tor-commits June 2021

tor-commits@lists.torproject.org

17 participants
1287 discussions

[community/master] Merge branch 'add-harica-mention-dv-cert'
by gus＠torproject.org 25 Jun '21

25 Jun '21

commit b8ff63da33e7670de06674d00882183839c7f1d3 Merge: 303dd55 a6c4c4c Author: gus <gus(a)torproject.org> Date: Fri Jun 25 12:29:28 2021 -0300 Merge branch 'add-harica-mention-dv-cert' content/onion-services/advanced/https/contents.lr | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

1 0

[community/master] Minor fix
by gus＠torproject.org 25 Jun '21

25 Jun '21

commit 4c648889e0e8866f3f4f532771806480f8c9c67c Author: gus <gus(a)torproject.org> Date: Fri Jun 25 12:31:03 2021 -0300 Minor fix --- content/onion-services/advanced/https/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/onion-services/advanced/https/contents.lr b/content/onion-services/advanced/https/contents.lr index 4641444..b3166c8 100644 --- a/content/onion-services/advanced/https/contents.lr +++ b/content/onion-services/advanced/https/contents.lr @@ -25,7 +25,7 @@ No certificate authority is required for this proof, because that name is the ac As ".onion" is a [special top level domain name](https://tools.ietf.org/html/rfc7686), most Certificate Authorities don't have support for issuing X.509 certificates for onion sites. Right now, HTTPS certificates are only provided by - [DigiCert](https://www.digicert.com/) with an Extended Validation (EV) TLS certificate, which means a considerable cost for an organization. -- [Harica](https://www.harica.gr) with Domain Validation (DV) TLS certificates. +- [HARICA](https://www.harica.gr) with Domain Validation (DV) TLS certificates. That said, there are some specific cases where you would need or want to have an HTTPS for your onion site.

1 0

[community/master] Update contents.lr
by gus＠torproject.org 25 Jun '21

25 Jun '21

commit a6c4c4ce29b1d442ace5fccb015b05c06680d18b Author: nyxnor <nyxnor(a)protonmail.com> Date: Fri Jun 25 15:21:32 2021 +0000 Update contents.lr --- content/onion-services/advanced/https/contents.lr | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/onion-services/advanced/https/contents.lr b/content/onion-services/advanced/https/contents.lr index c49fd7a..196b9e8 100644 --- a/content/onion-services/advanced/https/contents.lr +++ b/content/onion-services/advanced/https/contents.lr @@ -23,7 +23,9 @@ When visiting a site over the onion services protocol, the Tor protocol prevents No certificate authority is required for this proof, because that name is the actual public key used to authenticate the underlying connection. As ".onion" is a [special top level domain name](https://tools.ietf.org/html/rfc7686), most Certificate Authorities don't have support for issuing X.509 certificates for onion sites. -Right now, HTTPS certificates are only provided by DigiCert with an Extended Validation (EV) TLS certificate, which means a considerable cost for an organization. +Right now, HTTPS certificates are only provided by +- [DigiCert](https://www.digicert.com/) with an Extended Validation (EV) TLS certificate, which means a considerable cost for an organization. +- [Harica](https://www.harica.gr) with Domain Validation (DV) TLS certificates. That said, there are some specific cases where you would need or want to have an HTTPS for your onion site.

1 0

[community/master] Update contents.lr
by gus＠torproject.org 25 Jun '21

25 Jun '21

commit 357079f9220749843c23c0f654b2439490d8b564 Author: nyxnor <nyxnor(a)protonmail.com> Date: Fri Jun 25 14:54:28 2021 +0000 Update contents.lr --- content/relay/community-resources/bad-relays/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/relay/community-resources/bad-relays/contents.lr b/content/relay/community-resources/bad-relays/contents.lr index 4de7718..d59a340 100644 --- a/content/relay/community-resources/bad-relays/contents.lr +++ b/content/relay/community-resources/bad-relays/contents.lr @@ -6,7 +6,7 @@ title: Bad relays --- body: -Ran into a misconfigured, malicious, or suspicious relay while using Tor? Please let us know by sending email to bad-relays AT lists DOT torproject DOT org! Many bad relays are caught thanks to our wider community, so many thanks for all your help and vigilance! +Ran into a misconfigured, malicious, or suspicious relay while using Tor? Please let us know by sending email to bad-relays AT lists DOT torproject DOT org! Many bad relays are caught thanks to our wider community, so many thanks for all your help and vigilance! The criteria for rejecting bad relays can be found in the [wiki](https://gitlab.torproject.org/tpo/network-health/team/-/wikis/Criteri… ### What is a bad relay?

1 0

[community/master] Better l10n strings
by gus＠torproject.org 25 Jun '21

25 Jun '21

commit 303dd55949b662b6407fa92defd31edc80e7374e Author: gus <gus(a)torproject.org> Date: Fri Jun 25 12:18:09 2021 -0300 Better l10n strings --- content/relay/community-resources/bad-relays/contents.lr | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/relay/community-resources/bad-relays/contents.lr b/content/relay/community-resources/bad-relays/contents.lr index d59a340..47b0b58 100644 --- a/content/relay/community-resources/bad-relays/contents.lr +++ b/content/relay/community-resources/bad-relays/contents.lr @@ -6,7 +6,9 @@ title: Bad relays --- body: -Ran into a misconfigured, malicious, or suspicious relay while using Tor? Please let us know by sending email to bad-relays AT lists DOT torproject DOT org! Many bad relays are caught thanks to our wider community, so many thanks for all your help and vigilance! The criteria for rejecting bad relays can be found in the [wiki](https://gitlab.torproject.org/tpo/network-health/team/-/wikis/Criteri… +Ran into a misconfigured, malicious, or suspicious relay while using Tor? Please let us know by sending email to bad-relays AT lists DOT torproject DOT org! +Many bad relays are caught thanks to our wider community, so many thanks for all your help and vigilance! +The criteria for rejecting bad relays can be found in the [Network Health wiki](https://gitlab.torproject.org/tpo/network-health/team/-/wikis/Criteri…. ### What is a bad relay? @@ -58,8 +60,6 @@ In just about all cases we're unable to contact the operator to resolve the issu Yes. For our automated issue detection see [exitmap](http://www.cs.kau.se/philwint/spoiled_onions/) and [sybilhunter](https://gitweb.torproject.org/user/phw/sybilhunter.git/). Other monitors include [tortunnel](https://github.com/moxie0/tortunnel), [SoaT](https://gitweb.torproject.org/torflow.git/tree/NetworkScanners/ExitAu…, [torscanner](https://code.google.com/p/torscanner/), and DetecTor. - - --- html: two-columns-page.html ---

1 0

[community/master] Merge branch 'link-bad-relay-wiki'
by gus＠torproject.org 25 Jun '21

25 Jun '21

commit b176e45ddea5507fecb3fce7d878723fc41439fb Merge: 074d0af 357079f Author: gus <gus(a)torproject.org> Date: Fri Jun 25 12:16:20 2021 -0300 Merge branch 'link-bad-relay-wiki' content/relay/community-resources/bad-relays/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

1 0

[manual/master] update instructions for preferences, add instructions for windows. will-fix: https://gitlab.torproject.org/tpo/web/manual/-/issues/57. this merge contains work done by GoodieC on https://github.com/torproject/manual/pull/82, https://github.com/torproject/manual/pull/81 and https://github.com/torproject/manual/pull/80.
by emmapeel＠torproject.org 25 Jun '21

25 Jun '21

commit bfc5679ac60504f94b65020d97e9a4286e247aeb Author: emma peel <emma.peel(a)riseup.net> Date: Fri Jun 25 17:02:54 2021 +0200 update instructions for preferences, add instructions for windows. will-fix: https://gitlab.torproject.org/tpo/web/manual/-/issues/57. this merge contains work done by GoodieC on https://github.com/torproject/manual/pull/82, https://github.com/torproject/manual/pull/81 and https://github.com/torproject/manual/pull/80. --- content/bridges/contents.lr | 4 ++-- content/circumvention/contents.lr | 2 +- content/plugins/contents.lr | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/content/bridges/contents.lr b/content/bridges/contents.lr index a94ad62..92ab4ab 100644 --- a/content/bridges/contents.lr +++ b/content/bridges/contents.lr @@ -33,7 +33,7 @@ If you're starting Tor Browser for the first time, click "Configure" to open the After checking the checkbox "Tor is censored in my country," choose "Request a bridge from torproject.org" and click "Request a Bridge..." for BridgeDB to provide a bridge. Complete the Captcha and click "Submit." Click "Connect" to save your settings. -Or, if you have Tor Browser running, click on "Preferences" in the hamburger menu and then on "Tor" in the sidebar. +Or, if you have Tor Browser running, click on "Preferences" (or "Options" on Windows) in the [hamburger menu (≡)](https://support.torproject.org/glossary/hamburger-menu/) and then on "Tor" in the sidebar. In the "Bridges" section, check the checkbox "Use a bridge," and from the option "Request a bridge from torproject.org," click "Request a New Bridge..." for BridgeDB to provide a bridge. Complete the Captcha and click "Submit." Your setting will automatically be saved once you close the tab. @@ -47,7 +47,7 @@ If you're starting Tor Browser for the first time, click "Configure" to open the After checking the checkbox "Tor is censored in my country," choose "Provide a bridge I know" and enter each bridge address on a separate line. Click "Connect" to save your settings. -Or, if you have Tor Browser running, click on "Preferences" in the hamburger menu and then on "Tor" in the sidebar. +Or, if you have Tor Browser running, click on "Preferences" (or "Options" on Windows) in the [hamburger menu (≡)](https://support.torproject.org/glossary/hamburger-menu/) and then on "Tor" in the sidebar. In the "Bridges" section, check the checkbox "Use a bridge," and from the option "Provide a bridge I know," enter each bridge address on a separate line. Your settings will automatically be saved once you close the tab. diff --git a/content/circumvention/contents.lr b/content/circumvention/contents.lr index 2b98024..d3245e8 100644 --- a/content/circumvention/contents.lr +++ b/content/circumvention/contents.lr @@ -54,7 +54,7 @@ After checking the checkbox "Tor is censored in my country," choose the "Select From the dropdown, select whichever pluggable transport you'd like to use. Once you've selected the pluggable transport, click "Connect" to save your settings. -Or, if you have Tor Browser running, click on "Preferences" in the hamburger menu and then on "Tor" in the sidebar. +Or, if you have Tor Browser running, click on "Preferences" (or "Options" on Windows) in the [hamburger menu (≡)](https://support.torproject.org/glossary/hamburger-menu/) and then on "Tor" in the sidebar. In the "Bridges" section, check the checkbox "Use a bridge," and from the option "Select a built-in bridge," choose whichever pluggable transport you'd like to use from the dropdown. Your settings will automatically be saved once you close the tab. diff --git a/content/plugins/contents.lr b/content/plugins/contents.lr index b0379dd..66bae53 100644 --- a/content/plugins/contents.lr +++ b/content/plugins/contents.lr @@ -19,7 +19,7 @@ Some video websites (such as YouTube) offer alternative video delivery methods t JavaScript is a programming language that websites use to offer interactive elements such as video, animation, audio, and status timelines. Unfortunately, JavaScript can also enable attacks on the security of the browser, which might lead to deanonymization. -Tor Browser includes an add-on called NoScript. It's accessible through 'Preferences' on hamburger menu (main menu), then select 'Customize' and drag the “S” icon to the top-right of the window. NoScript allows you to control the JavaScript (and other scripts) that runs on individual web pages, or block it entirely. +Tor Browser includes an add-on called NoScript. It's accessible through "Preferences" (or "Options" on Windows) on the [hamburger menu (≡)](https://support.torproject.org/glossary/hamburger-menu/), then select 'Customize' and drag the “S” icon to the top-right of the window. NoScript allows you to control the JavaScript (and other scripts) that runs on individual web pages, or block it entirely. Users who require a high degree of security in their web browsing should set Tor Browser’s [Security Level](../security-settings/) to “Safer” (which disables JavaScript for non-HTTPS websites) or “Safest” (which does so for all websites). However, disabling JavaScript will prevent many websites from displaying correctly, so Tor Browser’s default setting is to allow all websites to run scripts in "Standard" mode.

1 0

[translation/tails-onioncircuits_release] https://gitweb.torproject.org/translation.git/commit/?h=tails-onioncircuits_release
by translation＠torproject.org 25 Jun '21

25 Jun '21

commit df7de61f4df35ef8756ad98e5374061baa336205 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Jun 25 14:46:49 2021 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tails-onioncircuits… --- nl/onioncircuits.po | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nl/onioncircuits.po b/nl/onioncircuits.po index 3a55ef9923..8012084b26 100644 --- a/nl/onioncircuits.po +++ b/nl/onioncircuits.po @@ -4,9 +4,9 @@ # # Translators: # André Koot <meneer(a)tken.net>, 2016 -# tx, 2019 +# Meteor0id, 2019 # Nathan Follens, 2019 -# tx, 2019 +# Meteor0id, 2019 # Tonnes <tonnes.mb(a)gmail.com>, 2019 # Volluta <volluta(a)tutanota.com>, 2016 msgid ""

1 0

[translation/tails-misc_release] https://gitweb.torproject.org/translation.git/commit/?h=tails-misc_release
by translation＠torproject.org 25 Jun '21

25 Jun '21

commit c574d8f97c5cc8650d943e91d5071917e53afb04 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Jun 25 14:46:29 2021 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tails-misc_release --- nl.po | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nl.po b/nl.po index 7134c93aba..64a2e9d3b3 100644 --- a/nl.po +++ b/nl.po @@ -21,9 +21,9 @@ # kwadronaut <kwadronaut(a)autistici.org>, 2017-2019,2021 # LittleNacho <louisboy(a)msn.com>, 2013 # 53a60eabbf5124a226a7678001f9a57b, 2015 -# tx, 2019 +# Meteor0id, 2019 # Nathan Follens, 2015 -# tx, 2019-2020 +# Meteor0id, 2019-2020 # Midgard, 2014 # T. Des Maison <ton.siedsma(a)bof.nl>, 2014 # Thinkwell, 2018

1 0

[community/master] Better l10n strings
by gus＠torproject.org 25 Jun '21

25 Jun '21

commit 074d0af6b0d32887f29170d3ad65456b50528ea9 Author: gus <gus(a)torproject.org> Date: Fri Jun 25 11:44:28 2021 -0300 Better l10n strings --- content/onion-services/advanced/https/contents.lr | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/onion-services/advanced/https/contents.lr b/content/onion-services/advanced/https/contents.lr index 675ee83..c0aa241 100644 --- a/content/onion-services/advanced/https/contents.lr +++ b/content/onion-services/advanced/https/contents.lr @@ -37,7 +37,9 @@ Alternatively, websites can provide other ways to verify their onion address usi While there is extensive criticism regarding HTTPS and the CA trust model, the information security community has taught users to look for HTTPS when visiting a website as a synonym of secure connection and avoid HTTP connections. Tor Developers and UX team worked together to bring a new user experience for Tor Browser users, so when a user visits an onion site using HTTP [Tor Browser doesn't display a warning or error message](https://support.torproject.org/onionservices/onionservices-5/). -3. One of the risks of using a certificate issued by a CA is that .onion names might unintentionally get [leaked](https://crt.sh/?q=.onion) due to [Certificate Transparency](https://certificate.transparency.dev/) if the onion service owners use HTTPS for their .onions. If you still want to use HTTPS, there is an [open proposal](https://github.com/alecmuffett/onion-dv-certificate-proposal/blob… to allow Tor Browser to verify self-created https cert (where you can make your own https cert chain using your onion key to sign it, and Tor Browser knows how to verify a self-created chain like that), because not only do you not need to involve a third-party in making it, you don't need to reveal to a third-party that it exists. +3. One of the risks of using a certificate issued by a CA is that .onion names might unintentionally get [leaked](https://crt.sh/?q=.onion) due to [Certificate Transparency](https://certificate.transparency.dev/) if the onion service owners use HTTPS for their .onions. +There is an [open proposal](https://github.com/alecmuffett/onion-dv-certificate-proposal/blob… to allow Tor Browser to verify self-created HTTPS certificates. +If this proposal gets implemented, an onion service operator could make their own HTTPS certificate chain using an onion key to sign it, and Tor Browser would know how to verify a self-created chain like that because not only do you not need to involve a third-party in making it, you don't need to reveal to a third-party that it exists. 4. Some websites have a complex setup and are serving HTTP and HTTPS content. In that case, just using onion services over HTTP could leak [secure cookies](https://github.com/alecmuffett/eotk/blob/master/docs.d/security-ad….

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits June 2021