March 2018 - tor-commits - lists.torproject.org

[webwml/staging] Merge branch 'irl-patch'
by arma＠torproject.org 29 Mar '18

29 Mar '18

commit 01e9e02fa8db2b27767fbd50487543fb4e8e5ffb Merge: a491b1d9 5c715e9a Author: hiromipaw <hiro(a)torproject.org> Date: Wed Feb 7 11:40:56 2018 +0100 Merge branch 'irl-patch' about/en/contributors.wml | 7 +++---- about/en/corepeople.wml | 4 ++-- docs/en/documentation.wml | 4 ++-- en/index.wml | 2 +- getinvolved/en/volunteer.wml | 29 +++++------------------------ 5 files changed, 13 insertions(+), 33 deletions(-)

1 0

[webwml/staging] Updates references for Atlas, Globe and Compass (Fixes: #24459)
by arma＠torproject.org 29 Mar '18

29 Mar '18

commit 8fa5262a79d473476b820bacd6c43014e2bc6db3 Author: Iain R. Learmonth <irl(a)fsfe.org> Date: Sun Dec 3 19:16:22 2017 +0000 Updates references for Atlas, Globe and Compass (Fixes: #24459) * Atlas is now known as Relay Search * Compass will soon no longer be running at compass.torproject.org * Globe has been not running for a while now --- about/en/contributors.wml | 7 +++---- about/en/corepeople.wml | 4 ++-- docs/en/documentation.wml | 4 ++-- docs/en/tor-doc-relay.wml | 8 ++++---- docs/en/tor-relay-debian.wml | 2 +- en/index.wml | 2 +- getinvolved/en/volunteer.wml | 29 +++++------------------------ 7 files changed, 18 insertions(+), 38 deletions(-) diff --git a/about/en/contributors.wml b/about/en/contributors.wml index 08d7c0a7..a27331c3 100644 --- a/about/en/contributors.wml +++ b/about/en/contributors.wml @@ -112,7 +112,7 @@ href="https://svn.torproject.org/cgi-bin/viewvc.cgi/torflow/branches/gsoc2008/"> <dt>Sathyanarayanan Gunasekaran, Developer</dt> <dd>Worked on Orbot in Google Summer of Code 2011, and developed <a -href="https://compass.torproject.org/">Compass</a>.</dd> +href="https://gitweb.torproject.org/compass.git/">Compass</a>.</dd> <dt>Marie Gutbub, Advocate</dt> <dd>Helps educate the world about the value of Tor, especially @@ -195,9 +195,8 @@ Perry.</dd> projects such as Vidalia, Torbutton and the website.</dd> <dt>Christian Schulz, Developer</dt> -<dd>Developed <a -href="https://globe.torproject.org/">Globe</a>, which is on -its way to replacing Atlas and eventually Compass.</dd> +<dd>Developed <a href="http://globe.rndm.de/">Globe</em>, a web application to +show information about relays that make up the Tor network.</dd> <dt>Andrea Shepard, Developer</dt> <dd>Works with Nick as a core Tor developer.</dd> diff --git a/about/en/corepeople.wml b/about/en/corepeople.wml index 0e1fd824..f7c88533 100644 --- a/about/en/corepeople.wml +++ b/about/en/corepeople.wml @@ -115,7 +115,7 @@ <div class="icon"><a href="https://db.torproject.org/fetchkey.cgi?fingerprint=67EF3966509986E96ACEE84E…"><img src="$(IMGROOT)/pgp-key.png" alt="pgp key" /></a></div> <div class="name"><a href="#hellais">Arturo Filastò</a></div> <div class="field"><b>IRC:</b> hellais</div> - <div class="description">Project leader for <a href="https://ooni.torproject.org/">OONI</a>, has helped with <a href="http://tor2web.org/">tor2web</a>, wrote <a href="https://atlas.torproject.org/">Atlas</a>, and helps improve security.</div> + <div class="description">Project leader for <a href="https://ooni.torproject.org/">OONI</a>, has helped with <a href="http://tor2web.org/">tor2web</a>, wrote Atlas which later became <a href="https://atlas.torproject.org/">Relay Search</a>, and helps improve security.</div> </td> </tr> @@ -280,7 +280,7 @@ <div class="icon"><a href="https://db.torproject.org/fetchkey.cgi?fingerprint=A8F7BA5041E133339CBA1696…"><img src="$(IMGROOT)/pgp-key.png" alt="pgp key" /></a></div> <div class="name"><a href="#irl">Iain Learmonth</a></div> <div class="field"><b>IRC:</b> irl</div> - <div class="description"><a href="https://metrics.torproject.org">Metrics team member</a> and maintainer of <a href="https://atlas.torproject.org/">Atlas</a>.</div> + <div class="description"><a href="https://metrics.torproject.org">Metrics team member</a> and maintainer of <a href="https://atlas.torproject.org/">Relay Search</a>.</div> </td> </tr> diff --git a/docs/en/documentation.wml b/docs/en/documentation.wml index 7160d8b8..1aa4e0ce 100644 --- a/docs/en/documentation.wml +++ b/docs/en/documentation.wml @@ -223,8 +223,8 @@ Tor</a>.</li> <li><a href="https://check.torproject.org/">The Tor detector</a> tries to guess if you're using Tor or not.</li> - <li>Check out one of the Tor status pages, such as the <a - href="https://atlas.torproject.org/">Atlas</a> and <a href="https://compass.torproject.org/">Compass</a> pages. + <li>Check out Tor network status information using <a + href="https://atlas.torproject.org/">Relay Search</a>. Remember that these lists may not be as accurate as what your Tor client uses, because your client fetches its own directory information and examines it locally.</li> diff --git a/docs/en/tor-doc-relay.wml b/docs/en/tor-doc-relay.wml index 7f897d3e..75a99890 100644 --- a/docs/en/tor-doc-relay.wml +++ b/docs/en/tor-doc-relay.wml @@ -101,11 +101,11 @@ <p>When your relay has decided that it's reachable, it will upload a "server descriptor" to the directories, to let clients know - what address, ports, keys, etc your relay is using. You can search <a - href="https://atlas.torproject.org/">Atlas</a> or <a - href="https://globe.torproject.org/">Globe</a> for + what address, ports, keys, etc your relay is using. You can use <a + href="https://atlas.torproject.org/">Relay Search</a> to lookup the nickname you configured, to make sure it's there. You may need to wait - up to one hour for the directories to publish the new server information.</p> + up to two hours for the directories to publish the new server information + and for it to be shown on Relay Search.</p> <hr> <a id="after"></a> diff --git a/docs/en/tor-relay-debian.wml b/docs/en/tor-relay-debian.wml index 10bebc7c..57dad0cb 100644 --- a/docs/en/tor-relay-debian.wml +++ b/docs/en/tor-relay-debian.wml @@ -93,7 +93,7 @@ href="<wiki>/doc/TorExitGuidelines">guidelines descriptor" to the directory authorities, to let clients know what address, ports, keys, etc your relay is using. After a few hours (to give it enough time to propagate), you can query - <a href="https://atlas.torproject.org/">Atlas</a> to see whether your + <a href="https://atlas.torproject.org/">Relay Search</a> to see whether your relay has successfully registered in the network.</p> <hr> diff --git a/en/index.wml b/en/index.wml index 24f55b53..71c3de1d 100644 --- a/en/index.wml +++ b/en/index.wml @@ -109,7 +109,7 @@ <div class="project"> <a href="https://atlas.torproject.org/"><img src="$(IMGROOT)/icon-TorStatus.jpg" alt="Atlas Icon"></a> - <h3><a href="https://atlas.torproject.org/">Atlas</a></h3> + <h3><a href="https://atlas.torproject.org/">Relay Search</a></h3> <p>Site providing an overview of the Tor network.</p> </div> </td> diff --git a/getinvolved/en/volunteer.wml b/getinvolved/en/volunteer.wml index 7758e15d..20752c57 100644 --- a/getinvolved/en/volunteer.wml +++ b/getinvolved/en/volunteer.wml @@ -247,7 +247,7 @@ meetings around the world.</li> </tr> <tr> - <td><a href="#project-atlas">Atlas</a></td> + <td><a href="#project-atlas">Relay Search</a></td> <td>Client Service</td> <td>JavaScript</td> <td>Light</td> @@ -255,14 +255,6 @@ meetings around the world.</li> </tr> <tr> - <td><a href="#project-compass">Compass</a></td> - <td>Client Service</td> - <td>Python</td> - <td>None</td> - <td></td> - </tr> - - <tr> <td><a href="#project-onionoo">Onionoo</a></td> <td>Backend Service</td> <td>Java</td> @@ -570,13 +562,13 @@ meetings around the world.</li> </p> <a id="project-atlas"></a> - <h3><a href="https://atlas.torproject.org/">Atlas</a> (<a + <h3><a href="https://atlas.torproject.org/">Relay Search</a> (<a href="https://gitweb.torproject.org/atlas.git">code</a>)</h3> <p> - Atlas is a web application to discover Tor relays and bridges. It provides - useful information on how relays are configured along with graphics about - their past usage. + Relay Search is a web application to discover Tor relays and bridges. It + provides useful information on how relays are configured along with graphics + about their past usage. </p> <p> @@ -589,17 +581,6 @@ meetings around the world.</li> been discontinued. </p> - <a id="project-compass"></a> - <h3><a href="https://compass.torproject.org/">Compass</a> (<a - href="https://gitweb.torproject.org/compass.git">code</a>, <a - href="https://trac.torproject.org/projects/tor/query?status=accepted&status=assig…">bug - tracker</a>)</h3> - - <p> - Compass is a web and command line application that filters and - aggregates the Tor relays based on various attributes. - </p> - <a id="project-onionoo"></a> <h3><a href="https://onionoo.torproject.org/">Onionoo</a> (<a href="https://gitweb.torproject.org/onionoo.git">code</a>,

1 0

[webwml/staging] update alpha version to 0.3.3.2-alpha
by arma＠torproject.org 29 Mar '18

29 Mar '18

commit a9b3b55fcc512985673e020223fde833bc4aea7c Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Feb 10 10:05:15 2018 -0500 update alpha version to 0.3.3.2-alpha --- Makefile | 2 +- include/versions.wmi | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 79d21f99..c307846b 100644 --- a/Makefile +++ b/Makefile @@ -15,7 +15,7 @@ # website component, and set it to needs_review. export STABLETAG=tor-0.3.2.9 -export DEVTAG=tor-0.3.3.1-alpha +export DEVTAG=tor-0.3.3.2-alpha WMLBASE=. SUBDIRS=docs eff projects press about download getinvolved donate docs/torbutton diff --git a/include/versions.wmi b/include/versions.wmi index 9f1097c3..918a8fe4 100644 --- a/include/versions.wmi +++ b/include/versions.wmi @@ -1,5 +1,5 @@ <define-tag version-stable whitespace=delete>0.3.2.9</define-tag> -<define-tag version-alpha whitespace=delete>0.3.3.1-alpha</define-tag> +<define-tag version-alpha whitespace=delete>0.3.3.2-alpha</define-tag> <define-tag version-torbrowserdevelopbranch whitespace=delete>maint-7.5</define-tag>

1 0

[webwml/staging] Link to executive director posting
by arma＠torproject.org 29 Mar '18

29 Mar '18

commit d0702ef79940c4f19376d2fd9c94ed99de37b9c6 Author: Damian Johnson <atagar(a)torproject.org> Date: Thu Feb 22 14:37:43 2018 -0800 Link to executive director posting I was hoping to double check with Erin and folks that they were happy with this before the page was live but a half hour after being built it still isn't showing up... https://jenkins.torproject.org/job/website-build-webwml/4951/ Maybe unlinked pages can't go live? It's fine if this is linked. We can still iterate on it. --- about/en/jobs.wml | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/about/en/jobs.wml b/about/en/jobs.wml index b3fac521..88e124bf 100644 --- a/about/en/jobs.wml +++ b/about/en/jobs.wml @@ -12,15 +12,14 @@ <div id="maincol"> <h1>The Tor Project is always looking for more great people to join our team!</h1> - <p>At the moment, we don't have any official open positions. Please check back - soon, though! In the meantime, you may want to glance at our - <a href="<page getinvolved/volunteer>">volunteers</a> page.</p> + #<p>At the moment, we don't have any official open positions. Please check back + # soon, though! In the meantime, you may want to glance at our + #<a href="<page getinvolved/volunteer>">volunteers</a> page.</p> - #<p>Specifically, we're looking for the following people currently:</p> - #<ul> - # <li><a href="<page about/jobs-cfgo>">Chief Financial and Grants Officer</a></li> - # <li><a href="<page about/jobs-osdeveloperandroid>">Android OS Developer</a></li> - #</ul> + <p>Specifically, we're looking for the following people currently:</p> + <ul> + <li><a href="<page about/jobs-execdirector>">Executive Director</a></li> + </ul> <p>In the past, we looked for the following people:</p>

1 0

[webwml/staging] Add new Tor Browser version: 8.0a2
by arma＠torproject.org 29 Mar '18

29 Mar '18

commit 281f5b9719fba70cebe13c8f53f19cd66a169624 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Feb 23 18:20:28 2018 +0100 Add new Tor Browser version: 8.0a2 --- include/versions.wmi | 4 ++-- projects/torbrowser/RecommendedTBBVersions | 6 +++++- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/include/versions.wmi b/include/versions.wmi index 918a8fe4..091930d0 100644 --- a/include/versions.wmi +++ b/include/versions.wmi @@ -22,8 +22,8 @@ <define-tag package-win32-stable whitespace=delete>../dist/torbrowser/<version-torbrowserbundle>/tor-win32-<version-win32-stable>.zip</define-tag> # *** tor browser beta/alpha *** -<define-tag version-torbrowserbundlebeta-all whitespace=delete>8.0a1</define-tag> -<define-tag releasedate-torbrowserbundlebeta-all whitespace=delete>2018-01-24</define-tag> +<define-tag version-torbrowserbundlebeta-all whitespace=delete>8.0a2</define-tag> +<define-tag releasedate-torbrowserbundlebeta-all whitespace=delete>2018-02-23</define-tag> <define-tag version-torbrowsersandboxlinux whitespace=delete>0.0.16</define-tag> # If all platforms are on the same version, you only need to update diff --git a/projects/torbrowser/RecommendedTBBVersions b/projects/torbrowser/RecommendedTBBVersions index 852bf2ac..ee821ff1 100644 --- a/projects/torbrowser/RecommendedTBBVersions +++ b/projects/torbrowser/RecommendedTBBVersions @@ -6,5 +6,9 @@ "8.0a1", "8.0a1-MacOS", "8.0a1-Linux", -"8.0a1-Windows" +"8.0a1-Windows", +"8.0a2", +"8.0a2-MacOS", +"8.0a2-Linux", +"8.0a2-Windows" ]

1 0

[webwml/staging] Add mention of summer of privacy
by arma＠torproject.org 29 Mar '18

29 Mar '18

commit 8ced42e5cf74901cc9e5f19cd65bf87b268f298e Author: Colin Childs <colin(a)torproject.org> Date: Wed Feb 28 21:54:55 2018 -0600 Add mention of summer of privacy --- getinvolved/en/volunteer.wml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/getinvolved/en/volunteer.wml b/getinvolved/en/volunteer.wml index ea7e8e87..e160c415 100644 --- a/getinvolved/en/volunteer.wml +++ b/getinvolved/en/volunteer.wml @@ -724,7 +724,7 @@ meetings around the world.</li> <p> You may find some of these projects to be good ideas for <a href="<page - about/gsoc>">Google Summer of Code</a>. We have labelled each idea with + about/gsoc>">Google Summer of Code</a> or the Tor Summer of Privacy. We have labelled each idea with which of our <a href="<page about/corepeople>">core developers</a> would be good mentors. If one or more of these ideas looks promising to you, please <a href="<page about/contact>">contact us</a> to discuss your plans rather

1 0

[webwml/staging] Update title in exec job posting
by arma＠torproject.org 29 Mar '18

29 Mar '18

commit 014bc3dd1149d99b0db2d160a5ad2cf5909bfd2a Author: hiromipaw <hiro(a)torproject.org> Date: Fri Feb 23 00:10:47 2018 +0100 Update title in exec job posting --- about/en/jobs-execdirector.wml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/about/en/jobs-execdirector.wml b/about/en/jobs-execdirector.wml index 15b5c771..f03f499a 100644 --- a/about/en/jobs-execdirector.wml +++ b/about/en/jobs-execdirector.wml @@ -12,7 +12,7 @@ <div id="maincol"> -<h2>Internet Freedom Nonprofit Seeks Executive Director</h2> +<h1>Internet Freedom Nonprofit Seeks Executive Director</h1> <p> The Tor Project, Inc., is a 501(c)(3) organization headquartered in Seattle that provides the technical infrastructure for privacy protection over the Internet, helping millions of activists, journalists and others around the world communicate securely. With paid staff and contractors of around 35 engineers and operational support people, plus many volunteers all over the world who contribute to our work, the Tor Project is funded in part by government grants and contracts, as well as by individual, foundation, and corporate donations. Our mission is "To advance human rights and freedoms by creating and deploying free and open anonymity and privacy technologies, supporting their unrestricted availability and use, and furthering their scientific and popular understanding."

1 0

[webwml/staging] Unlinked executive director job posting
by arma＠torproject.org 29 Mar '18

29 Mar '18

commit 782a7917e02504893a323421b2653808e3af11ff Author: Damian Johnson <atagar(a)torproject.org> Date: Thu Feb 22 13:56:43 2018 -0800 Unlinked executive director job posting Erin asked me to publish the executive director job posting... https://trac.torproject.org/projects/tor/ticket/25336 Presently uploading that description so they can look this over before it's linked from our jobs page. --- about/en/jobs-execdirector.wml | 81 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 81 insertions(+) diff --git a/about/en/jobs-execdirector.wml b/about/en/jobs-execdirector.wml new file mode 100644 index 00000000..15b5c771 --- /dev/null +++ b/about/en/jobs-execdirector.wml @@ -0,0 +1,81 @@ +## translation metadata +# Revision: $Revision: 25666 $ +# Translation-Priority: 3-low + +#include "head.wmi" TITLE="Tor Project: Jobs (executive administrator)" CHARSET="UTF-8" +<div id="content" class="clearfix"> + <div id="breadcrumbs"> + <a href="<page index>">Home » </a> + <a href="<page about/overview>">About » </a> + <a href="<page about/jobs>">Jobs</a> + </div> + <div id="maincol"> + + +<h2>Internet Freedom Nonprofit Seeks Executive Director</h2> + +<p> +The Tor Project, Inc., is a 501(c)(3) organization headquartered in Seattle that provides the technical infrastructure for privacy protection over the Internet, helping millions of activists, journalists and others around the world communicate securely. With paid staff and contractors of around 35 engineers and operational support people, plus many volunteers all over the world who contribute to our work, the Tor Project is funded in part by government grants and contracts, as well as by individual, foundation, and corporate donations. Our mission is "To advance human rights and freedoms by creating and deploying free and open anonymity and privacy technologies, supporting their unrestricted availability and use, and furthering their scientific and popular understanding." +</p> + +<p> +We are currently seeking an Executive Director to lead the organization into our next phase of growth and sustainability. This position can be based anywhere, as our work is international in scope. This person must be able to communicate regularly with the staff working on the ground at our organizational headquarters in Seattle. This position reports directly to the Tor Project Board of Directors. +</p> + +<p> +The Executive Director sets the tone for the organization, thinks strategically, and provides leadership and guidance in the day-to-day operations. The Tor Project does open source software development, and the Executive Director must be able to engage with various different stakeholders in managing the organization. Some of the key attributes of this person should be: +</p> + +<ul> + <li>A strong public commitment to privacy, and a good understanding of related debates.</li> + <li>A good understanding of open source development culture, and a commitment to transparent organizations.</li> + <li>A strong commitment to creating and maintaining a healthy and safe working environment, including for remote participants.</li> + <li>A talent for consensus and community building.</li> + <li>An ability to effectively support and collaborate with diverse groups of people.</li> + <li>A willingness to share responsibility and leadership of the organization with a leadership team.</li> + <li>An enthusiasm for coaching and developing emerging leaders.</li> + <li>A natural leadership ability that encourages and empowers others to do their best work.</li> + <li>Strong written and verbal communications skills.</li> +</ul> + +<p> +Some of the key requirements of this position are at least five years or equivalent experience in each of the following areas: +</p> + +<ul> + <li>Nonprofit fundraising, including raising money from government contracts and grants, foundations, corporations and individual contributions;</li> + <li>Talking to and working with the press, including being active and visible in promoting organizational goals and enhancing the organization’s image;</li> + <li>Solid, hands-on, budget management skills, including budget preparation, analysis, decision-making and reporting;</li> + <li>Human resource administration, including working with a leadership team and hiring and firing experience;</li> + <li>Working closely with a board of directors;</li> + <li>Non-profit operations, including managing an office and planning events, ideally remotely; and</li> + <li>Running a corporation of at least $3 million in yearly revenue, including an ability to recognize when outside professional assistance is required.</li> +</ul> + +<p> +The successful candidate will have a global perspective on privacy and censorship issues and an ability to balance "survival issues" (like next year’s funding) with "mission issues" (like making sure we’re actually moving our programs in a good direction). This person will have the ability to work remotely and work with remote workers. To this end, this person must be willing to adapt to daily use of privacy enhancing technologies used to communicate with others. Prior experience working with software development or internet people is a plus. +</p> + +<p> +The Tor Project has made a commitment to being a safe, fair, and diverse workplace. Our new Executive Director must be committed to these values and to continuing to foster a welcoming work environment. +</p> + +<p> +Salary is commensurate with experience and other qualifications. The Tor Project has a competitive benefits package, including a generous PTO policy; 14 paid holidays per year (including the week between Christmas and New Year's, when the office is closed); health, vision, dental, disability, and life insurance paid in full for employee; flexible work schedule; and occasional travel opportunities. The Tor Project, Inc., is an equal opportunity, affirmative action employer. +</p> + +<p> +This is a full-time position working either out of our office in Seattle or remotely. To apply, send a cover letter explaining why you believe you should be our next Executive Director, along with your resume, to edsearch(a)torproject.org with "Executive Director - [Your First and Last Name]" in the subject line. No phone calls please! +</p> + + </div> +  + <div id = "sidecol"> +#include "side.wmi" +#include "info.wmi" + </div> +  +</div> + +#include <foot.wmi> +

1 0

[webwml/staging] Bug 24027: update the FAQ to point to the new Tor Browser git repository
by arma＠torproject.org 29 Mar '18

29 Mar '18

commit afba226bd6eec49726f694d4adf48fed1f45c23c Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Feb 7 12:41:54 2018 +0100 Bug 24027: update the FAQ to point to the new Tor Browser git repository --- docs/en/faq.wml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/en/faq.wml b/docs/en/faq.wml index 88f81b15..b15de6f2 100644 --- a/docs/en/faq.wml +++ b/docs/en/faq.wml @@ -1514,7 +1514,7 @@ href="http://www.crowdstrike.com/community-tools/index.html#tool-79">proposed Tor Browser? How do I verify a build?</a></h3> <p> - Start with <a href="https://gitweb.torproject.org/builders/tor-browser-bundle.git">https://gitweb.torproject.org/builders/tor-browser-bundle.git</a> and <a href="https://gitweb.torproject.org/builders/tor-browser-bundle.git/tree/gitian/R…">https://gitweb.torproject.org/builders/tor-browser-bundle.git/tree/gitian/R…</a>. + Tor Browser is built from the <a href="https://gitweb.torproject.org/builders/tor-browser-build.git/">tor-browser-build.git git repository</a>. You can have a look at the <a href="https://gitweb.torproject.org/builders/tor-browser-build.git/tree/README">README file</a> for the build instructions. There is also some informations in the <a href="https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser/Hacking">Tor Browser Hacking Guide</a>. </p>

1 0

[webwml/staging] Addressing Mike's design doc review comments
by arma＠torproject.org 29 Mar '18

29 Mar '18

commit 87df89e20fef80e51e4db2e39afe0334e9522731 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Feb 19 15:58:59 2018 +0000 Addressing Mike's design doc review comments --- projects/torbrowser/design/index.html.en | 135 +++++++++++++++++++++---------- 1 file changed, 94 insertions(+), 41 deletions(-) diff --git a/projects/torbrowser/design/index.html.en b/projects/torbrowser/design/index.html.en index 49e710a7..8f1cb695 100644 --- a/projects/torbrowser/design/index.html.en +++ b/projects/torbrowser/design/index.html.en @@ -1,5 +1,5 @@ <?xml version="1.0" encoding="UTF-8"?> -<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>The Design and Implementation of the Tor Browser [DRAFT]</title><meta name="generator" content="DocBook XSL Stylesheets V1.79.1" /></head><body><div class="article"><div class="titlepage"><div><div><h2 class="title"><a id="design"></a>The Design and Implementation of the Tor Browser [DRAFT]</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Mike</span> <span class="surname">Perry</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:mikeperry#torproject org">mikeperry#torproject org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Erinn</span> <span class="surname">Clark</span></h3><div class="a ffiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:erinn#torproject org">erinn#torproject org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Steven</span> <span class="surname">Murdoch</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:sjmurdoch#torproject org">sjmurdoch#torproject org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Georg</span> <span class="surname">Koppen</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:gk#torproject org">gk#torproject org</a>></code></p></div></div></div></div><div><p class="pubdate">January 25th, 2018</p></div></div><hr /></div><div class="toc"><p><strong>Table of Contents</strong></p><dl class="toc"><dt><span class="sect1"><a href="#idm29">1. Introduct ion</a></span></dt><dd><dl><dt><span class="sect2"><a href="#components">1.1. Browser Component Overview</a></span></dt></dl></dd><dt><span class="sect1"><a href="#DesignRequirements">2. Design Requirements and Philosophy</a></span></dt><dd><dl><dt><span class="sect2"><a href="#security">2.1. Security Requirements</a></span></dt><dt><span class="sect2"><a href="#privacy">2.2. Privacy Requirements</a></span></dt><dt><span class="sect2"><a href="#philosophy">2.3. Philosophy</a></span></dt></dl></dd><dt><span class="sect1"><a href="#adversary">3. Adversary Model</a></span></dt><dd><dl><dt><span class="sect2"><a href="#adversary-goals">3.1. Adversary Goals</a></span></dt><dt><span class="sect2"><a href="#adversary-positioning">3.2. Adversary Capabilities - Positioning</a></span></dt><dt><span class="sect2"><a href="#attacks">3.3. Adversary Capabilities - Attacks</a></span></dt></dl></dd><dt><span class="sect1"><a href="#Implementation">4. Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="#proxy-obedience">4.1. Proxy Obedience</a></span></dt><dt><span class="sect2"><a href="#state-separation">4.2. State Separation</a></span></dt><dt><span class="sect2"><a href="#disk-avoidance">4.3. Disk Avoidance</a></span></dt><dt><span class="sect2"><a href="#app-data-isolation">4.4. Application Data Isolation</a></span></dt><dt><span class="sect2"><a href="#identifier-linkability">4.5. Cross-Origin Identifier Unlinkability</a></span></dt><dt><span class="sect2"><a href="#fingerprinting-linkability">4.6. Cross-Origin Fingerprinting Unlinkability</a></span></dt><dt><span class="sect2"><a href="#new-identity">4.7. Long-Term Unlinkability via "New Identity" button</a></span></dt><dt><span class="sect2"><a href="#other-security">4.8. Other Security Measures</a></span></dt></dl></dd><dt><span class="sect1"><a href="#BuildSecurity">5. Build Security and Package Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="#idm1144">5.1. Achieving Binary Reprod ucibility</a></span></dt><dt><span class="sect2"><a href="#idm1176">5.2. Package Signatures and Verification</a></span></dt><dt><span class="sect2"><a href="#idm1183">5.3. Anonymous Verification</a></span></dt><dt><span class="sect2"><a href="#update-safety">5.4. Update Safety</a></span></dt></dl></dd><dt><span class="appendix"><a href="#Transparency">A. Towards Transparency in Navigation Tracking</a></span></dt><dd><dl><dt><span class="sect1"><a href="#deprecate">A.1. Deprecation Wishlist</a></span></dt><dt><span class="sect1"><a href="#idm1226">A.2. Promising Standards</a></span></dt></dl></dd></dl></div><div class="sect1"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="idm29"></a>1. Introduction</h2></div></div></div><p> +<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>The Design and Implementation of the Tor Browser [DRAFT]</title><meta name="generator" content="DocBook XSL Stylesheets V1.79.1" /></head><body><div class="article"><div class="titlepage"><div><div><h2 class="title"><a id="design"></a>The Design and Implementation of the Tor Browser [DRAFT]</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Mike</span> <span class="surname">Perry</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:mikeperry#torproject org">mikeperry#torproject org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Erinn</span> <span class="surname">Clark</span></h3><div class="a ffiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:erinn#torproject org">erinn#torproject org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Steven</span> <span class="surname">Murdoch</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:sjmurdoch#torproject org">sjmurdoch#torproject org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Georg</span> <span class="surname">Koppen</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:gk#torproject org">gk#torproject org</a>></code></p></div></div></div></div><div><p class="pubdate">February 19th, 2018</p></div></div><hr /></div><div class="toc"><p><strong>Table of Contents</strong></p><dl class="toc"><dt><span class="sect1"><a href="#idm29">1. Introduc tion</a></span></dt><dd><dl><dt><span class="sect2"><a href="#components">1.1. Browser Component Overview</a></span></dt></dl></dd><dt><span class="sect1"><a href="#DesignRequirements">2. Design Requirements and Philosophy</a></span></dt><dd><dl><dt><span class="sect2"><a href="#security">2.1. Security Requirements</a></span></dt><dt><span class="sect2"><a href="#privacy">2.2. Privacy Requirements</a></span></dt><dt><span class="sect2"><a href="#philosophy">2.3. Philosophy</a></span></dt></dl></dd><dt><span class="sect1"><a href="#adversary">3. Adversary Model</a></span></dt><dd><dl><dt><span class="sect2"><a href="#adversary-goals">3.1. Adversary Goals</a></span></dt><dt><span class="sect2"><a href="#adversary-positioning">3.2. Adversary Capabilities - Positioning</a></span></dt><dt><span class="sect2"><a href="#attacks">3.3. Adversary Capabilities - Attacks</a></span></dt></dl></dd><dt><span class="sect1"><a href="#Implementation">4. Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="#proxy-obedience">4.1. Proxy Obedience</a></span></dt><dt><span class="sect2"><a href="#state-separation">4.2. State Separation</a></span></dt><dt><span class="sect2"><a href="#disk-avoidance">4.3. Disk Avoidance</a></span></dt><dt><span class="sect2"><a href="#app-data-isolation">4.4. Application Data Isolation</a></span></dt><dt><span class="sect2"><a href="#identifier-linkability">4.5. Cross-Origin Identifier Unlinkability</a></span></dt><dt><span class="sect2"><a href="#fingerprinting-linkability">4.6. Cross-Origin Fingerprinting Unlinkability</a></span></dt><dt><span class="sect2"><a href="#new-identity">4.7. Long-Term Unlinkability via "New Identity" button</a></span></dt><dt><span class="sect2"><a href="#other-security">4.8. Other Security Measures</a></span></dt></dl></dd><dt><span class="sect1"><a href="#BuildSecurity">5. Build Security and Package Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="#idm1164">5.1. Achieving Binary Repro ducibility</a></span></dt><dt><span class="sect2"><a href="#idm1196">5.2. Package Signatures and Verification</a></span></dt><dt><span class="sect2"><a href="#idm1203">5.3. Anonymous Verification</a></span></dt><dt><span class="sect2"><a href="#update-safety">5.4. Update Safety</a></span></dt></dl></dd><dt><span class="appendix"><a href="#Transparency">A. Towards Transparency in Navigation Tracking</a></span></dt><dd><dl><dt><span class="sect1"><a href="#deprecate">A.1. Deprecation Wishlist</a></span></dt><dt><span class="sect1"><a href="#idm1246">A.2. Promising Standards</a></span></dt></dl></dd></dl></div><div class="sect1"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="idm29"></a>1. Introduction</h2></div></div></div><p> This document describes the <a class="link" href="#adversary" title="3. Adversary Model">adversary model</a>, <a class="link" href="#DesignRequirements" title="2. Design Requirements and Philosophy">design requirements</a>, and <a class="link" href="#Implementation" title="4. Implementation">implementation</a> of the Tor Browser. It is current as of Tor Browser @@ -439,7 +439,7 @@ about the user agent. Also, JavaScript can be used to query the user's timezone via the <code class="function">Date()</code> object, <a class="ulink" href="https://www.khronos.org/registry/webgl/specs/1.0/#5.13" target="_top">WebGL</a> can reveal information about the video card in use, and high precision timing -information can be used to <a class="ulink" href="https://cseweb.ucsd.edu/~hovav/dist/jspriv.pdf" target="_top">fingerprint the cpu and +information can be used to <a class="ulink" href="https://cseweb.ucsd.edu/~hovav/dist/jspriv.pdf" target="_top">fingerprint the CPU and interpreter speed</a>. JavaScript features such as <a class="ulink" href="https://www.w3.org/TR/resource-timing/" target="_top">Resource Timing</a> may leak an unknown amount of network timing related information. And, moreover, @@ -707,7 +707,7 @@ a helper application. Furthermore, we ship a <a class="ulink" href="https://gitweb.torproject.org/tor-browser.git/commit/?h=tor-browser-52.5.2e…" target="_top">patch for Linux users</a> that makes sure sftp:// and smb:// URLs are not passed along to the operating system as this -can lead to proxy bypasses on systems that have GIO/GnomeVS support. And proxy +can lead to proxy bypasses on systems that have GIO/GnomeVFS support. And proxy bypass risks due to file:// URLs should be mitigated for macOS and Linux users by <a class="ulink" href="https://gitweb.torproject.org/tor-browser.git/commit/?h=tor-browser-52.5.2e…" target="_top"> two</a> <a class="ulink" href="https://gitweb.torproject.org/tor-browser.git/commit/?h=tor-browser-52.5.2e…" target="_top"> @@ -715,7 +715,7 @@ further patches</a>. </p><p> -Additionally, modern desktops now pre-emptively fetch any URLs in Drag and +Additionally, modern desktops now preemptively fetch any URLs in Drag and Drop events as soon as the drag is initiated. This download happens independent of the browser's Tor settings, and can be triggered by something as simple as holding the mouse button down for slightly too long while @@ -835,7 +835,7 @@ and no other browser vendor or standards body had invested the effort to enumerate or otherwise deal with these vectors for third party tracking. As such, we have had to enumerate and isolate these identifier sources on a piecemeal basis. This has gotten better lately with Mozilla stepping up and -helping us with uplifting our patches, and with contributing own ones where we +helping us with uplifting our patches, and with contributing their own patches where we lacked proper fixes. However, we are not done yet with our unlinkability defense as new identifier sources are still getting added to the web platform. Here is the list that we have discovered and dealt with to date: @@ -863,11 +863,19 @@ We isolate the content and image cache to the URL bar domain by setting <span class="command"><strong>privacy.firstparty.isolate</strong></span> to <span class="command"><strong>true</strong></span>. </p><p> -Furthermore there is the Cache API (CacheStorage). That one is currently not -available in Tor Browser as we do not allow third party cookies and are in -Private Browsing Mode by default. +Furthermore there is the <a class="ulink" href="https://developer.mozilla.org/en-US/docs/Web/API/CacheStorage" target="_top"> +CacheStorage API</a>. That one is currently not available in Tor Browser as +we do not allow third party cookies and are in Private Browsing Mode by default. +As the cache entries are written to disk the CacheStorage API +<a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1173467" target="_top">got disabled</a> +in that mode in Firefox, similar to how IndexedDB is handled. There are +<a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1117808" target="_top">thoughts</a> +about enabling it by providing a memory-only database but that is still work +in progress. But even if users are leaving the Private Browsing Mode and are +enabling third party cookies the storage is isolated to the URL bar domain by +<span class="command"><strong>privacy.firstparty.isolate</strong></span> set to <span class="command"><strong>true</strong></span>. </p><p> -Finally, we have the asm.js cache. The cache entry of the sript is (among +Finally, we have the asm.js cache. The cache entry of the script is (among others things, like type of CPU, build ID, source characters of the asm.js module etc.) keyed <a class="ulink" href="https://blog.mozilla.org/luke/2014/01/14/asm-js-aot-compilation-and-startup…" target="_top">to the origin of the script</a>. Lacking a good solution for binding it to the URL bar domain instead we decided @@ -888,6 +896,19 @@ DOM storage for third party domains MUST be isolated to the URL bar domain, to prevent linkability between sites. We achieve this by setting <span class="command"><strong>privacy.firstparty.isolate</strong></span> to <span class="command"><strong>true</strong></span>. + </p></li><li class="listitem"><span class="command"><strong>IndexedDB Storage</strong></span><p> + +IndexedDB storage for third party domains MUST be isolated to the URL bar +domain, to prevent linkability between sites. By default +<a class="ulink" href="https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API" target="_top"> +IndexedDB storage</a> is disabled as Tor Browser is using Firefox's Private +Browsing Mode and does not allow third party cookies. There are +<a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=781982" target="_top">thoughts</a> +about enabling this API in Private Browsing Mode as well but that is still work +in progress. However, if users are leaving this mode and are enabling third +party cookies, isolation to the URL bar is achieved, though, by +<span class="command"><strong>privacy.firstparty.isolate</strong></span> set to <span class="command"><strong>true</strong></span>. + </p></li><li class="listitem"><span class="command"><strong>Flash cookies</strong></span><p><span class="command"><strong>Design Goal:</strong></span> Users should be able to click-to-play flash objects from trusted sites. To @@ -1077,7 +1098,7 @@ We provide the isolation in Tor Browser by setting </p></li><li class="listitem"><span class="command"><strong>OCSP</strong></span><p> -OCSP requests go to Certfication Authorities (CAs) to check for revoked +OCSP requests go to Certificate Authorities (CAs) to check for revoked certificates. They are sent once the browser is visiting a website via HTTPS and no cached results are available. Thus, to avoid information leaks, e.g. to exit relays, OCSP requests MUST go over the same circuit as the HTTPS request causing @@ -1092,7 +1113,7 @@ When visiting a website its favicon is fetched via a request originating from the browser itself (similar to the OCSP mechanism mentioned in the previous section). Those requests MUST be isolated to the URL bar domain. - </p><p><span class="command"><strong>Implemetation Status:</strong></span> + </p><p><span class="command"><strong>Implementation Status:</strong></span> Favicon requests are isolated to the URL bar domain by setting <span class="command"><strong>privacy.firstparty.isolate</strong></span> to <span class="command"><strong>true</strong></span>. @@ -1144,7 +1165,7 @@ We allow these requests to proceed, but we isolate them. The Permissions API allows a website to query the status of different permissions. Although permissions are keyed to the origin, that is not enough to -alleviate cross-linkabilility concerns: the combined permission state could work +alleviate cross-linkability concerns: the combined permission state could work like an identifier given more and more permissions and their state being accessible under this API. @@ -1270,7 +1291,14 @@ most of our fingerprinting defenses serve to differentiate Tor Browser users from normal Firefox users. Because of this, any study that lumps browser vendor and version differences into its analysis of the fingerprintability of a population is largely useless for evaluating either attacks or defenses. -Unfortunately, this includes popular large-scale studies such as <a class="ulink" href="https://panopticlick.eff.org/" target="_top">Panopticlick</a> and <a class="ulink" href="https://amiunique.org/" target="_top">Am I Unique</a>. +Unfortunately, this includes popular large-scale studies such as <a class="ulink" href="https://panopticlick.eff.org/" target="_top">Panopticlick</a> and <a class="ulink" href="https://amiunique.org/" target="_top">Am I Unique</a>. To gather usable data about +Tor Browser's fingerprinting defenses we launched a Google Summer of Code +project in 2016, called <a class="ulink" href="https://github.com/plaperdr/fp-central" target="_top"> +FPCentral</a>, with the aim to provide us an own testbed. We set this up +during 2017 and <a class="ulink" href="https://fpcentral.tbb.torproject.org/" target="_top">have it +available now</a> for further integration into our quality assurance efforts +and possible research into improving our fingerprinting defenses and measuring +their effectiveness. </p></li></ol></div></div><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="fingerprinting-defenses-general"></a>General Fingerprinting Defenses</h4></div></div></div><p> @@ -1333,7 +1361,7 @@ narrow domain or use case, or when there are alternate ways of accomplishing the same task, these features and/or certain aspects of their functionality may be simply removed. - </p></li></ol></div></div><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idm646"></a>Strategies for Defense: Randomization versus Uniformity</h4></div></div></div><p> + </p></li></ol></div></div><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idm660"></a>Strategies for Defense: Randomization versus Uniformity</h4></div></div></div><p> When applying a form of defense to a specific fingerprinting vector or source, there are two general strategies available: either the implementation for all @@ -1357,7 +1385,9 @@ implementation that strives for uniformity is very simple to evaluate. Despite their current flaws, a properly designed version of <a class="ulink" href="https://panopticlick.eff.org/" target="_top">Panopticlick</a> or <a class="ulink" href="https://amiunique.org/" target="_top">Am I Unique</a> could report the entropy and uniqueness rates for all users of a single user agent version, without the need for complicated statistics about the variance of the measured behaviors. - +<a class="ulink" href="https://fpcentral.tbb.torproject.org/fp" target="_top">FPCentral</a> is trying +to achieve that for Tor Browser by providing feedback on acceptable browser +properties and giving guidance on possible improvements. </p><p> Randomization (especially incomplete randomization) may also provide a false @@ -1583,7 +1613,7 @@ use those fonts exclusively. In addition to that we set the <span class="command is always displayed with the same font. This is not guaranteed even if we bundle all the fonts Tor Browser uses as it can happen that fonts are loaded in a different order on different systems. Setting the above mentioned preferences -works around this issue by specifying the font to use explicitely. +works around this issue by specifying the font to use explicitly. </p><p> @@ -1725,7 +1755,7 @@ SpeechRecognition (Asynchronous Speech Recognition). The latter is still disabled in Firefox. However, the former is enabled by default and there is the risk that <span class="command"><strong>speechSynthesis.getVoices()</strong></span> has access to computer-specific speech packages making them available in an enumerable -fashion. Morevover, there are callbacks that would allow JavaScript to time how +fashion. Moreover, there are callbacks that would allow JavaScript to time how long a phrase takes to be "uttered". To prevent both we set <span class="command"><strong>media.webspeech.synth.enabled</strong></span> to <span class="command"><strong>false</strong></span>. @@ -1739,6 +1769,7 @@ the Touch API by setting <span class="command"><strong>dom.w3c_touch_events.enab have this API available we patched the code to give content-window related coordinates back. Furthermore, we made sure that the touch area described by <span class="command"><strong>Touch.radiusX</strong></span>, <span class="command"><strong>Touch.radiusY</strong></span>, and + <span class="command"><strong>Touch.rotationAngle</strong></span> does not leak further information and <span class="command"><strong>Touch.force</strong></span> does not reveal how much pressure a user applied to the surface. That is achieved by a direct @@ -1757,7 +1788,7 @@ still after that got fixed (and on other platforms where the precision was just two significant digits anyway) the risk for tracking users remained as combined with the <span class="command"><strong>chargingTime</strong></span> and <span class="command"><strong>dischargingTime</strong></span> the possible values <a class="ulink" href="https://senglehardt.com/papers/iwpe17_battery_status_case_study.pdf" target="_top"> -got estimated to be in the millons</a> under normal conditions. We avoid all +got estimated to be in the millions</a> under normal conditions. We avoid all those possible issues with disabling the Battery Status API by setting <span class="command"><strong>dom.battery.enabled</strong></span> to <span class="command"><strong>false</strong></span>. @@ -1765,7 +1796,14 @@ those possible issues with disabling the Battery Status API by setting It is possible to get the system uptime of a Tor Browser user by querying the <span class="command"><strong>Event.timestamp</strong></span> property. We avoid this by setting <span class="command"><strong> -dom.event.highrestimestamp.enabled</strong></span> to <span class="command"><strong>true</strong></span>. +dom.event.highrestimestamp.enabled</strong></span> to <span class="command"><strong>true</strong></span>. This +might seem to be counterintuitive at first glance but the effect of setting +that preference to <code class="code">true</code> is a +<a class="ulink" href="https://trac.torproject.org/projects/tor/ticket/17046#comment:8" target="_top"> +normalization</a> of <code class="code">evt.timestamp</code> and +<code class="code">new Event('').timeStamp</code>. Together with clamping the timer +resolution to 100ms this provides an effective means against system uptime +fingerprinting. </p></li><li class="listitem"><span class="command"><strong>Keyboard Layout Fingerprinting</strong></span><p> @@ -1795,6 +1833,18 @@ are currently returning an empty <span class="command"><strong>KeyboardEvent.cod <span class="command"><strong>KeyboardEvent.keyCode</strong></span> of <span class="command"><strong>0</strong></span>. Moreover, neither <span class="command"><strong>Alt</strong></span> or <span class="command"><strong>Shift</strong></span>, or <span class="command"><strong>AltGr</strong></span> keyboard events are reported to content. + + </p><p> + +We are currently not taking the actually deployed browser locale or the locale +indicated by a loaded document into account when spoofing the keyboard layout. +We think that would be the right thing to do in the longer run, to mitigate +possible usability issues and broken functionality on websites. Similarily to +how users of non-english Tor Browser bundles right now can choose between +keeping the Accept header spoofed or not they would then be able to keep a +spoofed english keyboard or a spoofed one depending on the actual Tor Browser +locale or language of the document. + </p></li><li class="listitem"><span class="command"><strong>User Agent and HTTP Headers</strong></span><p><span class="command"><strong>Design Goal:</strong></span> All Tor Browser users MUST provide websites with an identical user agent and @@ -1853,7 +1903,7 @@ and <span class="command"><strong>document.timeline.currentTime</strong></span>. </p><p> -While clamping the clock resolution to 100ms is a step towards neutering the +While clamping the clock resolution to 100ms is a step towards mitigating timing-based side channel fingerprinting, it is by no means sufficient. It turns out that it is possible to subvert our clamping of explicit clocks by using <a class="ulink" href="https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper…" target="_top"> @@ -1884,7 +1934,7 @@ out of a Tor Browser user by deploying resource:// and/or chrome:// URIs. Until this is fixed in Firefox <a class="ulink" href="https://gitweb.torproject.org/torbutton.git/tree/src/components/content-pol…" target="_top"> we filter</a> resource:// and chrome:// requests done by web content denying them by default. We need a whitelist of resource:// and -chrome:// URIs, though, to avoid breaking parts of Firefox. Those more than a +chrome:// URIs, though, to avoid breaking parts of Firefox. There are more than a dozen Firefox resources do not aid in fingerprinting Tor Browser users as they are not different on the platforms and in the locales we support. @@ -1903,7 +1953,7 @@ We set the fallback character set to set to windows-1252 for all locales, via to instruct the JS engine to use en-US as its internal C locale for all Date, Math, and exception handling. Additionally, we provide a patch to use an <a class="ulink" href="https://gitweb.torproject.org/tor-browser.git/commit/?h=tor-browser-52.5.2e…" target="_top"> -en-US label for the <span class="command"><strong>isindex</strong></span> HTML element</a> instead of +en-US label for the <span class="command"><strong>isindex</strong></span>HTML element</a> instead of letting the label leak the browser's UI locale. </p></li><li class="listitem"><span class="command"><strong>Timezone and Clock Offset</strong></span><p> @@ -1984,8 +2034,9 @@ We clamp keyboard event resolution to 100ms with a <a class="ulink" href="https: </p></li><li class="listitem"><span class="command"><strong>Amount of Processor Cores (hardwareConcurrency)</strong></span><p> -Modern computers have multiple physical processor cores in their CPU available. -One core typically allows to run more than one thread at a time and +Modern computers have multiple physical processor cores available in their +CPU. For optimum performance, native code typically attempts to run as many +threads as there are cores, and <span class="command"><strong>navigator.hardwareConcurrency</strong></span> makes the number of those threads (i.e. logical processors) available to web content. @@ -1998,7 +2049,7 @@ the amount of logical processors available. We set <span class="command"><strong>dom.maxHardwareConcurrency</strong></span> to <span class="command"><strong>1</strong></span> to report the same amount of logical processors for everyone. However, there are -<a class="ulink" href="https://github.com/oftn/core-estimator" target="_top">probablistic ways of +<a class="ulink" href="https://github.com/oftn/core-estimator" target="_top">probabilistic ways of determining the same information available</a> which we are not defending against currently. Moreover, we might even want to think about a more elaborate approach defending against this fingerprinting technique by not making all users @@ -2010,7 +2061,7 @@ size exfiltration. The <a class="ulink" href="https://developer.mozilla.org/en-US/docs/Web/API/Web_Audio_API" target="_top"> Web Audio API</a> provides several means to aid in fingerprinting users. -At the simplest level it allows differentiating between users having the API +At the simplest level it allows differentiating between users who have the API available and those who don't by checking for an <span class="command"><strong>AudioContext</strong></span> or <span class="command"><strong>OscillatorNode</strong></span> object. However, there are more bits of information that the Web Audio API reveals if audio signals generated with an @@ -2052,7 +2103,9 @@ is a Firefox feature to view web pages clutter-free and easily adjusted to own needs and preferences. To avoid fingerprintability risks we make Tor Browser users uniform by setting <span class="command"><strong>reader.parse-on-load.enabled</strong></span> to <span class="command"><strong>false</strong></span> and <span class="command"><strong>browser.reader.detectedFirstArticle</strong></span> -to <span class="command"><strong>true</strong></span>. +to <span class="command"><strong>true</strong></span>. This makes sure that documents are not parsed on +load as this is disabled on some devices due to memory consumption and we +pretend that everybody has already been using that feature in the past. </p></li><li class="listitem"><span class="command"><strong>Contacting Mozilla Services</strong></span><p> @@ -2063,8 +2116,8 @@ This is often implemented by contacting Mozilla services, be it for displaying further information about a new feature or by <a class="ulink" href="https://wiki.mozilla.org/Telemetry" target="_top">sending (aggregated) data back for analysis</a>. While some of those mechanisms are disabled by default on -release channels (gathering telemetry data comes to mind) others are not. We -make sure that non of those Mozilla services is contacted to avoid possible +release channels (such as telemetry data) others are not. We +make sure that none of those Mozilla services are contacted to avoid possible fingerprinting risks. </p><p> @@ -2152,11 +2205,11 @@ In order to avoid long-term linkability, we provide a "New Identity" context menu option in Torbutton. This context menu option is active if Torbutton can read the environment variables $TOR_CONTROL_PASSWD and $TOR_CONTROL_PORT. - </p><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idm1048"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> + </p><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idm1068"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> All linkable identifiers and browser state MUST be cleared by this feature. - </blockquote></div></div><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idm1051"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> + </blockquote></div></div><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idm1071"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> First, Torbutton disables JavaScript in all open tabs and windows by using both the <a class="ulink" href="https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsIDocSh…" target="_top">browser.docShell.allowJavaScript</a> @@ -2175,10 +2228,10 @@ After closing all tabs, we then clear the searchbox and findbox text and emit state). Then we manually clear the following state: HTTP auth, SSL state, crypto tokens, OCSP state, site-specific content preferences (including HSTS state), the undo tab history, content and image cache, offline and memory cache, -offline storage, IndexedDB storage, asm.js cache, cookies, DOM storage, the -safe browsing key, the Google wifi geolocation token (if it exists), and the -domain isolator state. We also clear NoScript's site and temporary permissions, -and all other browser site permissions. +offline storage, Cache storage, IndexedDB storage, asm.js cache, cookies, +DOM storage, the safe browsing key, the Google wifi geolocation token (if it +exists), and the domain isolator state. We also clear NoScript's site and +temporary permissions, and all other browser site permissions. </p><p> @@ -2261,7 +2314,7 @@ images (<span class="command"><strong>svg.in-content.enabled</strong></span>). Fingerprinting</a> is a statistical attack to attempt to recognize specific encrypted website activity. - </p><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idm1109"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> + </p><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idm1129"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> We want to deploy a mechanism that reduces the accuracy of <a class="ulink" href="https://en.wikipedia.org/wiki/Feature_selection" target="_top">useful features</a> available for classification. This mechanism would either impact the true and false @@ -2283,7 +2336,7 @@ Congestion-Sensitive BUFLO</a>. It may be also possible to <a class="ulink" href defenses</a> such that they only use existing spare Guard bandwidth capacity in the Tor network, making them also effectively no-overhead. - </p></blockquote></div></div><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idm1121"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> + </p></blockquote></div></div><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idm1141"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> Currently, we patch Firefox to <a class="ulink" href="https://gitweb.torproject.org/tor-browser.git/commit/?h=tor-browser-52.5.2e…" target="_top">randomize pipeline order and depth</a>. Unfortunately, pipelining is very fragile. Many sites do not support it, and even sites that advertise support for @@ -2348,7 +2401,7 @@ contend with. For this reason, we have deployed a build system that allows anyone to use our source code to reproduce byte-for-byte identical binary packages to the ones that we distribute. - </p><div class="sect2"><div class="titlepage"><div><div><h3 class="title"><a id="idm1144"></a>5.1. Achieving Binary Reproducibility</h3></div></div></div><p> + </p><div class="sect2"><div class="titlepage"><div><div><h3 class="title"><a id="idm1164"></a>5.1. Achieving Binary Reproducibility</h3></div></div></div><p> The GNU toolchain has been working on providing reproducible builds for some time, however a large software project such as Firefox typically ends up @@ -2456,7 +2509,7 @@ particular: libgmp) attempt to detect the current CPU to determine which optimizations to compile in. This CPU type is uniform on our KVM instances, but differs under LXC. - </p></li></ol></div></div><div class="sect2"><div class="titlepage"><div><div><h3 class="title"><a id="idm1176"></a>5.2. Package Signatures and Verification</h3></div></div></div><p> + </p></li></ol></div></div><div class="sect2"><div class="titlepage"><div><div><h3 class="title"><a id="idm1196"></a>5.2. Package Signatures and Verification</h3></div></div></div><p> The build process generates a single sha256sums-unsigned-build.txt file that contains a sorted list of the SHA-256 hashes of every package produced for that @@ -2489,7 +2542,7 @@ In order to verify package integrity, the signature must be stripped off using the osslsigncode tool, as described on the <a class="ulink" href="https://www.torproject.org/docs/verifying-signatures.html.en#BuildVerificat…" target="_top">Signature Verification</a> page. - </p></div><div class="sect2"><div class="titlepage"><div><div><h3 class="title"><a id="idm1183"></a>5.3. Anonymous Verification</h3></div></div></div><p> + </p></div><div class="sect2"><div class="titlepage"><div><div><h3 class="title"><a id="idm1203"></a>5.3. Anonymous Verification</h3></div></div></div><p> Due to the fact that bit-identical packages can be produced by anyone, the security of this build system extends beyond the security of the official @@ -2625,7 +2678,7 @@ possible for us to <a class="ulink" href="https://trac.torproject.org/projects/t ourselves</a>, as they are comparatively rare and can be handled with site permissions. - </p></li></ol></div></div><div class="sect1"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="idm1226"></a>A.2. Promising Standards</h2></div></div></div><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><a class="ulink" href="https://web.archive.org/web/20130213034335/http://web-send.org:80/" target="_top">Web-Send Introducer</a><p> + </p></li></ol></div></div><div class="sect1"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="idm1246"></a>A.2. Promising Standards</h2></div></div></div><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><a class="ulink" href="https://web.archive.org/web/20130213034335/http://web-send.org:80/" target="_top">Web-Send Introducer</a><p> Web-Send is a browser-based link sharing and federated login widget that is designed to operate without relying on third-party tracking or abusing other

1 0