June 2021 - tor-commits - lists.torproject.org

[community/master] make text more easy to understand
by emmapeel＠torproject.org 29 Jun '21

29 Jun '21

commit a74d216d12d65059d43e2bb206625c398032c48e Author: emma peel <emma.peel(a)riseup.net> Date: Fri Jun 25 21:15:57 2021 +0200 make text more easy to understand --- content/onion-services/advanced/https/contents.lr | 29 ++++++++++++---------- .../community-resources/bad-relays/contents.lr | 4 +-- 2 files changed, 18 insertions(+), 15 deletions(-) diff --git a/content/onion-services/advanced/https/contents.lr b/content/onion-services/advanced/https/contents.lr index 8c0941d..9122a0e 100644 --- a/content/onion-services/advanced/https/contents.lr +++ b/content/onion-services/advanced/https/contents.lr @@ -16,15 +16,16 @@ html: two-columns-page.html --- body: -When visiting a site over HTTPS (HTTP over TLS), the TLS protocol prevents data in transit from being read or manipulated by man in the middle attacks, and an x.509 certificate obtained from a Certificate Authority (CA) is validates that the user is actually connecting to a server representing the domain name in the browser address bar. +When visiting a site over HTTPS (HTTP over TLS), the TLS protocol prevents data in transit from being read or manipulated by man in the middle attacks, and an x.509 certificate obtained from a Certificate Authority (CA) validates that the user is actually connecting to a server representing the domain name in the browser address bar. Modern browsers indicate that a connection is insecure if not using TLS, and require that a TLS connection is authenticated by a CA-issued x.509 certificate. When visiting a site over the onion services protocol, the Tor protocol prevents data in transit from being read or manipulated by man in the middle attacks, and the onion service protocol validates that the user is connected to the domain name in the browser address bar. -No certificate authority is required for this proof, because that name is the actual public key used to authenticate the underlying connection. +No certificate authority is required for this proof, because the name of the service is the actual public key used to authenticate the underlying connection. As ".onion" is a [special top level domain name](https://tools.ietf.org/html/rfc7686), most Certificate Authorities don't have support for issuing X.509 certificates for onion sites. -Right now, HTTPS certificates are only provided by -- [DigiCert](https://www.digicert.com/) with an Extended Validation (EV) TLS certificate, which means a considerable cost for an organization. +Right now, HTTPS certificates are only provided by: + +- [DigiCert](https://www.digicert.com/) with an Extended Validation (EV) TLS certificate, which means a considerable cost for an organization. - [HARICA](https://www.harica.gr) with Domain Validation (DV) TLS certificates. That said, there are some specific cases where you would need or want to have an HTTPS for your onion site. @@ -36,25 +37,27 @@ Users would need to click and do a manual verification, and that would show that Alternatively, websites can provide other ways to verify their onion address using HTTPS, for example, linking their onion site address from an HTTPS-authenticated page, or using [Onion-Location](https://community.torproject.org/onion-services/advanced/on…. 2. Another topic of this discussion is user expectations and modern browsers. -While there is extensive criticism regarding HTTPS and the CA trust model, the information security community has taught users to look for HTTPS when visiting a website as a synonym of secure connection and avoid HTTP connections. -Tor Developers and UX team worked together to bring a new user experience for Tor Browser users, so when a user visits an onion site using HTTP [Tor Browser doesn't display a warning or error message](https://support.torproject.org/onionservices/onionservices-5/). +While there is extensive criticism regarding HTTPS and the CA trust model, the information security community has taught users to look for HTTPS when visiting a website as a synonym of secure connection, and to avoid HTTP connections. +Tor Developers and UX team worked together to bring a new user experience for Tor Browser users, so when a user visits an onion site using HTTP, [Tor Browser doesn't display a warning or error message](https://support.torproject.org/onionservices/onionservices-5/). -3. One of the risks of using a certificate issued by a CA is that .onion names might unintentionally get [leaked](https://crt.sh/?q=.onion) due to [Certificate Transparency](https://certificate.transparency.dev/) if the onion service owners use HTTPS for their .onions. +3. One of the risks of using a certificate issued by a CA is that `.onion` names might unintentionally get [leaked](https://crt.sh/?q=.onion) if the onion service owners use HTTPS due to [Certificate Transparency](https://certificate.transparency.dev/). There is an [open proposal](https://github.com/alecmuffett/onion-dv-certificate-proposal/blob… to allow Tor Browser to verify self-created HTTPS certificates. -If this proposal gets implemented, an onion service operator could make their own HTTPS certificate chain using an onion key to sign it, and Tor Browser would know how to verify a self-created chain like that because not only do you not need to involve a third-party in making it, you don't need to reveal to a third-party that it exists. +If this proposal gets implemented, an onion service operator could make their own HTTPS certificate chain using an onion key to sign it. +Tor Browser would know how to verify such a self-created chain. +This will mean that you don't need to involve a third-party in making it, so no third-party will know that your onion exists. -4. Some websites have a complex setup and are serving HTTP and HTTPS content. +4. Some websites have a complex setup, and are serving HTTP and HTTPS content. In that case, just using onion services over HTTP could leak [secure cookies](https://github.com/alecmuffett/eotk/blob/master/docs.d/security-ad…. -We wrote about [Tor Browser security expectations](https://blog.torproject.org/tor-brower-onion-services-challen…, and how we're working on onion services usability and adoption. +We wrote about [Tor Browser security expectations](https://blog.torproject.org/tor-brower-onion-services-challen…, and how we're working on onion services usability and adoption. There are some alternatives you might want to try to address this problem: * To avoid using an HTTPS certificate for your onion, the easiest answer is to write all your content so it uses only relative links. -Then the content will work smoothly no matter what website name it's being served from. +This way the content will work smoothly, independently of what website name it's being served from. * Another option is to use webserver rules to rewrite absolute links on the fly. - * Or use a reverse proxy in the middle or more specifically EOTK with an HTTPS certificate. + * Or use a reverse proxy in the middle (more specifically EOTK with an HTTPS certificate). 5. Related to the previous point, some protocols, frameworks, and infrastructures use SSL as a technical requirement; they won't work if they don't see an "https://" link. -In that case, your onion will need to use an HTTPS certificate in order to function. +In that case, your onion service will need to use an HTTPS certificate in order to function. 6. Actually HTTPS does give you a little bit more than onion services. For example, in the case where the webserver isn't in the same location as the Tor program, you would need to use an HTTPS certificate to avoid exposing unencrypted traffic to the network in between the two. diff --git a/content/relay/community-resources/bad-relays/contents.lr b/content/relay/community-resources/bad-relays/contents.lr index 47b0b58..2733baf 100644 --- a/content/relay/community-resources/bad-relays/contents.lr +++ b/content/relay/community-resources/bad-relays/contents.lr @@ -23,9 +23,9 @@ A bad relay is one that either doesn't work properly or tampers with our users' Also, if your relay is stolen or goes missing, please report it as well, so we can blocklist it in case whoever took it puts it back online. -The following are currently permitted yet do have some discussion for prohibition (as such, they should not be reported at this time)... +The following are currently permitted yet do have some discussion for prohibition (as such, they should not be reported at this time): - * Only allowing plain-text traffic (for instance, just port 80). There's no good reason to disallow its encrypted counterpart (like port 443), making these relays highly suspect for sniffing traffic. See [context](https://www.google.com/search?site:torproject.org+80+443+6667) and [spec](https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt#n1969). +* Only allowing plain-text traffic (for instance, just port 80). There's no good reason to disallow its encrypted counterpart (like port 443), making these relays highly suspect for sniffing traffic. See [context](https://www.google.com/search?site:torproject.org+80+443+6667) and [spec](https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt#n1969). ### How do I report a bad relay?

1 0

[tpo/master] Add new Tor Browser version 10.5a17
by sysrqb＠torproject.org 29 Jun '21

29 Jun '21

commit 6eefb47d90c9008d1edf26696f43012d149cfd80 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Tue Jun 29 00:55:07 2021 +0000 Add new Tor Browser version 10.5a17 --- databags/versions.ini | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/databags/versions.ini b/databags/versions.ini index b1d61dd4..485c30e6 100644 --- a/databags/versions.ini +++ b/databags/versions.ini @@ -12,13 +12,13 @@ version = 10.0.18 version = 10.0.18 [torbrowser-alpha] -version = 10.5a16 +version = 10.5a17 [torbrowser-android-alpha] -version = 10.5a16 +version = 10.5a17 [torbrowser-win-alpha] -version = 10.5a16 +version = 10.5a17 [tor-stable] version = 0.4.6.5

1 0

[community/master] Update contents.lr
by gus＠torproject.org 28 Jun '21

28 Jun '21

commit f4b04e366837adc92092cecc0293670bc83d5812 Author: nyxnor <nyxnor(a)protonmail.com> Date: Sat Jun 26 01:03:01 2021 +0000 Update contents.lr --- content/relay/community-resources/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/relay/community-resources/contents.lr b/content/relay/community-resources/contents.lr index 667b241..6f1277e 100644 --- a/content/relay/community-resources/contents.lr +++ b/content/relay/community-resources/contents.lr @@ -75,7 +75,7 @@ Many computer science departments, university libraries, and individual students These universities include the Massachusetts Institute of Technology (MIT CSAIL), Boston University, the University of Waterloo, the University of Washington, Northeastern University, Karlstad University, Universitaet Stuttgart, and Friedrich-Alexander University Erlangen-Nuremberg. -To learn more about how to get support for a relay on your university's network, check out EFF's resources: [Tor on campus](https://www.eff.org/torchallenge/tor-on-campus.html). +To learn more about how to get support for a relay on your university's network, check out EFF's resources: Tor on campus Part [I](https://www.eff.org/deeplinks/2014/08/tor-campus-part-i-its-been-done-an… and [II](https://www.eff.org/deeplinks/2014/08/tor-campus-part-ii-icebreakers-an…. ## At your company or organization

1 0

[community/master] Add blog post title
by gus＠torproject.org 28 Jun '21

28 Jun '21

commit 071a13dacb12b96bbf71cc349888b06c199571ec Author: gus <gus(a)torproject.org> Date: Mon Jun 28 20:56:18 2021 -0300 Add blog post title --- content/relay/community-resources/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/relay/community-resources/contents.lr b/content/relay/community-resources/contents.lr index 6f1277e..30dbaaf 100644 --- a/content/relay/community-resources/contents.lr +++ b/content/relay/community-resources/contents.lr @@ -75,7 +75,7 @@ Many computer science departments, university libraries, and individual students These universities include the Massachusetts Institute of Technology (MIT CSAIL), Boston University, the University of Waterloo, the University of Washington, Northeastern University, Karlstad University, Universitaet Stuttgart, and Friedrich-Alexander University Erlangen-Nuremberg. -To learn more about how to get support for a relay on your university's network, check out EFF's resources: Tor on campus Part [I](https://www.eff.org/deeplinks/2014/08/tor-campus-part-i-its-been-done-an… and [II](https://www.eff.org/deeplinks/2014/08/tor-campus-part-ii-icebreakers-an…. +To learn more about how to get support for a relay on your university's network, check out EFF's resources: Tor on campus [Part 1 - It's Been Done Before and Should Happen Again](https://www.eff.org/deeplinks/2014/08/tor-campus-part-i-its-been-don… and [Part 2 - Icebreakers and Risk Mitigation Strategies](https://www.eff.org/deeplinks/2014/08/tor-campus-part-ii-icebre…. ## At your company or organization

1 0

[community/master] Merge branch 'repair-brokenlink-eff-resource'
by gus＠torproject.org 28 Jun '21

28 Jun '21

commit 0b6f3cab9236aec5b5b1c1251f3da1263dc76cec Merge: da3a146 f4b04e3 Author: gus <gus(a)torproject.org> Date: Mon Jun 28 20:54:25 2021 -0300 Merge branch 'repair-brokenlink-eff-resource' content/relay/community-resources/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

1 0

[translation/tbmanual-contentspot] https://gitweb.torproject.org/translation.git/commit/?h=tbmanual-contentspot
by translation＠torproject.org 28 Jun '21

28 Jun '21

commit 6746577eaff21a3c7df7eccf5874daef5398bf42 Author: Translation commit bot <translation(a)torproject.org> Date: Mon Jun 28 21:46:47 2021 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tbmanual-contentspot --- contents+fr.po | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/contents+fr.po b/contents+fr.po index 65e8823b77..f3ef835f12 100644 --- a/contents+fr.po +++ b/contents+fr.po @@ -1681,7 +1681,7 @@ msgid "" msgstr "" "Cliquez sur le menu (≡), allez dans Préférences (ou Options sur Windows), " "cliquez sur « Vie Privée et Sécurité », et dans la section des services " -"Onion cherchez « Prioriser les sites .onion s’ils sont connus » et cliquez " +"oignon cherchez « Prioriser les sites .onion s’ils sont connus » et cliquez " "sur « Toujours »." #: https//tb-manual.torproject.org/onion-services/ @@ -1697,7 +1697,7 @@ msgstr "" #: https//tb-manual.torproject.org/onion-services/ #: (content/onion-services/contents+en.lrtopic.body) msgid "## ONION SERVICE AUTHENTICATION" -msgstr "## SERVICE ONION D'AUTHENTIFICATION" +msgstr "## SERVICE OIGNON D'AUTHENTIFICATION" #: https//tb-manual.torproject.org/onion-services/ #: (content/onion-services/contents+en.lrtopic.body) @@ -1705,6 +1705,9 @@ msgid "" "An authenticated onion service is a service like an onion site that requires" " the client to provide an authentication token before accessing the service." msgstr "" +"Un service oignon authentifié est un service qui demande au client de " +"fournir un jeton d'authentification comme un site oignon avant d'accéder au " +"service." #: https//tb-manual.torproject.org/onion-services/ #: (content/onion-services/contents+en.lrtopic.body) @@ -1729,6 +1732,9 @@ msgid "" "When accessing an authenticated onion service, Tor Browser will show in the " "URL bar an icon of a little gray key, accompanied by a tooltip." msgstr "" +"Lorsque vous accèderez à un service oignon authentifié, le navigateur Tor " +"fera apparaître une petite clé grise accompagnée d'une infobulle dans la " +"barre d'URL." #: https//tb-manual.torproject.org/onion-services/ #: (content/onion-services/contents+en.lrtopic.body)

1 0

[translation/tails-misc_release] https://gitweb.torproject.org/translation.git/commit/?h=tails-misc_release
by translation＠torproject.org 28 Jun '21

28 Jun '21

commit b5809043e3644f4b342ee547bd04d7978a227226 Author: Translation commit bot <translation(a)torproject.org> Date: Mon Jun 28 21:46:27 2021 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tails-misc_release --- nl.po | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nl.po b/nl.po index 64a2e9d3b3..95dcb3eebd 100644 --- a/nl.po +++ b/nl.po @@ -24,7 +24,7 @@ # Meteor0id, 2019 # Nathan Follens, 2015 # Meteor0id, 2019-2020 -# Midgard, 2014 +# 8d98478d19376e343142c8c23c2a73b6_36c4a7f, 2014 # T. Des Maison <ton.siedsma(a)bof.nl>, 2014 # Thinkwell, 2018 # Thomas van Voorst <thomasv.voorst(a)hotmail.com>, 2017

1 0

[translation/tbmanual-contentspot] https://gitweb.torproject.org/translation.git/commit/?h=tbmanual-contentspot
by translation＠torproject.org 28 Jun '21

28 Jun '21

commit 91247f787e8614bd867ded3c3ccab001d8a7d009 Author: Translation commit bot <translation(a)torproject.org> Date: Mon Jun 28 21:17:02 2021 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tbmanual-contentspot --- contents+fr.po | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/contents+fr.po b/contents+fr.po index b7cdea7831..65e8823b77 100644 --- a/contents+fr.po +++ b/contents+fr.po @@ -9,6 +9,7 @@ # Curtis Baltimore <curtisbaltimore(a)protonmail.com>, 2021 # AO <ao(a)localizationlab.org>, 2021 # Kingouin <tom.pons(a)hotmail.fr>, 2021 +# Matburnx <matboury(a)gmail.com>, 2021 # msgid "" msgstr "" @@ -16,7 +17,7 @@ msgstr "" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2021-06-22 19:43+CET\n" "PO-Revision-Date: 2018-11-14 12:31+0000\n" -"Last-Translator: Kingouin <tom.pons(a)hotmail.fr>, 2021\n" +"Last-Translator: Matburnx <matboury(a)gmail.com>, 2021\n" "Language-Team: French (https://www.transifex.com/otf/teams/1519/fr/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -1678,6 +1679,10 @@ msgid "" "entry \"Prioritize .onion sites when known.\" and check the option " "\"Always\"." msgstr "" +"Cliquez sur le menu (≡), allez dans Préférences (ou Options sur Windows), " +"cliquez sur « Vie Privée et Sécurité », et dans la section des services " +"Onion cherchez « Prioriser les sites .onion s’ils sont connus » et cliquez " +"sur « Toujours »." #: https//tb-manual.torproject.org/onion-services/ #: (content/onion-services/contents+en.lrtopic.body) @@ -1685,11 +1690,14 @@ msgid "" "Or, if you're already running Tor Browser, you can copy and paste this " "string in a new tab: `about:preferences#privacy` and change this setting." msgstr "" +"Ou, si vous être déjà en train d'utiliser le Navigateur Tor, vous pouvez " +"copier et coller ceci dans un nouvel onglet : `about:preferences#privacy` et" +" changez le paramètre." #: https//tb-manual.torproject.org/onion-services/ #: (content/onion-services/contents+en.lrtopic.body) msgid "## ONION SERVICE AUTHENTICATION" -msgstr "" +msgstr "## SERVICE ONION D'AUTHENTIFICATION" #: https//tb-manual.torproject.org/onion-services/ #: (content/onion-services/contents+en.lrtopic.body)

1 0

[donate-static/staging] Correctly fix the footer links linking to the wrong page
by gus＠torproject.org 28 Jun '21

28 Jun '21

commit cf0f308036072581f8180945159cbdadace6bf8e Author: kez <kez(a)torproject.org> Date: Thu Jun 24 13:55:47 2021 -0400 Correctly fix the footer links linking to the wrong page The previous solution was fragile and would most likely break in the future. This is the correct solution. See: tpo/web/donate-static!36 --- templates/footer.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/footer.html b/templates/footer.html index a8b7d54e..1a45719b 100644 --- a/templates/footer.html +++ b/templates/footer.html @@ -42,7 +42,7 @@ <li{% if this.is_child_of(item.path) %} class="nav-item active" {% else %} class="nav-item"{% endif %}> {% set link = site.get(item.path) %} {% if link %} - <a class="nav-link text-light" href="/{{ item.path|url(alt=this.alt) }}"> + <a class="nav-link text-light" href="{{ ('/' + item.path)|url(alt=this.alt, absolute=True) }}"> {% else %} {% set local = bag('links', this.alt, id) %} {% if local %}

1 0

[donate-static/staging] Merge remote-tracking branch 'gitlab/kez-fix-footer-links-again' into staging
by gus＠torproject.org 28 Jun '21

28 Jun '21

commit 2811897c711db6db70282f4a2f640abd4ce8fc13 Merge: 3fc3ea26 cf0f3080 Author: gus <gus(a)torproject.org> Date: Mon Jun 28 17:16:38 2021 -0300 Merge remote-tracking branch 'gitlab/kez-fix-footer-links-again' into staging templates/footer.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

1 0