April 2014 - tor-commits - lists.torproject.org

[tor-browser-spec/master] Improve "New Identity" documentation.
by mikeperry＠torproject.org 28 Apr '14

28 Apr '14

commit 33506d4a7d41846de45dc53f0d61f77ad021a8ff Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Feb 19 13:58:58 2013 -0800 Improve "New Identity" documentation. --- docs/design/design.xml | 60 ++++++++++++++++++++++++++++++++---------------- 1 file changed, 40 insertions(+), 20 deletions(-) diff --git a/docs/design/design.xml b/docs/design/design.xml index 4d005de..59ce6ef 100644 --- a/docs/design/design.xml +++ b/docs/design/design.xml @@ -591,8 +591,8 @@ with cookies as well. <para> These types of attacks are attempts at subverting our <link -linkend="identifier-linkability">Cross-Origin Identifier Unlinkability</ulink> and <link -linkend="new-identity">Long-Term Unlikability</ulink> design requirements. +linkend="identifier-linkability">Cross-Origin Identifier Unlinkability</link> and <link +linkend="new-identity">Long-Term Unlikability</link> design requirements. </para> </listitem> @@ -605,8 +605,8 @@ of the browser. This information can be used to reduce anonymity set, or even uniquely fingerprint individual users. Attacks of this nature are typically aimed at tracking users across sites without their consent, in an attempt to subvert our <link linkend="fingerprinting-linkability">Cross-Origin -Fingerprinting Unlinkability</ulink> and <link -linkend="new-identity">Long-Term Unlikability</ulink> design requirements. +Fingerprinting Unlinkability</link> and <link +linkend="new-identity">Long-Term Unlikability</link> design requirements. </para> @@ -1509,8 +1509,11 @@ Currently we simply disable WebGL. <sect2 id="new-identity"> <title>Long-Term Unlinkability via "New Identity" button</title> <para> + In order to avoid long-term linkability, we provide a "New Identity" context -menu option in Torbutton. +menu option in Torbutton. This context menu option is active if Torbutton can +read the environment variables $TOR_CONTROL_PASSWD and $TOR_CONTROL_PORT. + </para> <sect3> @@ -1525,25 +1528,42 @@ All linkable identifiers and browser state MUST be cleared by this feature. <sect3> <title>Implementation Status:</title> <blockquote> + <para> + +First, Torbutton disables Javascript in all open tabs and windows by using +both the <ulink +url="https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsIDocSh…">browser.docShell.allowJavascript<ulink> +attribute as well as <ulink +url="https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsIDOMWi…">nsIDOMWindowUtil.suppressEventHandling()</ulink>. +We then stop all page activity for each tab using <ulink +url="https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsIWebNa…">browser.webNavigation.stop(nsIWebNavigation.STOP_ALL)</ulink>. +We then clear the site-specific Zoom by temporarily disabling the preference +<command>browser.zoom.siteSpecific</command>, and clear the GeoIP wiki token +URL and the last opened URL prefs (if they exist). Each tab is then closed. + + </para> + <para> -First, Torbutton disables all open tabs and windows by tagging them and -blocking them via the nsIContentPolicy, and then closes each tab and -window. The extra step for blocking tabs is done as a precaution to ensure -that any asynchronous Javascript is in fact properly disabled. After closing -all of the windows, we then clear the following state: OCSP (by toggling -security.OCSP.enabled), cache, site-specific zoom and content preferences, -Cookies, DOM storage, safe browsing key, the Google wifi geolocation token (if -exists), HTTP auth, SSL Session IDs, HSTS state, close all remaining HTTP -keep-alive connections, and clear the last opened URL field (via the pref -general.open_location.last_url). After clearing the browser state, we then -send the NEWNYM signal to the Tor control port to cause a new circuit to be -created. +After closing all tabs, we then clear the following state: searchbox and +findbox text, HTTP auth, SSL state, OCSP state, site-specific content +preferences (including HSTS state), content and image cache, Cookies, DOM storage, safe browsing key, the +Google wifi geolocation token (if exists). + </para> + <para> + +After the state is cleared, we then close all remaining HTTP keep-alive +connections and then send the NEWNYM signal to the Tor control port to cause a +new circuit to be created. + </para> + <para> +Finally, a fresh browser window is opened, and the current browser window is +closed. + </para> </blockquote> <blockquote> -Additionally, the user is allowed to "protect" cookies of their choosing from -deletion during New Identity by using the Torbutton Cookie Protections UI to -protect the cookies they would like to keep across New Identity invocations. +If the user chose to "protect" cookie by using the Torbutton Cookie +Protections UI, those cookies are not cleared as part of the above. </blockquote> </sect3> </sect2>

1 0

[tor-browser-spec/master] Link to trac tags.
by mikeperry＠torproject.org 28 Apr '14

28 Apr '14

commit 481857338cd4ed282aa2bf2135e1f9f57eff1150 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Feb 19 17:15:58 2013 -0800 Link to trac tags. --- docs/design/design.xml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/docs/design/design.xml b/docs/design/design.xml index 65b6a01..d409da6 100644 --- a/docs/design/design.xml +++ b/docs/design/design.xml @@ -1274,6 +1274,10 @@ functionality. </para> </listitem> </orderedlist> + <para> +For more details on identifier linkability bugs and enhancements, see the <ulink +url="https://trac.torproject.org/projects/tor/query?keywords=~tbb-linkability&am…">tbb-linkability tag in our bugtracker</ulink> + </para> </sect2> <sect2 id="fingerprinting-linkability"> <title>Cross-Origin Fingerprinting Unlinkability</title> @@ -1604,6 +1608,10 @@ We have no implementation as of yet. </listitem> </orderedlist> </sect3> + <para> +For more details on identifier linkability bugs and enhancements, see the <ulink +url="https://trac.torproject.org/projects/tor/query?keywords=~tbb-fingerprinting…">tbb-fingerprinting tag in our bugtracker</ulink> + </para> </sect2> <sect2 id="new-identity"> <title>Long-Term Unlinkability via "New Identity" button</title>

1 0

[tor-browser-spec/master] Update disk avoidance section.
by mikeperry＠torproject.org 28 Apr '14

28 Apr '14

commit a56f78d36461feddcfbdc90978fdcff4544d999d Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Feb 19 17:10:56 2013 -0800 Update disk avoidance section. Hrmm. This section is really ugly... --- docs/design/design.xml | 86 +++++++++++++++++++++++++----------------------- 1 file changed, 44 insertions(+), 42 deletions(-) diff --git a/docs/design/design.xml b/docs/design/design.xml index aa4dd99..65b6a01 100644 --- a/docs/design/design.xml +++ b/docs/design/design.xml @@ -876,50 +876,22 @@ Flash cookies from leaking from a pre-existing Flash directory. <sect3> <title>Design Goal:</title> <blockquote> -Tor Browser MUST (at user option) prevent all disk records of browser activity. + +The User Agent MUST (at user option) prevent all disk records of browser activity. The user should be able to optionally enable URL history and other history -features if they so desire. Once we <ulink -url="https://trac.torproject.org/projects/tor/ticket/3100">simplify the -preferences interface</ulink>, we will likely just enable Private Browsing -mode by default to handle this goal. +features if they so desire. + </blockquote> </sect3> <sect3> <title>Implementation Status:</title> <blockquote> -For now, Tor Browser blocks write access to the disk through Torbutton -using several Firefox preferences. - - - - -The set of prefs is: -<command>dom.storage.enabled</command>, -<command>network.http.use-cache</command>, -<command>browser.cache.disk.enable</command>, -<command>browser.cache.disk.capacity</command>, -<command>browser.cache.offline.enable</command>, -<command>general.open_location.last_url</command>, -<command>places.history.enabled</command>, -<command>browser.formfill.enable</command>, -<command>signon.rememberSignons</command>, -<command>browser.download.manager.retention</command>, -<command>dom.indexedDB.enabled</command>, -and <command>network.cookie.lifetimePolicy</command>. - </blockquote> - </sect3> - <para> - -Torbutton also <ulink -url="https://gitweb.torproject.org/torbutton.git/blob/HEAD:/src/components/tbSes…">contains -code</ulink> to prevent the Firefox session store from writing to disk. - </para> - <para> -In addition, three Firefox patches are needed to prevent disk writes, even if +We achieve this goal through several mechanisms. First, we set the Firefox +Private Browsing preference +<command>browser.privatebrowsing.autostart</command>. In addition, four Firefox patches are needed to prevent disk writes, even if Private Browsing Mode is enabled. We need to - <ulink url="https://gitweb.torproject.org/torbrowser.git/blob/maint-2.4:/src/current-pa…">prevent the permissions manager from recording HTTPS STS state</ulink>, @@ -933,16 +905,40 @@ download history from being recorded</ulink>, and url="https://gitweb.torproject.org/torbrowser.git/blob/maint-2.4:/src/current-pa…">prevent the content preferences service from recording site zoom</ulink>. - - For more details on these patches, <link linkend="firefox-patches">see the Firefox Patches section</link>. - </para> - <para> + </blockquote> + <blockquote> + +As an additional defense-in-depth measure, we set the following preferences: +<command></command>, +<command>browser.cache.disk.enable</command>, +<command>browser.cache.offline.enable</command>, +<command>dom.indexedDB.enabled</command>, +<command>network.cookie.lifetimePolicy</command>, +<command>signon.rememberSignons</command>, +<command>browser.formfill.enable</command>, +<command>browser.download.manager.retention</command>, +<command>browser.sessionstore.privacy_level</command>, +and <command>network.cookie.lifetimePolicy</command>. Many of these +preferences are likely redundant with +<command>browser.privatebrowsing.autostart</command>, but we have not done the +auditing work to ensure that yet. + + </blockquote> + <blockquote> + +Torbutton also <ulink +url="https://gitweb.torproject.org/torbutton.git/blob/HEAD:/src/components/tbSes…">contains +code</ulink> to prevent the Firefox session store from writing to disk. + </blockquote> + <blockquote> + For more details on disk leak bugs and enhancements, see the <ulink url="https://trac.torproject.org/projects/tor/query?keywords=~tbb-disk-leak&…">tbb-disk-leak tag in our bugtracker</ulink> - </para> + </blockquote> + </sect3> </sect2> <sect2 id="app-data-isolation"> <title>Application Data Isolation</title> @@ -954,9 +950,15 @@ safely remove the bundle without leaving other traces of Tor usage on their computer. </para> - <para>FIXME: sjmurdoch, Erinn: explain what magic we do to satisfy this, -and/or what additional work or auditing needs to be done. + <para> + +To ensure TBB directory isolation, we set +<command>browser.download.useDownloadDir</command>, +<command>browser.shell.checkDefaultBrowser</command>, and +<command>browser.download.manager.addToRecentDocs</command>. We also set the +$HOME environment variable to be the TBB extraction directory. </para> + </sect2> <!-- FIXME: Write me... <sect2 id="update-safety">

1 0

[tor-browser-spec/master] Describe Firefox Patches.
by mikeperry＠torproject.org 28 Apr '14

28 Apr '14

commit 5dabf48347c7c63d83a05abf28fa16f73f8cd3eb Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Feb 19 18:39:10 2013 -0800 Describe Firefox Patches. --- docs/design/design.xml | 57 ++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 50 insertions(+), 7 deletions(-) diff --git a/docs/design/design.xml b/docs/design/design.xml index a3aa7fc..52c4112 100644 --- a/docs/design/design.xml +++ b/docs/design/design.xml @@ -1473,10 +1473,11 @@ desktop resolution. We have implemented the above strategy using a window observer to <ulink url="https://gitweb.torproject.org/torbutton.git/blob/HEAD:/src/chrome/content/t…">resize new windows based on desktop resolution</ulink>. Additionally, we patch -Firefox to <ulink -url="https://gitweb.torproject.org/torbrowser.git/blob/maint-2.4:/src/current-pa…">use -the client content window size</ulink> for window.screen and all desktop size -related media queries, and similarly <ulink +Firefox to use the client content window size <ulink +url="https://gitweb.torproject.org/torbrowser.git/blob/maint-2.4:/src/current-pa…">for +window.screen</ulink> and <ulink +url="https://gitweb.torproject.org/torbrowser.git/blob/maint-2.4:/src/current-pa…">for +CSS Media Queries</ulink>. Similarly, we <ulink url="https://gitweb.torproject.org/torbrowser.git/blob/maint-2.4:/src/current-pa…">patch DOM events to return content window relative points</ulink>. We also patch Firefox to <ulink @@ -1800,42 +1801,64 @@ by the <link linkend="new-identity">New Identity</link> button. <listitem>Limit Device and System Specific Media Queries <para> +<ulink url="https://developer.mozilla.org/en-US/docs/CSS/Media_queries">CSS +Media Queries</ulink> have a fingerprinting capability approaching that of +Javascript. This patch causes such Media Queries to evaluate as if the device +resolution was equal to the content window resolution. </para> </listitem> <listitem>Limit the number of fonts per document <para> +Font availability can be <ulink url="http://flippingtypical.com/">queried by +CSS and Javascript</ulink> and is a fingerprinting vector. This patch limits +the number of times CSS and Javascript can cause font-family rules to +evaluate. Remote @font-face fonts are exempt from the limits imposed by this +patch, and remote fonts are given priority over local fonts whenever both +appear in the same font-family rule. </para> </listitem> <listitem>Rebrand Firefox to Tor Browser <para> +This patch updates our branding in compliance with Mozilla's trademark policy. </para> </listitem> <listitem>Make Download Manager Memory Only <para> +This patch prevents disk leaks from the download manager. The original +behavior is to write the download history to disk and then delete it, even if +you disable download history from your Firefox preferences. </para> </listitem> <listitem>Add DDG and StartPage to Omnibox <para> +This patch adds DuckDuckGo and StartPage to the Search Box, and sets our +default search engine to StartPage. We deployed this patch due to excessive +Captchas and complete 403 bans from Google. </para> </listitem> <listitem>Make nsICacheService.EvictEntires() Synchronous <para> +This patch eliminates a race condition with "New Identity". Without it, +cache-based Evercookies survive for up to a minute after clearing the cache +on some platforms. </para> </listitem> <listitem>Prevent WebSockets DNS Leak <para> +This patch prevents a DNS leak when using WebSockets. It also prevents other +similar types of DNS leaks. </para> </listitem> @@ -1852,60 +1875,80 @@ pipeline, as well as their order. <listitem>Adapt Steve Michaud's Mac crashfix patch <para> +This patch allows us to block Drag and Drop without causing crashes on Mac OS. +We need to block Drag and Drop because Mac OS and Ubuntu both immediately load +any URLs they find in your drag buffer before you even drop them (without +using your browser's proxy settings, of course). </para> </listitem> <listitem>Add mozIThirdPartyUtil.getFirstPartyURI() API <para> +This patch provides an API that allows us to more easily isolate identifiers +to the URL bar domain. </para> </listitem> <listitem>Add canvas image extraction prompt <para> +This patch prompts the user before returning canvas image data. Canvas image +data can be used to create an extremely stable, high-entropy fingerprint based +on the unique rendering behavior of video cards, OpenGL behavior, +system fonts, and supporting library versions. </para> </listitem> <listitem>Return client window coordinates for mouse events <para> +This patch causes mouse events to return coordinates relative to the content +window instead of the desktop. </para> </listitem> - <listitem>Do not expose physical screen info viw window and CSS + <listitem>Do not expose physical screen info to window.screen <para> +This patch causes window.screen to return the display resolution size of the +content window instead of the desktop resolution size. </para> </listitem> <listitem>Do not expose system colors to CSS or canvas <para> +This patch prevents CSS and Javascript from discovering your desktop color +scheme and/or theme. </para> </listitem> <listitem>Isolate the Image Cache per url bar domain <para> +This patch prevents cached images from being used to store third party tracking +identifiers. </para> </listitem> <listitem>nsIHTTPChannel.redirectTo() API <para> +This patch provides HTTPS-Everywhere with an API to perform redirections more +securely and without addon conflicts. </para> </listitem> <listitem>Isolate DOM Storage to first party URI <para> +This patch prevents DOM Storage from being used to store third party tracking +identifiers. </para> </listitem> - - </orderedlist> </sect2>

1 0

[tor-browser-spec/master] Misc cleanups.
by mikeperry＠torproject.org 28 Apr '14

28 Apr '14

commit 11a592b57ea145a71ec5bee50fba522af0f288bd Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Feb 19 17:53:57 2013 -0800 Misc cleanups. --- docs/design/design.xml | 29 +++++++++++------------------ 1 file changed, 11 insertions(+), 18 deletions(-) diff --git a/docs/design/design.xml b/docs/design/design.xml index d409da6..f956ca4 100644 --- a/docs/design/design.xml +++ b/docs/design/design.xml @@ -440,7 +440,7 @@ be replaced with more privacy friendly, auditable alternatives. <para> A Tor web browser adversary has a number of goals, capabilities, and attack -types that can be used to guide us towards a set of requirements for the +types that can be used to illustrate the design requirements for the Tor Browser. Let's start with the goals. </para> @@ -758,7 +758,7 @@ are typically linked for these cases. Proxy obedience is assured through the following: </para> <orderedlist> - <listitem>Firefox Proxy settings + <listitem>Firefox proxy settings, patches, and build flags <para> Our <ulink url="https://gitweb.torproject.org/torbrowser.git/blob/HEAD:/build-scripts/confi…">Firefox @@ -837,13 +837,6 @@ url="https://gitweb.torproject.org/torbrowser.git/blob/maint-2.4:/src/current-pa for Flash and Gnash</ulink>. </para> - <para> - -Finally, even if the user alters their browser settings to re-enable the Flash -plugin, we have configured NoScript to provide click-to-play placeholders, so -that only desired objects will be loaded, and only after user confirmation. - - </para> </listitem> <listitem>External App Blocking <para> @@ -855,10 +848,10 @@ url="https://gitweb.torproject.org/torbutton.git/blob_plain/HEAD:/src/components provide the user with a popup</ulink> whenever the browser attempts to launch a helper app.  -Additionally, due primarily to an issue with Ubuntu Unity, url-based drag and drop is +Additionally, due to an issue with Ubuntu Unity, url-based drag and drop is filtered by this component. Unity was pre-fetching URLs without using the browser's proxy settings during a drag action, even if the drop was ultimately -canceled by the user. +canceled by the user. A similar issue was discovered on Mac OS. </para> </listitem> </orderedlist> @@ -1368,8 +1361,8 @@ url="http://www.w2spconf.com/2012/papers/w2sp12-final4.pdf">Initial studies</ulink> show that the Canvas can provide an easy-access fingerprinting target: The adversary simply renders WebGL, font, and named color data to a Canvas element, extracts the image buffer, and computes a hash of that image -data. Subtle differences in the video card, font packs, and even the font -library versions allow the adversary to produce a stable, simple, easy to use, +data. Subtle differences in the video card, font packs, and even font and +graphics library versions allow the adversary to produce a stable, simple, high-entropy fingerprint of a computer. In fact, the hash of the rendered image can be used almost identically to a tracking cookie by the web server. @@ -1653,8 +1646,9 @@ URL and the last opened URL prefs (if they exist). Each tab is then closed. After closing all tabs, we then clear the following state: searchbox and findbox text, HTTP auth, SSL state, OCSP state, site-specific content -preferences (including HSTS state), content and image cache, Cookies, DOM storage, safe browsing key, the -Google wifi geolocation token (if exists). +preferences (including HSTS state), content and image cache, Cookies, DOM +storage, safe browsing key, and the Google wifi geolocation token (if it +exists). </para> <para> @@ -1669,7 +1663,7 @@ closed. </para> </blockquote> <blockquote> -If the user chose to "protect" cookie by using the Torbutton Cookie +If the user chose to "protect" any cookies by using the Torbutton Cookie Protections UI, those cookies are not cleared as part of the above. </blockquote> </sect3> @@ -1839,7 +1833,6 @@ pipeline, as well as their order. - Set manually in profile - Update security - Thandy ---> <sect1 id="Packaging"> <title>Packaging</title> @@ -1856,7 +1849,6 @@ pipeline, as well as their order. </sect3> <sect3> <title>Excluded Addons</title> -  </sect3> <sect3> <title>Dangerous Addons</title> @@ -1871,6 +1863,7 @@ pipeline, as well as their order. <para> </para> </sect2> </sect1> +--> <sect1 id="Testing"> <title>Testing</title>

1 0

[tor-browser-spec/master] Start to fill in appendix..
by mikeperry＠torproject.org 28 Apr '14

28 Apr '14

commit d207190db7f171c80f72c3506177170ab32f2c67 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Feb 19 19:16:59 2013 -0800 Start to fill in appendix.. --- docs/design/design.xml | 44 +++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 43 insertions(+), 1 deletion(-) diff --git a/docs/design/design.xml b/docs/design/design.xml index 52c4112..4b0e53c 100644 --- a/docs/design/design.xml +++ b/docs/design/design.xml @@ -401,7 +401,7 @@ their proper deployment or privacy realization. However, we will likely disable high-risk features pending analysis, audit, and mitigation. </para> </listitem> - <listitem><command>Long Term Goal: Linkability Transparency</command> + <listitem><command>Strive for Linkability Transparency</command> <para>  Our long term goal is to reduce all linkability to mechanisms that are @@ -2255,4 +2255,46 @@ javascript into the chrome (and thus gain complete control of the browser). </sect2> --> </sect1> +<appendix id="Transparency"> +<title>Towards Linkability Transparency</title> +<para> + +In a few cases, entrenched (mis)use of certain browser features has caused us +to choose a less extreme implementation of linkability protections than we +would have liked. This section serves to enumerate those instances and +describe alternative standardards that have been proposed. + +</para> +<para> + +The primary goal of this section is to help describe a web where websites can +be easily audited for good privacy practices. Right now, there are too many +ways where XXX.. + +</para> + +<sect1> + <title>Deprecation List</title> + <orderedlist> + <listitem>The Referer Header + <para> +We believe the Referer header should be either eliminated or made explicit. If +a site wishes to transmit its URL to third parties or during link-click, it +should specify this as a property of its HTML. The + </para> + </listitem> + <listitem>window.name + </listitem> + </orderedlist> +</sect1> +<sect1> + <title>Promising Standards</title> + <orderedlist> + <listitem>Web-Send Introducers + </listitem> + <listitem>Mozilla Persona + </listitem> + </orderedlist> +</sect1> +</appendix> </article>

1 0

[tor-browser-spec/master] Update proxy settings info to reflect recent findings.
by mikeperry＠torproject.org 28 Apr '14

28 Apr '14

commit 736dba839366f8d59e4df9630a8f6ebd44101271 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Feb 19 16:46:44 2013 -0800 Update proxy settings info to reflect recent findings. --- docs/design/design.xml | 46 +++++++++++++++++++++++++++++++++++----------- 1 file changed, 35 insertions(+), 11 deletions(-) diff --git a/docs/design/design.xml b/docs/design/design.xml index ea5bdad..aa4dd99 100644 --- a/docs/design/design.xml +++ b/docs/design/design.xml @@ -760,21 +760,45 @@ Proxy obedience is assured through the following: <orderedlist> <listitem>Firefox Proxy settings <para> - The Torbutton xpi sets the Firefox proxy settings to use Tor directly as a +Our <ulink +url="https://gitweb.torproject.org/torbrowser.git/blob/HEAD:/build-scripts/confi…">Firefox +preferences file</ulink> sets the Firefox proxy settings to use Tor directly as a SOCKS proxy. It sets <command>network.proxy.socks_remote_dns</command>, -<command>network.proxy.socks_version</command>, and -<command>network.proxy.socks_port</command>. +<command>network.proxy.socks_version</command>, +<command>network.proxy.socks_port</command>, and +<command>network.dns.disablePrefetch</command>. </para> <para> -We have verified that these settings properly proxy HTTPS, OCSP, HTTP, FTP, -gopher (now defunct), DNS, SafeBrowsing Queries, all javascript activity, -including HTML5 audio and video objects, addon updates, wifi geolocation -queries, searchbox queries, XPCOM addon HTTPS/HTTP activity, and live bookmark -updates. We have also verified that IPv6 connections are not attempted, -through the proxy or otherwise (Tor does not yet support IPv6). We have also -verified that external protocol helpers, such as smb urls and other custom -protocol handers are all blocked. +We also patch Firefox in order to <ulink +url="https://gitweb.torproject.org/torbrowser.git/blob/maint-2.4:/src/current-pa…">prevent +a DNS leak due to a WebSocket rate-limiting check</ulink>. As stated in the +patch, we believe the direct DNS resolution performed by this check is in +violation of the W3C standard, but <ulink +url="https://bugzilla.mozilla.org/show_bug.cgi?id=751465">this DNS proxy leak +remains present in stock Firefox releases</ulink>. + + </para> + <para> + +During the transition to Firefox 17-ESR, a code audit was undertaken to verify +that there were no system calls or XPCOM activity in the source tree that did +not use the browser proxy settings. The only violation we found was that +WebRTC was capable of creating UDP sockets and was compiled in by default. We +subsequently disabled it using the Firefox build option +<command>--disable-webrtc</command>. + + </para> + <para> + +We have verified that these settings and patches properly proxy HTTPS, OCSP, +HTTP, FTP, gopher (now defunct), DNS, SafeBrowsing Queries, all javascript +activity, including HTML5 audio and video objects, addon updates, wifi +geolocation queries, searchbox queries, XPCOM addon HTTPS/HTTP activity, +WebSockets, and live bookmark updates. We have also verified that IPv6 +connections are not attempted, through the proxy or otherwise (Tor does not +yet support IPv6). We have also verified that external protocol helpers, such +as smb urls and other custom protocol handers are all blocked. </para> <para>

1 0

[tor-browser-spec/master] Build fix.
by mikeperry＠torproject.org 28 Apr '14

28 Apr '14

commit 0a38922b906b5a6ad4581db375f97b1d823e3ea9 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Feb 19 17:56:50 2013 -0800 Build fix. --- docs/design/design.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/design/design.xml b/docs/design/design.xml index f956ca4..c265250 100644 --- a/docs/design/design.xml +++ b/docs/design/design.xml @@ -37,8 +37,8 @@ This document describes the <link linkend="adversary">adversary model</link>, <link linkend="DesignRequirements">design requirements</link>, -<link linkend="Implementation">implementation</link>, <link -linkend="Packaging">packaging</link> and <link linkend="Testing">testing +<link linkend="Implementation">implementation</link>,  and <link linkend="Testing">testing procedures</link> of the Tor Browser.

1 0

[tor-browser-spec/master] Remove references to jshooks. List Firefox patches.
by mikeperry＠torproject.org 28 Apr '14

28 Apr '14

commit 6ef26ec53f1ba11aa03d4831046e724d404074a0 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Feb 19 18:10:34 2013 -0800 Remove references to jshooks. List Firefox patches. --- docs/design/design.xml | 129 +++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 112 insertions(+), 17 deletions(-) diff --git a/docs/design/design.xml b/docs/design/design.xml index c265250..a3aa7fc 100644 --- a/docs/design/design.xml +++ b/docs/design/design.xml @@ -1470,16 +1470,18 @@ desktop resolution. </para> <para><command>Implementation Status:</command> -We have implemented the above strategy for Javascript using Torbutton's <ulink -url="https://gitweb.torproject.org/torbutton.git/blob/HEAD:/src/chrome/content/j…">JavaScript -hooks</ulink> as well as a window observer to <ulink +We have implemented the above strategy using a window observer to <ulink url="https://gitweb.torproject.org/torbutton.git/blob/HEAD:/src/chrome/content/t…">resize -new windows based on desktop resolution</ulink>. Additionally, we <ulink -url="https://gitweb.torproject.org/torbrowser.git/blob/maint-2.4:/src/current-pa…">patch -Firefox</ulink> to cause CSS Media Queries to use the client content window size -for all desktop size related media queries. We also <ulink -url="https://gitweb.torproject.org/torbrowser.git/blob/maint-2.4:/src/current-pa…">patch Firefox to report a -fixed set of system colors to content window CSS</ulink>. +new windows based on desktop resolution</ulink>. Additionally, we patch +Firefox to <ulink +url="https://gitweb.torproject.org/torbrowser.git/blob/maint-2.4:/src/current-pa…">use +the client content window size</ulink> for window.screen and all desktop size +related media queries, and similarly <ulink +url="https://gitweb.torproject.org/torbrowser.git/blob/maint-2.4:/src/current-pa…">patch +DOM events to return content window relative points</ulink>. We also patch +Firefox to <ulink +url="https://gitweb.torproject.org/torbrowser.git/blob/maint-2.4:/src/current-pa…">report +a fixed set of system colors to content window CSS</ulink>. </para> <para> @@ -1690,15 +1692,12 @@ The set of patches we have against Firefox can be found in the <ulink url="https://gitweb.torproject.org/torbrowser.git/tree/maint-2.4:/src/current-pa…">current-patches directory of the torbrowser git repository</ulink>. They are: </para> <orderedlist> - <listitem>Block Components.interfaces and Components.lookupMethod + <listitem>Block Components.interfaces <para> -In order to reduce fingerprinting, we block access to these two interfaces -from content script. Components.lookupMethod can undo our <ulink -url="https://gitweb.torproject.org/torbutton.git/blob/HEAD:/src/chrome/content/j…">Javascript -hooks</ulink>, -and Components.interfaces can be used for fingerprinting the platform, OS, and -Firebox version, but not much else. +In order to reduce fingerprinting, we block access to this interface from +content script. Components.interfaces can be used for fingerprinting the +platform, OS, and Firebox version, but not much else. </para> </listitem> @@ -1798,7 +1797,49 @@ by the <link linkend="new-identity">New Identity</link> button. </para> </listitem> - <listitem>Randomize HTTP pipeline order and depth + <listitem>Limit Device and System Specific Media Queries + <para> + + + </para> + </listitem> + <listitem>Limit the number of fonts per document + <para> + + + </para> + </listitem> + <listitem>Rebrand Firefox to Tor Browser + <para> + + + </para> + </listitem> + <listitem>Make Download Manager Memory Only + <para> + + + </para> + </listitem> + <listitem>Add DDG and StartPage to Omnibox + <para> + + + </para> + </listitem> + <listitem>Make nsICacheService.EvictEntires() Synchronous + <para> + + + </para> + </listitem> + <listitem>Prevent WebSockets DNS Leak + <para> + + + </para> + </listitem> + <listitem>Randomize HTTP pipeline order and depth <para> As an <ulink @@ -1808,6 +1849,60 @@ HTTP pipelining code to randomize the number of requests in a pipeline, as well as their order. </para> </listitem> + <listitem>Adapt Steve Michaud's Mac crashfix patch + <para> + + + </para> + </listitem> + <listitem>Add mozIThirdPartyUtil.getFirstPartyURI() API + <para> + + + </para> + </listitem> + <listitem>Add canvas image extraction prompt + <para> + + + </para> + </listitem> + <listitem>Return client window coordinates for mouse events + <para> + + + </para> + </listitem> + <listitem>Do not expose physical screen info viw window and CSS + <para> + + + </para> + </listitem> + <listitem>Do not expose system colors to CSS or canvas + <para> + + + </para> + </listitem> + <listitem>Isolate the Image Cache per url bar domain + <para> + + + </para> + </listitem> + <listitem>nsIHTTPChannel.redirectTo() API + <para> + + + </para> + </listitem> + <listitem>Isolate DOM Storage to first party URI + <para> + + + </para> + </listitem>

1 0

[tor-browser-spec/master] Update TODO with progress.
by mikeperry＠torproject.org 28 Apr '14

28 Apr '14

commit 6d9cdab5710592e791c5af32ce1c8759e90815a9 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Feb 19 19:17:09 2013 -0800 Update TODO with progress. --- docs/design/Firefox17-TODO | 70 ++++++++++++++++++++++++-------------------- 1 file changed, 39 insertions(+), 31 deletions(-) diff --git a/docs/design/Firefox17-TODO b/docs/design/Firefox17-TODO index 633f10a..41ef38e 100644 --- a/docs/design/Firefox17-TODO +++ b/docs/design/Firefox17-TODO @@ -16,36 +16,37 @@ + "Correlate activity across multiple site visits" as one of the adversary goals. This is the primary goal of the ad networks, though. We need to explicitly mention it in the Adversary Goals section for completeness. - - Misc implementation + + Misc implementation + Link to prefs.js and describe omni.ja and extension-overrides hacks - - document the environment variables and settings used to provide a non-grey "New Identity" button. - - Mockup privacy UI - - Identifier Linkability - - Image cache jail - - DOM storage jail - - 3.5.8 is not clear that what we're trying to limit is non-click + + document the environment variables and settings used to provide a non-grey "New Identity" button. + + Mockup privacy UI + + Identifier Linkability + + Image cache jail + + DOM storage jail + + 3.5.8 is not clear that what we're trying to limit is non-click driven/non-interactive linkability rather than linkability in all cases. Other sections may have this problem, too. - - This is a subtlety that arises from both the impossibility of satisfying + + This is a subtlety that arises from both the impossibility of satisfying unlinkability due to covert channels in GET/POST, as well as the desire to avoid breaking thinks like consensual federated login. - - He reminded me about documenting disabling IndexedDB, but that is just one - of the many prefs.js changes we need to document. - - We should only preserve window.name if the url bar domain remains the - same. I could be convinced of this, but it's going to be trickier to - implement and I think it's not really possible to remove linkability for user - clicks in general. - Fingerprinting - - @font-face exemption and preference - - Canvas prompt - - Click-to-play WebGL - - describe our resolution defenses - - Explain why panopticlick is weirdsauce - - provide an entropy count estimate for fingerprinting defenses - - We should perhaps be more vocal about the fingerprinting issues with + + @font-face exemption and preference + + Canvas prompt + + describe our resolution defenses + + Limit CSS media queries + + System colors + fonts + + Explain why panopticlick is weirdsauce + + We report our useragent as 17.0 + + Click-to-play WebGL + + We should perhaps be more vocal about the fingerprinting issues with some or all of http://www.w3.org/TR/navigation-timing/. I think I agree. - - We report our useragent as 17.0 + - provide an entropy count estimate for fingerprinting defenses + + Disk avoidance + + Private browsing + pref changes + + He reminded me about documenting disabling IndexedDB, but that is just one + of the many prefs.js changes we need to document. - Testing + - Explain why panopticlick is weirdsauce - Sync with QA pages - Many are out of date - http://www.stayinvisible.com/ @@ -57,18 +58,25 @@ + All-but-flash patch + Plugin manager manipulation + We use Firefox's click-to-play - - Addons - - PDF.js inclusion - - Torbutton does not update - - Torbutton Security Settings - - Update notification/version checking - - Socks ports + + Addons + + PDF.js inclusion + + List links to design violations/enhancements: + + https://trac.torproject.org/projects/tor/query?keywords=~tbb-linkability + + https://trac.torproject.org/projects/tor/query?keywords=~tbb-fingerprinting + - Update notification/version checking? - Create a deprecation list and link to it: - Referer Header - Window.name + - We should only preserve window.name if the url bar domain remains the + same. I could be convinced of this, but it's going to be trickier to + implement and I think it's not really possible to remove linkability for user + clicks in general. + - Torbutton Security Settings + +- Packaging + - Pref changes + - Socks ports + - Torbutton does not update -- List links to design violations/enhancements: - - https://trac.torproject.org/projects/tor/query?keywords=~tbb-linkability - - https://trac.torproject.org/projects/tor/query?keywords=~tbb-fingerprinting

1 0