March 2017 - tor-commits - lists.torproject.org

[torbirdy/develop] Update install.rdf and license for 2017
by sukhbir＠torproject.org 26 Mar '17

26 Mar '17

commit 3313298262c384d6deeab8a79218c6d32883e147 Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Sat Mar 18 01:57:30 2017 -0400 Update install.rdf and license for 2017 --- LICENSE | 2 +- install.rdf | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/LICENSE b/LICENSE index b6be8c1..e0b814b 100644 --- a/LICENSE +++ b/LICENSE @@ -1,5 +1,5 @@ +Copyright (c) 2012-2017, Sukhbir Singh <sukhbir(a)torproject.org> Copyright (c) 2012-2013, Jacob Appelbaum <jacob(a)torproject.org> -Copyright (c) 2012-2013, Sukhbir Singh <sukhbir(a)torproject.org> All rights reserved. Redistribution and use in source and binary forms, with or without diff --git a/install.rdf b/install.rdf index 93736d4..4bddc6a 100644 --- a/install.rdf +++ b/install.rdf @@ -4,7 +4,7 @@ xmlns:em="http://www.mozilla.org/2004/em-rdf#"> <Description about="urn:mozilla:install-manifest"> <em:id>castironthunderbirdclub(a)torproject.org</em:id> - <em:version>0.2.1</em:version> + <em:version>0.2.2</em:version> <em:type>2</em:type> <em:iconURL>chrome://castironthunderbirdclub/skin/images/tor.png</em:iconURL> @@ -20,7 +20,8 @@  <em:name>TorBirdy</em:name> <em:description>This extension configures Thunderbird to make connections over the Tor anonymity network</em:description> - <em:creator>Jacob Appelbaum & Sukhbir Singh</em:creator> + <em:creator>Sukhbir Singh</em:creator> + <em:contributor>Jacob Appelbaum</em:contributor> <em:contributor>tagnaq</em:contributor> <em:homepageURL>https://www.torproject.org/</em:homepageURL> <em:optionsURL>chrome://castironthunderbirdclub/content/preferences.xul</em:optionsURL>

1 0

[torbirdy/develop] Allow specifying that Enigmail keyserver communication is torified already.
by sukhbir＠torproject.org 26 Mar '17

26 Mar '17

commit 09acfd09c465ba9cb50b6a4d03f155f02a081391 Author: intrigeri <intrigeri(a)boum.org> Date: Tue Jan 31 16:04:33 2017 +0000 Allow specifying that Enigmail keyserver communication is torified already. This can be done by setting extensions.torbirdy.enigmail.already_torified to true. It is needed e.g. when using GnuPG 2.1+, in which case these keyserver options break dirmngr: no-try-dns-srv,http-proxy=socks5h://127.0.0.1:9150 ... as reported e.g. on https://trac.torproject.org/projects/tor/ticket/19971 and https://labs.riseup.net/code/issues/11948. The correct way to torify keyserver communication with Modern GnuPG is to set "use-tor" in ~/.gnupg/dirmngr.conf. Let's not break things for users who have configured this properly, e.g. Tails. Note that the Enigmail master branch has code to use Tor for keyserver operations. My understanding of the code is that it supports GnuPG 2 nicely, and detects whether dirmngr is already configured to use Tor. Once that's released and ready for production use, the parts of the Torbirdy code that are about torifying Enigmail communication with keyservers can go away: https://sourceforge.net/p/enigmail/source/ci/74e19771ec18cd5e7b542c32a9b34d… ... which is why I didn't bother investing time into a nicer solution on Torbirdy's side. --- chrome/content/overlay.js | 1 + chrome/content/preferences.js | 13 ++++++++----- components/torbirdy.js | 2 +- defaults/preferences/prefs.js | 1 + 4 files changed, 11 insertions(+), 6 deletions(-) diff --git a/chrome/content/overlay.js b/chrome/content/overlay.js index 1f72c9d..f0c0304 100644 --- a/chrome/content/overlay.js +++ b/chrome/content/overlay.js @@ -40,6 +40,7 @@ // Tor. if (type === 0) { myPanel.label = strbundle.getString("torbirdy.enabled.tor"); + org.torbirdy.prefs.setProxyTor(); } // JonDo/Whonix. if (type === 1) { diff --git a/chrome/content/preferences.js b/chrome/content/preferences.js index eb4c9b8..ebfc13a 100644 --- a/chrome/content/preferences.js +++ b/chrome/content/preferences.js @@ -41,17 +41,19 @@ if (!org.torbirdy.prefs) org.torbirdy.prefs = new function() { if (pub.prefs.getBoolPref("extensions.torbirdy.enigmail.throwkeyid")) { opts += "--throw-keyids "; } - var proxy = "socks5h://127.0.0.1:9150"; - if (anonService === "jondo") { - proxy = "http://127.0.0.1:4001"; + if (! pub.prefs.getBoolPref("extensions.torbirdy.gpg_already_torified")) { + var proxy = "socks5h://127.0.0.1:9150"; + if (anonService === "jondo") { + proxy = "http://127.0.0.1:4001"; + } + opts += "--keyserver-options=no-try-dns-srv,http-proxy=" + proxy + " "; } return opts + "--no-emit-version " + "--no-comments " + "--display-charset utf-8 " + - "--keyserver-options no-auto-key-retrieve,no-try-dns-srv,http-proxy=" + - proxy; + "--keyserver-options no-auto-key-retrieve"; }; pub.updateKeyserver = function(anonService) { @@ -201,6 +203,7 @@ if (!org.torbirdy.prefs) org.torbirdy.prefs = new function() { pub.setPanelSettings(pub.strBundle.GetStringFromName("torbirdy.enabled.tor"), "green"); pub.prefs.setIntPref(pub.prefBranch + 'proxy', 0); + pub.setPreferences("extensions.enigmail.agentAdditionalParam", pub.setEnigmailPrefs("tor")); }; pub.setProxyJonDo = function() { diff --git a/components/torbirdy.js b/components/torbirdy.js index ebdef02..64ab390 100644 --- a/components/torbirdy.js +++ b/components/torbirdy.js @@ -272,7 +272,7 @@ var TorBirdyPrefs = { // We want to force UTF-8 everywhere "--display-charset utf-8 " + // We want to ensure that Enigmail is proxy aware even when it runs gpg in a shell - "--keyserver-options http-proxy=socks5h://127.0.0.1:9150 ", + "--keyserver-options http-proxy=socks5h://127.0.0.1:9050 ", // The default key server should be a hidden service; use the Tor OnionBalance hidden service pool (https://sks-keyservers.net/overview-of-pools.php#pool_tor) "extensions.enigmail.keyserver": "hkp://jirk5u4osbsr34t5.onion", diff --git a/defaults/preferences/prefs.js b/defaults/preferences/prefs.js index 8b43562..ea316d3 100644 --- a/defaults/preferences/prefs.js +++ b/defaults/preferences/prefs.js @@ -5,6 +5,7 @@ pref("extensions.torbirdy.warn", true); pref("extensions.torbirdy.startup_folder", false); pref("extensions.torbirdy.enigmail.throwkeyid", false); pref("extensions.torbirdy.enigmail.confirmemail", false); +pref("extensions.torbirdy.gpg_already_torified", false); pref("extensions.torbirdy.timezone", true); pref("extensions.torbirdy.whonix_run", true); pref("extensions.torbirdy.info_run", false);

1 0

[torbirdy/develop] Remove redundant comment about Gecko compatibility
by sukhbir＠torproject.org 26 Mar '17

26 Mar '17

commit 917249091c2431511d21b34221e31cdefdd7499a Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Sun Mar 26 05:05:21 2017 -0400 Remove redundant comment about Gecko compatibility --- components/torbirdy.js | 3 --- 1 file changed, 3 deletions(-) diff --git a/components/torbirdy.js b/components/torbirdy.js index c1bb474..a51efa2 100644 --- a/components/torbirdy.js +++ b/components/torbirdy.js @@ -598,9 +598,6 @@ TorBirdy.prototype = { var accounts = this.acctMgr.accounts; var allAccounts = []; - // To maintain compatibility between Gecko 17+ and Gecko < 17, find out - // which version we are on. - var accountLength = accounts.length; for (let i = 0; i < accountLength; i++) { var account = accounts.queryElementAt(i, Ci.nsIMsgAccount);

1 0

[torbirdy/develop] Update the changelog for version 0.2.2
by sukhbir＠torproject.org 26 Mar '17

26 Mar '17

commit eb4f76939e0accedc76fe2e7d57824612fdc7781 Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Sun Mar 26 04:47:50 2017 -0400 Update the changelog for version 0.2.2 --- ChangeLog | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ChangeLog b/ChangeLog index 8985cd1..6787b69 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +0.2.2, + * Bug 20751: Enforce stronger ciphers in TorBirdy + * Bug 16935, 19971: Add support for already torified keyserver communication + using modern GnuPG + * Update default keyserver to OnionBalance hidden service pool + 0.2.1, 30 Nov 2016 * Bug 20157: Do not set calendar timezone to UTC * Bug 20750, 20644: Ensure RSS feeds are displayed in plain text

1 0

[torbirdy/develop] Bug 20751: Enforce stronger ciphers in TorBirdy
by sukhbir＠torproject.org 26 Mar '17

26 Mar '17

commit c0e12ccb97ac07861417bbffbac58f95557bc23c Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Sat Mar 18 01:58:04 2017 -0400 Bug 20751: Enforce stronger ciphers in TorBirdy --- components/torbirdy.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/components/torbirdy.js b/components/torbirdy.js index 64ab390..c1bb474 100644 --- a/components/torbirdy.js +++ b/components/torbirdy.js @@ -123,7 +123,8 @@ var TorBirdyPrefs = { "security.enable_ssl3": false, // Thunderbird 23.0 uses the following preference. // https://bugs.torproject.org/11253 - "security.tls.version.min": 1, + // March 2017: See https://bugs.torproject.org/20751 + "security.tls.version.min": 3, "security.tls.version.max": 3, // Display a dialog warning the user when entering an insecure site from a secure one. "security.warn_entering_weak": true,

1 0

[torbirdy/master] Remove redundant comment about Gecko compatibility
by sukhbir＠torproject.org 26 Mar '17

26 Mar '17

commit 917249091c2431511d21b34221e31cdefdd7499a Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Sun Mar 26 05:05:21 2017 -0400 Remove redundant comment about Gecko compatibility --- components/torbirdy.js | 3 --- 1 file changed, 3 deletions(-) diff --git a/components/torbirdy.js b/components/torbirdy.js index c1bb474..a51efa2 100644 --- a/components/torbirdy.js +++ b/components/torbirdy.js @@ -598,9 +598,6 @@ TorBirdy.prototype = { var accounts = this.acctMgr.accounts; var allAccounts = []; - // To maintain compatibility between Gecko 17+ and Gecko < 17, find out - // which version we are on. - var accountLength = accounts.length; for (let i = 0; i < accountLength; i++) { var account = accounts.queryElementAt(i, Ci.nsIMsgAccount);

1 0

[torbirdy/master] Use the Tor OnionBalance hidden service pool as the default keyserver.
by sukhbir＠torproject.org 26 Mar '17

26 Mar '17

commit ac74d777a3a7fd53d3f52a278e7bad4959070bee Author: intrigeri <intrigeri(a)boum.org> Date: Tue Jan 31 15:54:01 2017 +0000 Use the Tor OnionBalance hidden service pool as the default keyserver. --- chrome/content/preferences.js | 2 +- components/torbirdy.js | 4 ++-- gpg.conf | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/chrome/content/preferences.js b/chrome/content/preferences.js index 59fe209..eb4c9b8 100644 --- a/chrome/content/preferences.js +++ b/chrome/content/preferences.js @@ -7,7 +7,7 @@ if (!org.torbirdy.prefs) org.torbirdy.prefs = new function() { pub.prefBranch = "extensions.torbirdy."; pub.customBranch = "extensions.torbirdy.custom."; - pub.torKeyserver = "hkp://qdigse2yzvuglcix.onion"; + pub.torKeyserver = "hkp://jirk5u4osbsr34t5.onion"; pub.jondoKeyserver = "hkp://pool.sks-keyservers.net"; pub.prefs = Components.classes["@mozilla.org/preferences-service;1"] diff --git a/components/torbirdy.js b/components/torbirdy.js index 41baf5f..ebdef02 100644 --- a/components/torbirdy.js +++ b/components/torbirdy.js @@ -274,8 +274,8 @@ var TorBirdyPrefs = { // We want to ensure that Enigmail is proxy aware even when it runs gpg in a shell "--keyserver-options http-proxy=socks5h://127.0.0.1:9150 ", - // The default key server should be a hidden service and this is the only known one (it's part of the normal SKS network) - "extensions.enigmail.keyserver": "hkp://qdigse2yzvuglcix.onion", + // The default key server should be a hidden service; use the Tor OnionBalance hidden service pool (https://sks-keyservers.net/overview-of-pools.php#pool_tor) + "extensions.enigmail.keyserver": "hkp://jirk5u4osbsr34t5.onion", // Force GnuPG to use SHA512. "extensions.enigmail.mimeHashAlgorithm": 5, diff --git a/gpg.conf b/gpg.conf index 82a20c7..a499eaa 100644 --- a/gpg.conf +++ b/gpg.conf @@ -19,7 +19,7 @@ display-charset utf-8 ## Proxy settings keyserver-options http-proxy=socks5://TORIP:TORPORT -keyserver hkp://qdigse2yzvuglcix.onion +keyserver hkp://jirk5u4osbsr34t5.onion ## END some suggestions from TorBirdy TorBirdy setting extensions.enigmail.agentAdditionalParam ##################################################################

1 0

[torbirdy/master] Allow specifying that Enigmail keyserver communication is torified already.
by sukhbir＠torproject.org 26 Mar '17

26 Mar '17

commit 09acfd09c465ba9cb50b6a4d03f155f02a081391 Author: intrigeri <intrigeri(a)boum.org> Date: Tue Jan 31 16:04:33 2017 +0000 Allow specifying that Enigmail keyserver communication is torified already. This can be done by setting extensions.torbirdy.enigmail.already_torified to true. It is needed e.g. when using GnuPG 2.1+, in which case these keyserver options break dirmngr: no-try-dns-srv,http-proxy=socks5h://127.0.0.1:9150 ... as reported e.g. on https://trac.torproject.org/projects/tor/ticket/19971 and https://labs.riseup.net/code/issues/11948. The correct way to torify keyserver communication with Modern GnuPG is to set "use-tor" in ~/.gnupg/dirmngr.conf. Let's not break things for users who have configured this properly, e.g. Tails. Note that the Enigmail master branch has code to use Tor for keyserver operations. My understanding of the code is that it supports GnuPG 2 nicely, and detects whether dirmngr is already configured to use Tor. Once that's released and ready for production use, the parts of the Torbirdy code that are about torifying Enigmail communication with keyservers can go away: https://sourceforge.net/p/enigmail/source/ci/74e19771ec18cd5e7b542c32a9b34d… ... which is why I didn't bother investing time into a nicer solution on Torbirdy's side. --- chrome/content/overlay.js | 1 + chrome/content/preferences.js | 13 ++++++++----- components/torbirdy.js | 2 +- defaults/preferences/prefs.js | 1 + 4 files changed, 11 insertions(+), 6 deletions(-) diff --git a/chrome/content/overlay.js b/chrome/content/overlay.js index 1f72c9d..f0c0304 100644 --- a/chrome/content/overlay.js +++ b/chrome/content/overlay.js @@ -40,6 +40,7 @@ // Tor. if (type === 0) { myPanel.label = strbundle.getString("torbirdy.enabled.tor"); + org.torbirdy.prefs.setProxyTor(); } // JonDo/Whonix. if (type === 1) { diff --git a/chrome/content/preferences.js b/chrome/content/preferences.js index eb4c9b8..ebfc13a 100644 --- a/chrome/content/preferences.js +++ b/chrome/content/preferences.js @@ -41,17 +41,19 @@ if (!org.torbirdy.prefs) org.torbirdy.prefs = new function() { if (pub.prefs.getBoolPref("extensions.torbirdy.enigmail.throwkeyid")) { opts += "--throw-keyids "; } - var proxy = "socks5h://127.0.0.1:9150"; - if (anonService === "jondo") { - proxy = "http://127.0.0.1:4001"; + if (! pub.prefs.getBoolPref("extensions.torbirdy.gpg_already_torified")) { + var proxy = "socks5h://127.0.0.1:9150"; + if (anonService === "jondo") { + proxy = "http://127.0.0.1:4001"; + } + opts += "--keyserver-options=no-try-dns-srv,http-proxy=" + proxy + " "; } return opts + "--no-emit-version " + "--no-comments " + "--display-charset utf-8 " + - "--keyserver-options no-auto-key-retrieve,no-try-dns-srv,http-proxy=" + - proxy; + "--keyserver-options no-auto-key-retrieve"; }; pub.updateKeyserver = function(anonService) { @@ -201,6 +203,7 @@ if (!org.torbirdy.prefs) org.torbirdy.prefs = new function() { pub.setPanelSettings(pub.strBundle.GetStringFromName("torbirdy.enabled.tor"), "green"); pub.prefs.setIntPref(pub.prefBranch + 'proxy', 0); + pub.setPreferences("extensions.enigmail.agentAdditionalParam", pub.setEnigmailPrefs("tor")); }; pub.setProxyJonDo = function() { diff --git a/components/torbirdy.js b/components/torbirdy.js index ebdef02..64ab390 100644 --- a/components/torbirdy.js +++ b/components/torbirdy.js @@ -272,7 +272,7 @@ var TorBirdyPrefs = { // We want to force UTF-8 everywhere "--display-charset utf-8 " + // We want to ensure that Enigmail is proxy aware even when it runs gpg in a shell - "--keyserver-options http-proxy=socks5h://127.0.0.1:9150 ", + "--keyserver-options http-proxy=socks5h://127.0.0.1:9050 ", // The default key server should be a hidden service; use the Tor OnionBalance hidden service pool (https://sks-keyservers.net/overview-of-pools.php#pool_tor) "extensions.enigmail.keyserver": "hkp://jirk5u4osbsr34t5.onion", diff --git a/defaults/preferences/prefs.js b/defaults/preferences/prefs.js index 8b43562..ea316d3 100644 --- a/defaults/preferences/prefs.js +++ b/defaults/preferences/prefs.js @@ -5,6 +5,7 @@ pref("extensions.torbirdy.warn", true); pref("extensions.torbirdy.startup_folder", false); pref("extensions.torbirdy.enigmail.throwkeyid", false); pref("extensions.torbirdy.enigmail.confirmemail", false); +pref("extensions.torbirdy.gpg_already_torified", false); pref("extensions.torbirdy.timezone", true); pref("extensions.torbirdy.whonix_run", true); pref("extensions.torbirdy.info_run", false);

1 0

[torbirdy/master] Update install.rdf and license for 2017
by sukhbir＠torproject.org 26 Mar '17

26 Mar '17

commit 3313298262c384d6deeab8a79218c6d32883e147 Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Sat Mar 18 01:57:30 2017 -0400 Update install.rdf and license for 2017 --- LICENSE | 2 +- install.rdf | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/LICENSE b/LICENSE index b6be8c1..e0b814b 100644 --- a/LICENSE +++ b/LICENSE @@ -1,5 +1,5 @@ +Copyright (c) 2012-2017, Sukhbir Singh <sukhbir(a)torproject.org> Copyright (c) 2012-2013, Jacob Appelbaum <jacob(a)torproject.org> -Copyright (c) 2012-2013, Sukhbir Singh <sukhbir(a)torproject.org> All rights reserved. Redistribution and use in source and binary forms, with or without diff --git a/install.rdf b/install.rdf index 93736d4..4bddc6a 100644 --- a/install.rdf +++ b/install.rdf @@ -4,7 +4,7 @@ xmlns:em="http://www.mozilla.org/2004/em-rdf#"> <Description about="urn:mozilla:install-manifest"> <em:id>castironthunderbirdclub(a)torproject.org</em:id> - <em:version>0.2.1</em:version> + <em:version>0.2.2</em:version> <em:type>2</em:type> <em:iconURL>chrome://castironthunderbirdclub/skin/images/tor.png</em:iconURL> @@ -20,7 +20,8 @@  <em:name>TorBirdy</em:name> <em:description>This extension configures Thunderbird to make connections over the Tor anonymity network</em:description> - <em:creator>Jacob Appelbaum & Sukhbir Singh</em:creator> + <em:creator>Sukhbir Singh</em:creator> + <em:contributor>Jacob Appelbaum</em:contributor> <em:contributor>tagnaq</em:contributor> <em:homepageURL>https://www.torproject.org/</em:homepageURL> <em:optionsURL>chrome://castironthunderbirdclub/content/preferences.xul</em:optionsURL>

1 0

[torbirdy/master] Bug 20751: Enforce stronger ciphers in TorBirdy
by sukhbir＠torproject.org 26 Mar '17

26 Mar '17

commit c0e12ccb97ac07861417bbffbac58f95557bc23c Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Sat Mar 18 01:58:04 2017 -0400 Bug 20751: Enforce stronger ciphers in TorBirdy --- components/torbirdy.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/components/torbirdy.js b/components/torbirdy.js index 64ab390..c1bb474 100644 --- a/components/torbirdy.js +++ b/components/torbirdy.js @@ -123,7 +123,8 @@ var TorBirdyPrefs = { "security.enable_ssl3": false, // Thunderbird 23.0 uses the following preference. // https://bugs.torproject.org/11253 - "security.tls.version.min": 1, + // March 2017: See https://bugs.torproject.org/20751 + "security.tls.version.min": 3, "security.tls.version.max": 3, // Display a dialog warning the user when entering an insecure site from a secure one. "security.warn_entering_weak": true,

1 0