tor-commits

tor-commits@lists.torproject.org

1 participants
214711 discussions

r24450: {website} Correcting for the @torproject.org -> @lists.torproject.org (website/trunk/about/en)
by Damian Johnson 26 Mar '11

26 Mar '11

Author: atagar Date: 2011-03-26 20:47:39 +0000 (Sat, 26 Mar 2011) New Revision: 24450 Modified: website/trunk/about/en/contact.wml Log: Correcting for the @torproject.org -> @lists.torproject.org migration. With the exception of tor-ops (which is noted in the man page and https://www.torproject.org/docs/tor-manual.html) this should be it - all remaining @torproject.org addresses appear to be for individuals or autoresponders. Modified: website/trunk/about/en/contact.wml =================================================================== --- website/trunk/about/en/contact.wml 2011-03-26 16:10:16 UTC (rev 24449) +++ website/trunk/about/en/contact.wml 2011-03-26 20:47:39 UTC (rev 24450) @@ -16,7 +16,7 @@ <p>First, if you have a problem or question about using Tor, go look at the <a href="<page docs/documentation>#Support">Support section</a> for how to proceed. The Tor developers spend most of their time developing Tor, and there are no people devoted to user support, so try to help yourself before <a href="<page docs/faq>#SupportMail">politely trying to find a volunteer</a>.</p> <p>If you really do need to reach us, here are some approaches. All - of these addresses are @torproject.org. Please be patient and <a + of these addresses are @lists.torproject.org. Please be patient and <a href="http://www.catb.org/~esr/faqs/smart-questions.html">helpful</a>, and please make sure to write your mail in English.</p>

1 0

r24449: {website} update the mirrors table. (website/trunk/include)
by Andrew Lewman 26 Mar '11

26 Mar '11

Author: phobos Date: 2011-03-26 16:10:16 +0000 (Sat, 26 Mar 2011) New Revision: 24449 Modified: website/trunk/include/mirrors-table.wmi Log: update the mirrors table. Modified: website/trunk/include/mirrors-table.wmi =================================================================== --- website/trunk/include/mirrors-table.wmi 2011-03-26 16:08:25 UTC (rev 24448) +++ website/trunk/include/mirrors-table.wmi 2011-03-26 16:10:16 UTC (rev 24449) @@ -18,23 +18,6 @@ <tr> - <td>NL</td> - - <td>Amorphis</td> - - <td>Up to date</td> - - <td> - </td> - <td><a href="http://tor.amorphis.eu/dist/">http</a></td> - <td><a href="http://tor.amorphis.eu/">http</a></td> - <td> - </td> - <td> - </td> - <td> - </td> - <td> - </td> -</tr> - -<tr> - <td>US</td> <td>searchprivate</td> @@ -86,40 +69,6 @@ <tr> - <td>DK</td> - - <td>Zentrum der Gesundheit</td> - - <td>Up to date</td> - - <td> - </td> - <td><a href="http://tor.idnr.ws/dist/">http</a></td> - <td><a href="http://tor.idnr.ws/">http</a></td> - <td> - </td> - <td> - </td> - <td> - </td> - <td> - </td> -</tr> - -<tr> - - <td>EE</td> - - <td>CyberSIDE</td> - - <td>Up to date</td> - - <td> - </td> - <td><a href="http://cyberside.net.ee/tor/">http</a></td> - <td><a href="http://cyberside.planet.ee/tor/">http</a></td> - <td> - </td> - <td> - </td> - <td> - </td> - <td> - </td> -</tr> - -<tr> - <td>DE</td> <td>chaos darmstadt</td> @@ -222,49 +171,66 @@ <tr> - <td>SE</td> + <td>DE</td> - <td>homosu</td> + <td>[[:bbs:]]</td> <td>Up to date</td> <td> - </td> - <td><a href="http://tor.homosu.net/dist">http</a></td> - <td><a href="http://tor.homosu.net/">http</a></td> + <td><a href="http://tor.blingblingsquad.net/dist">http</a></td> + <td><a href="http://tor.blingblingsquad.net/">http</a></td> + <td><a href="https://tor.blingblingsquad.net/dist">https</a></td> + <td><a href="https://tor.blingblingsquad.net/">https</a></td> <td> - </td> <td> - </td> +</tr> + +<tr> + + <td>NL</td> + + <td>Amorphis</td> + + <td>Up to date</td> + <td> - </td> + <td><a href="http://tor.amorphis.eu/dist/">http</a></td> + <td><a href="http://tor.amorphis.eu/">http</a></td> <td> - </td> + <td> - </td> + <td> - </td> + <td> - </td> </tr> <tr> - <td>DE</td> + <td>DK</td> - <td>[[:bbs:]]</td> + <td>Zentrum der Gesundheit</td> <td>Up to date</td> <td> - </td> - <td><a href="http://tor.blingblingsquad.net/dist">http</a></td> - <td><a href="http://tor.blingblingsquad.net/">http</a></td> - <td><a href="https://tor.blingblingsquad.net/dist">https</a></td> - <td><a href="https://tor.blingblingsquad.net/">https</a></td> + <td><a href="http://tor.idnr.ws/dist/">http</a></td> + <td><a href="http://tor.idnr.ws/">http</a></td> <td> - </td> <td> - </td> + <td> - </td> + <td> - </td> </tr> <tr> - <td>INT</td> + <td>SE</td> - <td>CoralCDN</td> + <td>homosu</td> <td>Up to date</td> <td> - </td> - <td><a href="http://www.torproject.org.nyud.net/dist/">http</a></td> - <td><a href="http://www.torproject.org.nyud.net/">http</a></td> + <td><a href="http://tor.homosu.net/dist">http</a></td> + <td><a href="http://tor.homosu.net/">http</a></td> <td> - </td> <td> - </td> <td> - </td> @@ -273,6 +239,23 @@ <tr> + <td>EE</td> + + <td>CyberSIDE</td> + + <td>Out of date</td> + + <td> - </td> + <td><a href="http://cyberside.net.ee/tor/">http</a></td> + <td><a href="http://cyberside.planet.ee/tor/">http</a></td> + <td> - </td> + <td> - </td> + <td> - </td> + <td> - </td> +</tr> + +<tr> + <td>IN</td> <td>India Tor Fans</td> @@ -292,7 +275,7 @@ <td>IR</td> - <td>Access</td> + <td>Ninjas</td> <td>Out of date</td> @@ -375,6 +358,23 @@ <tr> + <td>IS</td> + + <td>tor</td> + + <td>Out of date</td> + + <td> - </td> + <td><a href="http://torproject.is/dist">http</a></td> + <td> - </td> + <td> - </td> + <td> - </td> + <td> - </td> + <td> - </td> +</tr> + +<tr> + <td>NL</td> <td>BIT BV</td> @@ -477,6 +477,23 @@ <tr> + <td>INT</td> + + <td>CoralCDN</td> + + <td>Unknown</td> + + <td> - </td> + <td><a href="http://www.torproject.org.nyud.net/dist/">http</a></td> + <td><a href="http://www.torproject.org.nyud.net/">http</a></td> + <td> - </td> + <td> - </td> + <td> - </td> + <td> - </td> +</tr> + +<tr> + <td>DE</td> <td>Spline</td>

1 0

r24448: {website} and fix the rest of the org update. (website/trunk)
by Andrew Lewman 26 Mar '11

26 Mar '11

Author: phobos Date: 2011-03-26 16:08:25 +0000 (Sat, 26 Mar 2011) New Revision: 24448 Modified: website/trunk/update-mirrors.pl Log: and fix the rest of the org update. Modified: website/trunk/update-mirrors.pl =================================================================== --- website/trunk/update-mirrors.pl 2011-03-26 16:06:11 UTC (rev 24447) +++ website/trunk/update-mirrors.pl 2011-03-26 16:08:25 UTC (rev 24448) @@ -457,7 +457,7 @@ }, mirror023 => { - adminContact => "sina at accessnow.org", + adminContact => "SiNA", orgName => "Ninjas", isoCC => "IR", subRegion => "",

1 0

r24447: {website} fix one org name. (website/trunk)
by Andrew Lewman 26 Mar '11

26 Mar '11

Author: phobos Date: 2011-03-26 16:06:11 +0000 (Sat, 26 Mar 2011) New Revision: 24447 Modified: website/trunk/update-mirrors.pl Log: fix one org name. Modified: website/trunk/update-mirrors.pl =================================================================== --- website/trunk/update-mirrors.pl 2011-03-26 16:03:11 UTC (rev 24446) +++ website/trunk/update-mirrors.pl 2011-03-26 16:06:11 UTC (rev 24447) @@ -458,7 +458,7 @@ mirror023 => { adminContact => "sina at accessnow.org", - orgName => "Access", + orgName => "Ninjas", isoCC => "IR", subRegion => "", region => "IR",

1 0

r24446: {website} add cyberarmy and iceland mirrors. (website/trunk)
by Andrew Lewman 26 Mar '11

26 Mar '11

Author: phobos Date: 2011-03-26 16:03:11 +0000 (Sat, 26 Mar 2011) New Revision: 24446 Modified: website/trunk/update-mirrors.pl Log: add cyberarmy and iceland mirrors. Modified: website/trunk/update-mirrors.pl =================================================================== --- website/trunk/update-mirrors.pl 2011-03-26 00:17:53 UTC (rev 24445) +++ website/trunk/update-mirrors.pl 2011-03-26 16:03:11 UTC (rev 24446) @@ -623,6 +623,42 @@ httpsDistMirror => "", rsyncDistMirror => "", hiddenServiceMirror => "", + }, + mirror032 => { + adminContact => "", + orgName => "cyberarmy", + isoCC => "AT", + subRegion => "", + region => "AT", + ipv4 => "True", + ipv6 => "False", + loadBalanced => "No", + httpWebsiteMirror => "http://tor.cyberarmy.at", + httpsWebsiteMirror => "", + rsyncWebsiteMirror => "", + ftpWebsiteMirror => "", + httpDistMirror => "http://tor.cyberarmy.at/dist", + httpsDistMirror => "", + rsyncDistMirror => "", + hiddenServiceMirror => "", + }, + mirror032 => { + adminContact => "", + orgName => "tor", + isoCC => "IS", + subRegion => "", + region => "IS", + ipv4 => "True", + ipv6 => "False", + loadBalanced => "No", + httpWebsiteMirror => "", + httpsWebsiteMirror => "", + rsyncWebsiteMirror => "", + ftpWebsiteMirror => "", + httpDistMirror => "http://torproject.is/dist", + httpsDistMirror => "", + rsyncDistMirror => "", + hiddenServiceMirror => "", } );

1 0

r24445: {website} Update design html. (website/trunk/torbutton/en/design)
by Mike Perry 26 Mar '11

26 Mar '11

Author: mikeperry Date: 2011-03-26 00:17:53 +0000 (Sat, 26 Mar 2011) New Revision: 24445 Modified: website/trunk/torbutton/en/design/index.html.en Log: Update design html. Modified: website/trunk/torbutton/en/design/index.html.en =================================================================== --- website/trunk/torbutton/en/design/index.html.en 2011-03-25 23:31:40 UTC (rev 24444) +++ website/trunk/torbutton/en/design/index.html.en 2011-03-26 00:17:53 UTC (rev 24445) @@ -1,7 +1,7 @@ <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> -<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Torbutton Design Documentation</title><meta name="generator" content="DocBook XSL Stylesheets V1.75.2" /></head><body><div class="article" title="Torbutton Design Documentation"><div class="titlepage"><div><div><h2 class="title"><a id="design"></a>Torbutton Design Documentation</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Mike</span> <span class="surname">Perry</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:mikeperry.fscked/org">mikeperry.fscked/org</a>></code></p></div></div></div></div><div><p class="pubdate">Mar 25 2011</p></div></div><hr /></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="#id2647809">1. Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="#adversary">1.1. Adversary Model</a> </span></dt><dt><span class="sect2"><a href="#requirements">1.2. Torbutton Requirements</a></span></dt><dt><span class="sect2"><a href="#layout">1.3. Extension Layout</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2662790">2. Components</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2680078">2.1. Hooked Components</a></span></dt><dt><span class="sect2"><a href="#id2682465">2.2. New Components</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2684278">3. Chrome</a></span></dt><dd><dl><dt><span class="sect2"><a href="#browseroverlay">3.1. Browser Overlay - torbutton.xul</a></span></dt><dt><span class="sect2"><a href="#id2666921">3.2. Preferences Window - preferences.xul</a></span></dt><dt><span class="sect2"><a href="#id2659528">3.3. Other Windows</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2650612">4. Toggle Code Path</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2681148">4.1. Button Click</a></span></dt><dt>< span class="sect2"><a href="#id2683321">4.2. Proxy Update</a></span></dt><dt><span class="sect2"><a href="#id2662007">4.3. Settings Update</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2679416">5. Description of Options</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2674592">5.1. Test Settings</a></span></dt><dt><span class="sect2"><a href="#plugins">5.2. Disable plugins on Tor Usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2658766">5.3. Isolate Dynamic Content to Tor State (crucial)</a></span></dt><dt><span class="sect2"><a href="#jshooks">5.4. Hook Dangerous Javascript</a></span></dt><dt><span class="sect2"><a href="#id2668126">5.5. Resize windows to multiples of 50px during Tor usage (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2660426">5.6. Disable Updates During Tor</a></span></dt><dt><span class="sect2"><a href="#id2644084">5.7. Redirect Torbutton Updates Via Tor (recommended)</a></span></dt><dt><span c lass="sect2"><a href="#id2644128">5.8. Disable Search Suggestions during Tor (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2644167">5.9. Disable livemarks updates during Tor usage (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2644238">5.10. Block Tor/Non-Tor access to network from file:// urls (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2644310">5.11. Close all Tor/Non-Tor tabs and windows on toggle (optional)</a></span></dt><dt><span class="sect2"><a href="#id2644391">5.12. Isolate Access to History navigation to Tor state (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2644476">5.13. History Access Settings</a></span></dt><dt><span class="sect2"><a href="#id2644588">5.14. Clear History During Tor Toggle (optional)</a></span></dt><dt><span class="sect2"><a href="#id2686134">5.15. Block Password+Form saving during Tor/Non-Tor</a></span></dt><dt><span class="sect2"><a href="#id2686195">5.16. Block Tor dis k cache and clear all cache on Tor Toggle</a></span></dt><dt><span class="sect2"><a href="#id2686245">5.17. Block disk and memory cache during Tor</a></span></dt><dt><span class="sect2"><a href="#id2686298">5.18. Clear Cookies on Tor Toggle</a></span></dt><dt><span class="sect2"><a href="#id2686349">5.19. Store Non-Tor cookies in a protected jar</a></span></dt><dt><span class="sect2"><a href="#id2686405">5.20. Store both Non-Tor and Tor cookies in a protected jar (dangerous)</a></span></dt><dt><span class="sect2"><a href="#id2686444">5.21. Manage My Own Cookies (dangerous)</a></span></dt><dt><span class="sect2"><a href="#id2686459">5.22. Disable DOM Storage during Tor usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2686563">5.23. Clear HTTP Auth on Tor Toggle (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2686600">5.24. Clear cookies on Tor/Non-Tor shutdown</a></span></dt><dt><span class="sect2"><a href="#id2686655">5.25. Reload cookie ja r/clear cookies on Firefox crash</a></span></dt><dt><span class="sect2"><a href="#id2686731">5.26. On crash recovery or session restored startup, restore via: Tor, Non-Tor</a></span></dt><dt><span class="sect2"><a href="#id2686802">5.27. On normal startup, set state to: Tor, Non-Tor, Shutdown State</a></span></dt><dt><span class="sect2"><a href="#id2686861">5.28. Prevent session store from saving Non-Tor/Tor-loaded tabs</a></span></dt><dt><span class="sect2"><a href="#id2686926">5.29. Set user agent during Tor usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2687100">5.30. Spoof US English Browser</a></span></dt><dt><span class="sect2"><a href="#id2687193">5.31. Don't send referrer during Tor Usage</a></span></dt><dt><span class="sect2"><a href="#id2687234">5.32. Strip platform and language off of Google Search Box queries</a></span></dt><dt><span class="sect2"><a href="#id2687274">5.33. Automatically use an alternate search engine when presented with a -Google Captcha</a></span></dt><dt><span class="sect2"><a href="#id2687355">5.34. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)</a></span></dt></dl></dd><dt><span class="sect1"><a href="#FirefoxBugs">6. Relevant Firefox Bugs</a></span></dt><dd><dl><dt><span class="sect2"><a href="#FirefoxSecurity">6.1. Bugs impacting security</a></span></dt><dt><span class="sect2"><a href="#FirefoxWishlist">6.2. Bugs blocking functionality</a></span></dt><dt><span class="sect2"><a href="#FirefoxMiscBugs">6.3. Low Priority Bugs</a></span></dt></dl></dd><dt><span class="sect1"><a href="#TestPlan">7. Testing</a></span></dt><dd><dl><dt><span class="sect2"><a href="#SingleStateTesting">7.1. Single state testing</a></span></dt><dt><span class="sect2"><a href="#id2688437">7.2. Multi-state testing</a></span></dt><dt><span class="sect2"><a href="#HackTorbutton">7.3. Active testing (aka How to Hack Torbutton)</a></span></dt></dl></dd></dl></div><div class="sect1" title="1. Introduc tion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2647809"></a>1. Introduction</h2></div></div></div><p> +<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Torbutton Design Documentation</title><meta name="generator" content="DocBook XSL Stylesheets V1.75.2" /></head><body><div class="article" title="Torbutton Design Documentation"><div class="titlepage"><div><div><h2 class="title"><a id="design"></a>Torbutton Design Documentation</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Mike</span> <span class="surname">Perry</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:mikeperry.fscked/org">mikeperry.fscked/org</a>></code></p></div></div></div></div><div><p class="pubdate">Mar 25 2011</p></div></div><hr /></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="#id2940331">1. Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="#adversary">1.1. Adversary Model</a> </span></dt><dt><span class="sect2"><a href="#requirements">1.2. Torbutton Requirements</a></span></dt><dt><span class="sect2"><a href="#layout">1.3. Extension Layout</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2955313">2. Components</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2972601">2.1. Hooked Components</a></span></dt><dt><span class="sect2"><a href="#id2974988">2.2. New Components</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2976801">3. Chrome</a></span></dt><dd><dl><dt><span class="sect2"><a href="#browseroverlay">3.1. Browser Overlay - torbutton.xul</a></span></dt><dt><span class="sect2"><a href="#id2959444">3.2. Preferences Window - preferences.xul</a></span></dt><dt><span class="sect2"><a href="#id2952051">3.3. Other Windows</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2943135">4. Toggle Code Path</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2973670">4.1. Button Click</a></span></dt><dt>< span class="sect2"><a href="#id2975844">4.2. Proxy Update</a></span></dt><dt><span class="sect2"><a href="#id2954530">4.3. Settings Update</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2971938">5. Description of Options</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2967115">5.1. Test Settings</a></span></dt><dt><span class="sect2"><a href="#plugins">5.2. Disable plugins on Tor Usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2951289">5.3. Isolate Dynamic Content to Tor State (crucial)</a></span></dt><dt><span class="sect2"><a href="#jshooks">5.4. Hook Dangerous Javascript</a></span></dt><dt><span class="sect2"><a href="#id2960649">5.5. Resize windows to multiples of 50px during Tor usage (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2952949">5.6. Disable Updates During Tor</a></span></dt><dt><span class="sect2"><a href="#id2936606">5.7. Redirect Torbutton Updates Via Tor (recommended)</a></span></dt><dt><span c lass="sect2"><a href="#id2936650">5.8. Disable Search Suggestions during Tor (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2936689">5.9. Disable livemarks updates during Tor usage (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2936761">5.10. Block Tor/Non-Tor access to network from file:// urls (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2936833">5.11. Close all Tor/Non-Tor tabs and windows on toggle (optional)</a></span></dt><dt><span class="sect2"><a href="#id2936914">5.12. Isolate Access to History navigation to Tor state (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2936998">5.13. History Access Settings</a></span></dt><dt><span class="sect2"><a href="#id2937111">5.14. Clear History During Tor Toggle (optional)</a></span></dt><dt><span class="sect2"><a href="#id2978657">5.15. Block Password+Form saving during Tor/Non-Tor</a></span></dt><dt><span class="sect2"><a href="#id2978718">5.16. Block Tor dis k cache and clear all cache on Tor Toggle</a></span></dt><dt><span class="sect2"><a href="#id2978768">5.17. Block disk and memory cache during Tor</a></span></dt><dt><span class="sect2"><a href="#id2978820">5.18. Clear Cookies on Tor Toggle</a></span></dt><dt><span class="sect2"><a href="#id2978871">5.19. Store Non-Tor cookies in a protected jar</a></span></dt><dt><span class="sect2"><a href="#id2978928">5.20. Store both Non-Tor and Tor cookies in a protected jar (dangerous)</a></span></dt><dt><span class="sect2"><a href="#id2978967">5.21. Manage My Own Cookies (dangerous)</a></span></dt><dt><span class="sect2"><a href="#id2978982">5.22. Disable DOM Storage during Tor usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2979086">5.23. Clear HTTP Auth on Tor Toggle (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2979123">5.24. Clear cookies on Tor/Non-Tor shutdown</a></span></dt><dt><span class="sect2"><a href="#id2979178">5.25. Reload cookie ja r/clear cookies on Firefox crash</a></span></dt><dt><span class="sect2"><a href="#id2979253">5.26. On crash recovery or session restored startup, restore via: Tor, Non-Tor</a></span></dt><dt><span class="sect2"><a href="#id2979325">5.27. On normal startup, set state to: Tor, Non-Tor, Shutdown State</a></span></dt><dt><span class="sect2"><a href="#id2979384">5.28. Prevent session store from saving Non-Tor/Tor-loaded tabs</a></span></dt><dt><span class="sect2"><a href="#id2979449">5.29. Set user agent during Tor usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2979623">5.30. Spoof US English Browser</a></span></dt><dt><span class="sect2"><a href="#id2979716">5.31. Don't send referrer during Tor Usage</a></span></dt><dt><span class="sect2"><a href="#id2979756">5.32. Strip platform and language off of Google Search Box queries</a></span></dt><dt><span class="sect2"><a href="#id2979797">5.33. Automatically use an alternate search engine when presented with a +Google Captcha</a></span></dt><dt><span class="sect2"><a href="#id2979878">5.34. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)</a></span></dt></dl></dd><dt><span class="sect1"><a href="#FirefoxBugs">6. Relevant Firefox Bugs</a></span></dt><dd><dl><dt><span class="sect2"><a href="#FirefoxSecurity">6.1. Bugs impacting security</a></span></dt><dt><span class="sect2"><a href="#FirefoxWishlist">6.2. Bugs blocking functionality</a></span></dt><dt><span class="sect2"><a href="#FirefoxMiscBugs">6.3. Low Priority Bugs</a></span></dt></dl></dd><dt><span class="sect1"><a href="#TestPlan">7. Testing</a></span></dt><dd><dl><dt><span class="sect2"><a href="#SingleStateTesting">7.1. Single state testing</a></span></dt><dt><span class="sect2"><a href="#id2980994">7.2. Multi-state testing</a></span></dt><dt><span class="sect2"><a href="#HackTorbutton">7.3. Active testing (aka How to Hack Torbutton)</a></span></dt></dl></dd></dl></div><div class="sect1" title="1. Introduc tion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2940331"></a>1. Introduction</h2></div></div></div><p> This document describes the goals, operation, and testing procedures of the Torbutton Firefox extension. It is current as of Torbutton 1.2.5. @@ -232,13 +232,13 @@ stable.</p><p>'Chrome' is a combination of XML and Javascript used to describe a window. Extensions are allowed to create 'overlays' that are 'bound' to existing XML window definitions, or they can create their own windows. The DTD for this XML -is called <a class="ulink" href="http://developer.mozilla.org/en/docs/XUL_Reference" target="_top">XUL</a>.</p></div></div><div class="sect1" title="2. Components"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2662790"></a>2. Components</h2></div></div></div><p> +is called <a class="ulink" href="http://developer.mozilla.org/en/docs/XUL_Reference" target="_top">XUL</a>.</p></div></div><div class="sect1" title="2. Components"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2955313"></a>2. Components</h2></div></div></div><p> Torbutton installs components for two purposes: hooking existing components to reimplement their interfaces; and creating new components that provide services to other pieces of the extension. - </p><div class="sect2" title="2.1. Hooked Components"><div class="titlepage"><div><div><h3 class="title"><a id="id2680078"></a>2.1. Hooked Components</h3></div></div></div><p>Torbutton makes extensive use of Contract ID hooking, and implements some + </p><div class="sect2" title="2.1. Hooked Components"><div class="titlepage"><div><div><h3 class="title"><a id="id2972601"></a>2.1. Hooked Components</h3></div></div></div><p>Torbutton makes extensive use of Contract ID hooking, and implements some of its own standalone components as well. Let's discuss the hooked components first.</p><div class="sect3" title="@mozilla.org/browser/sessionstore;1 - components/nsSessionStore36.js"><div class="titlepage"><div><div><h4 class="title"><a id="sessionstore"></a><a class="ulink" href="http://developer.mozilla.org/en/docs/nsISessionStore" target="_top">@mozilla.org/browser/sessionstore;1</a> - <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/nsSessi…" target="_top">components/nsSessionStore36.js</a></h4></div></div></div><p>These components address the <a class="link" href="#disk">Disk Avoidance</a> @@ -267,7 +267,7 @@ back to arbitrary servers outside of Tor with no user intervention. Fixing this issue helps to satisfy Torbutton's <a class="link" href="#proxy">Proxy Obedience</a> Requirement. - </p></div><div class="sect3" title="@mozilla.org/browser/sessionstartup;1 - components/crash-observer.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2658953"></a><a class="ulink" href="http://lxr.mozilla.org/seamonkey/source/browser/components/sessionstore/src…" target="_top">@mozilla.org/browser/sessionstartup;1</a> - + </p></div><div class="sect3" title="@mozilla.org/browser/sessionstartup;1 - components/crash-observer.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2951475"></a><a class="ulink" href="http://lxr.mozilla.org/seamonkey/source/browser/components/sessionstore/src…" target="_top">@mozilla.org/browser/sessionstartup;1</a> - <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/crash-o…" target="_top">components/crash-observer.js</a></h4></div></div></div><p>This component wraps the Firefox Session Startup component that is in charge of <a class="ulink" href="http://developer.mozilla.org/en/docs/Session_store_API" target="_top">restoring saved sessions</a>. The wrapper's only job is to intercept the @@ -281,7 +281,7 @@ in the preferences window (<span class="command"><strong>extensions.torbutton.restore_tor</strong></span>), and restoring cookies for the corresponding cookie jar, if it exists.</p><p>By performing this notification, this component assists in the <a class="link" href="#proxy">Proxy Obedience</a>, and <a class="link" href="#isolation">Network Isolation</a> requirements. -</p></div><div class="sect3" title="@mozilla.org/browser/global-history;2 - components/ignore-history.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2679280"></a><a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/c…" target="_top">@mozilla.org/browser/global-history;2</a> +</p></div><div class="sect3" title="@mozilla.org/browser/global-history;2 - components/ignore-history.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2971802"></a><a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/c…" target="_top">@mozilla.org/browser/global-history;2</a> - <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/ignore-…" target="_top">components/ignore-history.js</a></h4></div></div></div><p>This component was contributed by <a class="ulink" href="http://www.collinjackson.com/" target="_top">Collin Jackson</a> as a method for defeating CSS and Javascript-based methods of history disclosure. The global-history component is what is used by Firefox to determine if a link was visited or not @@ -306,9 +306,9 @@ This component helps satisfy the <a class="link" href="#isolation">Network Isolation</a> and <a class="link" href="#setpreservation">Anonymity Set Preservation</a> requirements. -</p></div></div><div class="sect2" title="2.2. New Components"><div class="titlepage"><div><div><h3 class="title"><a id="id2682465"></a>2.2. New Components</h3></div></div></div><p>Torbutton creates four new components that are used throughout the +</p></div></div><div class="sect2" title="2.2. New Components"><div class="titlepage"><div><div><h3 class="title"><a id="id2974988"></a>2.2. New Components</h3></div></div></div><p>Torbutton creates four new components that are used throughout the extension. These components do not hook any interfaces, nor are they used -anywhere besides Torbutton itself.</p><div class="sect3" title="@torproject.org/cookie-jar-selector;2 - components/cookie-jar-selector.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2658495"></a><a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-…" target="_top">@torproject.org/cookie-jar-selector;2 +anywhere besides Torbutton itself.</p><div class="sect3" title="@torproject.org/cookie-jar-selector;2 - components/cookie-jar-selector.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2951018"></a><a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-…" target="_top">@torproject.org/cookie-jar-selector;2 - components/cookie-jar-selector.js</a></h4></div></div></div><p>The cookie jar selector (also based on code from <a class="ulink" href="http://www.collinjackson.com/" target="_top">Collin Jackson</a>) is used by the Torbutton chrome to switch between Tor and Non-Tor cookies. Its operations are simple: sync cookies to disk, then @@ -317,7 +317,7 @@ into place.</p><p> This component helps to address the <a class="link" href="#state">State Isolation</a> requirement of Torbutton. -</p></div><div class="sect3" title="@torproject.org/torbutton-logger;1 - components/torbutton-logger.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2683046"></a><a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/torbutt…" target="_top">@torproject.org/torbutton-logger;1 +</p></div><div class="sect3" title="@torproject.org/torbutton-logger;1 - components/torbutton-logger.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2975569"></a><a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/torbutt…" target="_top">@torproject.org/torbutton-logger;1 - components/torbutton-logger.js</a></h4></div></div></div><p>The torbutton logger component allows on-the-fly redirection of torbutton logging messages to either Firefox stderr (<span class="command"><strong>extensions.torbutton.logmethod=0</strong></span>), the Javascript error console @@ -369,7 +369,7 @@ </p><p> This helps to fulfill both the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> and the <a class="link" href="#undiscoverability">Tor Undiscoverability</a> requirements of -Torbutton.</p></div></div></div><div class="sect1" title="3. Chrome"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2684278"></a>3. Chrome</h2></div></div></div><p>The chrome is where all the torbutton graphical elements and windows are +Torbutton.</p></div></div></div><div class="sect1" title="3. Chrome"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2976801"></a>3. Chrome</h2></div></div></div><p>The chrome is where all the torbutton graphical elements and windows are located. Each window is described as an <a class="ulink" href="http://developer.mozilla.org/en/docs/XUL_Reference" target="_top">XML file</a>, with zero or more Javascript files attached. The scope of these Javascript files is their containing window.</p><div class="sect2" title="3.1. Browser Overlay - torbutton.xul"><div class="titlepage"><div><div><h3 class="title"><a id="browseroverlay"></a>3.1. Browser Overlay - <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/tor…" target="_top">torbutton.xul</a></h3></div></div></div><p>The browser overlay, torbutton.xul, defines the toolbar button, the status @@ -496,9 +496,9 @@ Avoidance</a> and <a class="link" href="#state">State Separation</a> requirements. - </p></li></ol></div></div><div class="sect2" title="3.2. Preferences Window - preferences.xul"><div class="titlepage"><div><div><h3 class="title"><a id="id2666921"></a>3.2. Preferences Window - <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/pre…" target="_top">preferences.xul</a></h3></div></div></div><p>The preferences window of course lays out the Torbutton preferences, with -handlers located in <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/pre…" target="_top">chrome/content/preferences.js</a>.</p></div><div class="sect2" title="3.3. Other Windows"><div class="titlepage"><div><div><h3 class="title"><a id="id2659528"></a>3.3. Other Windows</h3></div></div></div><p>There are additional windows that describe popups for right clicking on -the status bar, the toolbutton, and the about page.</p></div></div><div class="sect1" title="4. Toggle Code Path"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2650612"></a>4. Toggle Code Path</h2></div></div></div><p> + </p></li></ol></div></div><div class="sect2" title="3.2. Preferences Window - preferences.xul"><div class="titlepage"><div><div><h3 class="title"><a id="id2959444"></a>3.2. Preferences Window - <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/pre…" target="_top">preferences.xul</a></h3></div></div></div><p>The preferences window of course lays out the Torbutton preferences, with +handlers located in <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/pre…" target="_top">chrome/content/preferences.js</a>.</p></div><div class="sect2" title="3.3. Other Windows"><div class="titlepage"><div><div><h3 class="title"><a id="id2952051"></a>3.3. Other Windows</h3></div></div></div><p>There are additional windows that describe popups for right clicking on +the status bar, the toolbutton, and the about page.</p></div></div><div class="sect1" title="4. Toggle Code Path"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2943135"></a>4. Toggle Code Path</h2></div></div></div><p> The act of toggling is connected to <code class="function">torbutton_toggle()</code> via the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/tor…" target="_top">torbutton.xul</a> @@ -519,7 +519,7 @@ 409737</a> unfixed. The content policy does not allow any network activity whatsoever during this three stage transition. - </p><div class="sect2" title="4.1. Button Click"><div class="titlepage"><div><div><h3 class="title"><a id="id2681148"></a>4.1. Button Click</h3></div></div></div><p> + </p><div class="sect2" title="4.1. Button Click"><div class="titlepage"><div><div><h3 class="title"><a id="id2973670"></a>4.1. Button Click</h3></div></div></div><p> This is the first step in the toggling process. When the user clicks the toggle button or the toolbar, <code class="function">torbutton_toggle()</code> is @@ -532,7 +532,7 @@ <span class="command"><strong>torbutton_unique_pref_observer</strong></span> to perform the rest of the toggle. - </p></div><div class="sect2" title="4.2. Proxy Update"><div class="titlepage"><div><div><h3 class="title"><a id="id2683321"></a>4.2. Proxy Update</h3></div></div></div><p> + </p></div><div class="sect2" title="4.2. Proxy Update"><div class="titlepage"><div><div><h3 class="title"><a id="id2975844"></a>4.2. Proxy Update</h3></div></div></div><p> When Torbutton receives any proxy change notifications via its <span class="command"><strong>torbutton_unique_pref_observer</strong></span>, it calls @@ -547,7 +547,7 @@ observer so that other addons (such as SwitchProxy) can switch the proxy settings between multiple proxies. - </p></div><div class="sect2" title="4.3. Settings Update"><div class="titlepage"><div><div><h3 class="title"><a id="id2662007"></a>4.3. Settings Update</h3></div></div></div><p> + </p></div><div class="sect2" title="4.3. Settings Update"><div class="titlepage"><div><div><h3 class="title"><a id="id2954530"></a>4.3. Settings Update</h3></div></div></div><p> The next stage is also handled by <code class="function">torbutton_update_status()</code>. This function sets scores of @@ -558,10 +558,10 @@ <span class="command"><strong>extensions.torbutton.settings_applied</strong></span>, which signifies the completion of the toggle operation to the <a class="link" href="#contentpolicy" title="@torproject.org/cssblocker;1 - components/cssblocker.js">content policy</a>. - </p></div></div><div class="sect1" title="5. Description of Options"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2679416"></a>5. Description of Options</h2></div></div></div><p>This section provides a detailed description of Torbutton's options. Each + </p></div></div><div class="sect1" title="5. Description of Options"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2971938"></a>5. Description of Options</h2></div></div></div><p>This section provides a detailed description of Torbutton's options. Each option is presented as the string from the preferences window, a summary, the preferences it touches, and the effect this has on the components, chrome, and -browser properties.</p><div class="sect2" title="5.1. Test Settings"><div class="titlepage"><div><div><h3 class="title"><a id="id2674592"></a>5.1. Test Settings</h3></div></div></div><p> +browser properties.</p><div class="sect2" title="5.1. Test Settings"><div class="titlepage"><div><div><h3 class="title"><a id="id2967115"></a>5.1. Test Settings</h3></div></div></div><p> This button under the Proxy Settings tab provides a way to verify that the proxy settings are correct, and actually do route through the Tor network. It performs this check by issuing an <a class="ulink" href="http://developer.mozilla.org/en/docs/XMLHttpRequest" target="_top">XMLHTTPRequest</a> @@ -620,7 +620,7 @@ Since most plugins completely ignore browser proxy settings, the actions performed by this setting are crucial to satisfying the <a class="link" href="#proxy">Proxy Obedience</a> requirement. - </p></div><div class="sect2" title="5.3. Isolate Dynamic Content to Tor State (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2658766"></a>5.3. Isolate Dynamic Content to Tor State (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.isolate_content</strong></span></p><p>Enabling this preference is what enables the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cssbloc…" target="_top">@torproject.org/cssblocker;1</a> content policy + </p></div><div class="sect2" title="5.3. Isolate Dynamic Content to Tor State (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2951289"></a>5.3. Isolate Dynamic Content to Tor State (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.isolate_content</strong></span></p><p>Enabling this preference is what enables the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cssbloc…" target="_top">@torproject.org/cssblocker;1</a> content policy mentioned above, and causes it to block content load attempts in pages an opposite Tor state from the current state. Freshly loaded <a class="ulink" href="https://developer.mozilla.org/en/XUL/tabbrowser" target="_top">browser tabs</a> are tagged @@ -672,7 +672,7 @@ -</p></div><div class="sect2" title="5.5. Resize windows to multiples of 50px during Tor usage (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2668126"></a>5.5. Resize windows to multiples of 50px during Tor usage (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.resize_windows</strong></span></p><p> +</p></div><div class="sect2" title="5.5. Resize windows to multiples of 50px during Tor usage (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2960649"></a>5.5. Resize windows to multiples of 50px during Tor usage (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.resize_windows</strong></span></p><p> This option drastically cuts down on the number of distinct anonymity sets that divide the Tor web userbase. Without this setting, the dimensions for a @@ -707,7 +707,7 @@ </p><p> This setting helps to meet the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> requirements. -</p></div><div class="sect2" title="5.6. Disable Updates During Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2660426"></a>5.6. Disable Updates During Tor</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_updates</strong></span></p><p>This setting causes Torbutton to disable the four <a class="ulink" href="http://wiki.mozilla.org/Update:Users/Checking_For_Updates#Preference_Contro…" target="_top">Firefox +</p></div><div class="sect2" title="5.6. Disable Updates During Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2952949"></a>5.6. Disable Updates During Tor</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_updates</strong></span></p><p>This setting causes Torbutton to disable the four <a class="ulink" href="http://wiki.mozilla.org/Update:Users/Checking_For_Updates#Preference_Contro…" target="_top">Firefox update settings</a> during Tor usage: <span class="command"><strong>extensions.update.enabled</strong></span>, <span class="command"><strong>app.update.enabled</strong></span>, @@ -717,7 +717,7 @@ checking for search plugin updates while Tor is enabled. </p><p> This setting satisfies the <a class="link" href="#updates">Update Safety</a> requirement. -</p></div><div class="sect2" title="5.7. Redirect Torbutton Updates Via Tor (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2644084"></a>5.7. Redirect Torbutton Updates Via Tor (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.update_torbutton_via_tor</strong></span></p><p>This setting causes Torbutton to install an +</p></div><div class="sect2" title="5.7. Redirect Torbutton Updates Via Tor (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2936606"></a>5.7. Redirect Torbutton Updates Via Tor (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.update_torbutton_via_tor</strong></span></p><p>This setting causes Torbutton to install an <a class="ulink" href="https://developer.mozilla.org/en/nsIProtocolProxyFilter" target="_top">nsIProtocolProxyFilter</a> in order to redirect all version update checks and Torbutton update downloads @@ -726,7 +726,7 @@ help censored users meet the <a class="link" href="#undiscoverability">Tor Undiscoverability</a> requirement. - </p></div><div class="sect2" title="5.8. Disable Search Suggestions during Tor (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2644128"></a>5.8. Disable Search Suggestions during Tor (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_search</strong></span></p><p> + </p></div><div class="sect2" title="5.8. Disable Search Suggestions during Tor (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2936650"></a>5.8. Disable Search Suggestions during Tor (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_search</strong></span></p><p> This setting causes Torbutton to disable <a class="ulink" href="http://kb.mozillazine.org/Browser.search.suggest.enabled" target="_top"><span class="command"><strong>browser.search.suggest.enabled</strong></span></a> during Tor usage. This governs if you get Google search suggestions during Tor @@ -737,7 +737,7 @@ While this setting doesn't satisfy any Torbutton requirements, the fact that cookies are transmitted for partially typed queries does not seem desirable for Tor usage. -</p></div><div class="sect2" title="5.9. Disable livemarks updates during Tor usage (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2644167"></a>5.9. Disable livemarks updates during Tor usage (recommended)</h3></div></div></div><p>Option: +</p></div><div class="sect2" title="5.9. Disable livemarks updates during Tor usage (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2936689"></a>5.9. Disable livemarks updates during Tor usage (recommended)</h3></div></div></div><p>Option: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.disable_livemarks</strong></span></td></tr></table><p> </p><p> This option causes Torbutton to prevent Firefox from loading <a class="ulink" href="http://www.mozilla.com/firefox/livebookmarks.html" target="_top">Livemarks</a> during @@ -751,7 +751,7 @@ This helps satisfy the <a class="link" href="#isolation">Network Isolation</a> and <a class="link" href="#setpreservation">Anonymity Set Preservation</a> requirements. -</p></div><div class="sect2" title="5.10. Block Tor/Non-Tor access to network from file:// urls (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2644238"></a>5.10. Block Tor/Non-Tor access to network from file:// urls (recommended)</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.10. Block Tor/Non-Tor access to network from file:// urls (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2936761"></a>5.10. Block Tor/Non-Tor access to network from file:// urls (recommended)</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.block_tor_file_net</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_nontor_file_net</strong></span></td></tr></table><p> </p><p> @@ -771,7 +771,7 @@ operations in opposite Tor states. Also, allowing pages to submit arbitrary files to arbitrary sites just generally seems like a bad idea. -</p></div><div class="sect2" title="5.11. Close all Tor/Non-Tor tabs and windows on toggle (optional)"><div class="titlepage"><div><div><h3 class="title"><a id="id2644310"></a>5.11. Close all Tor/Non-Tor tabs and windows on toggle (optional)</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.11. Close all Tor/Non-Tor tabs and windows on toggle (optional)"><div class="titlepage"><div><div><h3 class="title"><a id="id2936833"></a>5.11. Close all Tor/Non-Tor tabs and windows on toggle (optional)</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.close_nontor</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.close_tor</strong></span></td></tr></table><p> </p><p> @@ -795,7 +795,7 @@ While this setting doesn't satisfy any Torbutton requirements, the fact that cookies are transmitted for partially typed queries does not seem desirable for Tor usage. -</p></div><div class="sect2" title="5.12. Isolate Access to History navigation to Tor state (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2644391"></a>5.12. Isolate Access to History navigation to Tor state (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.block_js_history</strong></span></p><p> +</p></div><div class="sect2" title="5.12. Isolate Access to History navigation to Tor state (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2936914"></a>5.12. Isolate Access to History navigation to Tor state (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.block_js_history</strong></span></p><p> This setting determines if Torbutton installs an <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsISHistoryListen…" target="_top">nsISHistoryListener</a> attached to the <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsISHistory" target="_top">sessionHistory</a> of of each browser's <a class="ulink" href="https://developer.mozilla.org/en/XUL%3aProperty%3awebNavigation" target="_top">webNavigatator</a>. @@ -823,7 +823,7 @@ Separation</a> and (until Bug 409737 is fixed) <a class="link" href="#isolation">Network Isolation</a> requirements. - </p></div><div class="sect2" title="5.13. History Access Settings"><div class="titlepage"><div><div><h3 class="title"><a id="id2644476"></a>5.13. History Access Settings</h3></div></div></div><p>Options: + </p></div><div class="sect2" title="5.13. History Access Settings"><div class="titlepage"><div><div><h3 class="title"><a id="id2936998"></a>5.13. History Access Settings</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.block_thread</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_nthread</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_thwrite</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_nthwrite</strong></span></td></tr></table><p> </p><p>These four settings govern the behavior of the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/ignore-…" target="_top">components/ignore-history.js</a> history blocker component mentioned above. By hooking the browser's view of @@ -838,12 +838,12 @@ </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements. -</p></div><div class="sect2" title="5.14. Clear History During Tor Toggle (optional)"><div class="titlepage"><div><div><h3 class="title"><a id="id2644588"></a>5.14. Clear History During Tor Toggle (optional)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_history</strong></span></p><p>This setting governs if Torbutton calls +</p></div><div class="sect2" title="5.14. Clear History During Tor Toggle (optional)"><div class="titlepage"><div><div><h3 class="title"><a id="id2937111"></a>5.14. Clear History During Tor Toggle (optional)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_history</strong></span></p><p>This setting governs if Torbutton calls <a class="ulink" href="https://developer.mozilla.org/en/nsIBrowserHistory#removeAllPages.28.29" target="_top">nsIBrowserHistory.removeAllPages</a> and <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsISHistory" target="_top">nsISHistory.PurgeHistory</a> for each tab on Tor toggle.</p><p> This setting is an optional way to help satisfy the <a class="link" href="#state">State Separation</a> requirement. -</p></div><div class="sect2" title="5.15. Block Password+Form saving during Tor/Non-Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2686134"></a>5.15. Block Password+Form saving during Tor/Non-Tor</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.15. Block Password+Form saving during Tor/Non-Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2978657"></a>5.15. Block Password+Form saving during Tor/Non-Tor</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.block_tforms</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_ntforms</strong></span></td></tr></table><p> </p><p>These settings govern if Torbutton disables <span class="command"><strong>browser.formfill.enable</strong></span> @@ -852,19 +852,19 @@ more important than it seems. </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements. -</p></div><div class="sect2" title="5.16. Block Tor disk cache and clear all cache on Tor Toggle"><div class="titlepage"><div><div><h3 class="title"><a id="id2686195"></a>5.16. Block Tor disk cache and clear all cache on Tor Toggle</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_cache</strong></span> +</p></div><div class="sect2" title="5.16. Block Tor disk cache and clear all cache on Tor Toggle"><div class="titlepage"><div><div><h3 class="title"><a id="id2978718"></a>5.16. Block Tor disk cache and clear all cache on Tor Toggle</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_cache</strong></span> </p><p>This option causes Torbutton to call <a class="ulink" href="https://developer.mozilla.org/en/nsICacheService#evictEntries.28.29" target="_top">nsICacheService.evictEntries(0)</a> on Tor toggle to remove all entries from the cache. In addition, this setting causes Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Browser.cache.disk.enable" target="_top">browser.cache.disk.enable</a> to false. </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements. -</p></div><div class="sect2" title="5.17. Block disk and memory cache during Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2686245"></a>5.17. Block disk and memory cache during Tor</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.block_cache</strong></span></p><p>This setting +</p></div><div class="sect2" title="5.17. Block disk and memory cache during Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2978768"></a>5.17. Block disk and memory cache during Tor</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.block_cache</strong></span></p><p>This setting causes Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Browser.cache.memory.enable" target="_top">browser.cache.memory.enable</a>, <a class="ulink" href="http://kb.mozillazine.org/Browser.cache.disk.enable" target="_top">browser.cache.disk.enable</a> and <a class="ulink" href="http://kb.mozillazine.org/Network.http.use-cache" target="_top">network.http.use-cache</a> to false during tor usage. </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements. -</p></div><div class="sect2" title="5.18. Clear Cookies on Tor Toggle"><div class="titlepage"><div><div><h3 class="title"><a id="id2686298"></a>5.18. Clear Cookies on Tor Toggle</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_cookies</strong></span> +</p></div><div class="sect2" title="5.18. Clear Cookies on Tor Toggle"><div class="titlepage"><div><div><h3 class="title"><a id="id2978820"></a>5.18. Clear Cookies on Tor Toggle</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_cookies</strong></span> </p><p> This setting causes Torbutton to call <a class="ulink" href="https://developer.mozilla.org/en/nsICookieManager#removeAll.28.29" target="_top">nsICookieManager.removeAll()</a> on @@ -874,7 +874,7 @@ </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements. -</p></div><div class="sect2" title="5.19. Store Non-Tor cookies in a protected jar"><div class="titlepage"><div><div><h3 class="title"><a id="id2686349"></a>5.19. Store Non-Tor cookies in a protected jar</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.cookie_jars</strong></span> +</p></div><div class="sect2" title="5.19. Store Non-Tor cookies in a protected jar"><div class="titlepage"><div><div><h3 class="title"><a id="id2978871"></a>5.19. Store Non-Tor cookies in a protected jar</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.cookie_jars</strong></span> </p><p> This setting causes Torbutton to use <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-…" target="_top">@torproject.org/cookie-jar-selector;2</a> to store @@ -887,15 +887,15 @@ </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements. -</p></div><div class="sect2" title="5.20. Store both Non-Tor and Tor cookies in a protected jar (dangerous)"><div class="titlepage"><div><div><h3 class="title"><a id="id2686405"></a>5.20. Store both Non-Tor and Tor cookies in a protected jar (dangerous)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.dual_cookie_jars</strong></span> +</p></div><div class="sect2" title="5.20. Store both Non-Tor and Tor cookies in a protected jar (dangerous)"><div class="titlepage"><div><div><h3 class="title"><a id="id2978928"></a>5.20. Store both Non-Tor and Tor cookies in a protected jar (dangerous)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.dual_cookie_jars</strong></span> </p><p> This setting causes Torbutton to use <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-…" target="_top">@torproject.org/cookie-jar-selector;2</a> to store both Tor and Non-Tor cookies into protected jars. </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement. -</p></div><div class="sect2" title="5.21. Manage My Own Cookies (dangerous)"><div class="titlepage"><div><div><h3 class="title"><a id="id2686444"></a>5.21. Manage My Own Cookies (dangerous)</h3></div></div></div><p>Options: None</p><p>This setting disables all Torbutton cookie handling by setting the above -cookie prefs all to false.</p></div><div class="sect2" title="5.22. Disable DOM Storage during Tor usage (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2686459"></a>5.22. Disable DOM Storage during Tor usage (crucial)</h3></div></div></div><div class="sect2" title="5.22.1. Do not write Tor/Non-Tor cookies to disk"><div class="titlepage"><div><div><h3 class="title"><a id="id2686461"></a>5.22.1. Do not write Tor/Non-Tor cookies to disk</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.21. Manage My Own Cookies (dangerous)"><div class="titlepage"><div><div><h3 class="title"><a id="id2978967"></a>5.21. Manage My Own Cookies (dangerous)</h3></div></div></div><p>Options: None</p><p>This setting disables all Torbutton cookie handling by setting the above +cookie prefs all to false.</p></div><div class="sect2" title="5.22. Disable DOM Storage during Tor usage (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2978982"></a>5.22. Disable DOM Storage during Tor usage (crucial)</h3></div></div></div><div class="sect2" title="5.22.1. Do not write Tor/Non-Tor cookies to disk"><div class="titlepage"><div><div><h3 class="title"><a id="id2978984"></a>5.22.1. Do not write Tor/Non-Tor cookies to disk</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.tor_memory_jar</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.nontor_memory_jar</strong></span></td></tr></table><p> </p><p> These settings (contributed by arno) cause Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Network.cookie.lifetimePolicy" target="_top">network.cookie.lifetimePolicy</a> @@ -915,13 +915,13 @@ <a class="ulink" href="http://developer.mozilla.org/en/docs/DOM:Storage" target="_top">DOM Storage</a> from being used to store persistent information across Tor states.</p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement. -</p></div><div class="sect2" title="5.23. Clear HTTP Auth on Tor Toggle (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2686563"></a>5.23. Clear HTTP Auth on Tor Toggle (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_http_auth</strong></span> +</p></div><div class="sect2" title="5.23. Clear HTTP Auth on Tor Toggle (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2979086"></a>5.23. Clear HTTP Auth on Tor Toggle (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_http_auth</strong></span> </p><p> This setting causes Torbutton to call <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsIHttpAuthManager" target="_top">nsIHttpAuthManager.clearAll()</a> every time Tor is toggled. </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement. -</p></div><div class="sect2" title="5.24. Clear cookies on Tor/Non-Tor shutdown"><div class="titlepage"><div><div><h3 class="title"><a id="id2686600"></a>5.24. Clear cookies on Tor/Non-Tor shutdown</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.shutdown_method</strong></span> +</p></div><div class="sect2" title="5.24. Clear cookies on Tor/Non-Tor shutdown"><div class="titlepage"><div><div><h3 class="title"><a id="id2979123"></a>5.24. Clear cookies on Tor/Non-Tor shutdown</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.shutdown_method</strong></span> </p><p> This option variable can actually take 3 values: 0, 1, and 2. 0 means no cookie clearing, 1 means clear only during Tor-enabled shutdown, and 2 means clear for both Tor and Non-Tor shutdown. When set to 1 or 2, Torbutton listens @@ -929,7 +929,7 @@ <code class="function">https://git.torproject.org/checkout/torbutton/master/src/components/crash-o…</code> and use <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-…" target="_top">@torproject.org/cookie-jar-selector;2</a> to clear out all cookies and all cookie jars upon shutdown. </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement. -</p></div><div class="sect2" title="5.25. Reload cookie jar/clear cookies on Firefox crash"><div class="titlepage"><div><div><h3 class="title"><a id="id2686655"></a>5.25. Reload cookie jar/clear cookies on Firefox crash</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.25. Reload cookie jar/clear cookies on Firefox crash"><div class="titlepage"><div><div><h3 class="title"><a id="id2979178"></a>5.25. Reload cookie jar/clear cookies on Firefox crash</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.reload_crashed_jar</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.crashed</strong></span></td></tr></table><p> </p><p>This is no longer a user visible option, and is enabled by default. In the event of a crash, the Torbutton <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/crash-o…" target="_top">components/crash-observer.js</a> @@ -941,7 +941,7 @@ component.</p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement in the event of Firefox crashes. -</p></div><div class="sect2" title="5.26. On crash recovery or session restored startup, restore via: Tor, Non-Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2686731"></a>5.26. On crash recovery or session restored startup, restore via: Tor, Non-Tor</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.26. On crash recovery or session restored startup, restore via: Tor, Non-Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2979253"></a>5.26. On crash recovery or session restored startup, restore via: Tor, Non-Tor</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.restore_tor</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.crashed</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.normal_exit</strong></span></td></tr></table><p> </p><p>This option works with the Torbutton <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/crash-o…" target="_top">crash-observer.js</a> to set the Tor state after a crash is detected (via the @@ -957,7 +957,7 @@ requirement in the event of Firefox crashes by ensuring all cookies, settings and saved sessions are reloaded from a fixed Tor state. -</p></div><div class="sect2" title="5.27. On normal startup, set state to: Tor, Non-Tor, Shutdown State"><div class="titlepage"><div><div><h3 class="title"><a id="id2686802"></a>5.27. On normal startup, set state to: Tor, Non-Tor, Shutdown State</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.27. On normal startup, set state to: Tor, Non-Tor, Shutdown State"><div class="titlepage"><div><div><h3 class="title"><a id="id2979325"></a>5.27. On normal startup, set state to: Tor, Non-Tor, Shutdown State</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.startup_state</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.noncrashed</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.normal_exit</strong></span></td></tr></table><p> </p><p>This option also works with the Torbutton <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/crash-o…" target="_top">crash-observer.js</a> to set the Tor state after a normal startup is detected (via the @@ -967,7 +967,7 @@ extensions.torbutton.normal_exit in torbutton_uninstall_observer() during Firefox exit and checks this value as well during startup. -</p></div><div class="sect2" title="5.28. Prevent session store from saving Non-Tor/Tor-loaded tabs"><div class="titlepage"><div><div><h3 class="title"><a id="id2686861"></a>5.28. Prevent session store from saving Non-Tor/Tor-loaded tabs</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.28. Prevent session store from saving Non-Tor/Tor-loaded tabs"><div class="titlepage"><div><div><h3 class="title"><a id="id2979384"></a>5.28. Prevent session store from saving Non-Tor/Tor-loaded tabs</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.nonontor_sessionstore</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.notor_sessionstore</strong></span></td></tr></table><p> </p><p>If these options are enabled, the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/nsSessi…" target="_top">replacement nsSessionStore.js</a> component checks the <span class="command"><strong>__tb_tor_fetched</strong></span> tag of tabs before writing them @@ -977,7 +977,7 @@ requirement, and also helps to satisfy the <a class="link" href="#state">State Separation</a> requirement in the event of Firefox crashes. -</p></div><div class="sect2" title="5.29. Set user agent during Tor usage (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2686926"></a>5.29. Set user agent during Tor usage (crucial)</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.29. Set user agent during Tor usage (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2979449"></a>5.29. Set user agent during Tor usage (crucial)</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.set_uagent</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.platform_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.oscpu_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.buildID_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.productsub_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.appname_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.appversion_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.useragent_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.useragent_vendor</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.useragent_vendorSub</strong></span></td></tr></table><p> </p><p>On face, user agent switching appears to be straight-forward in Firefox. It provides several options for controlling the browser user agent string: @@ -1001,7 +1001,7 @@ </p><p> This setting helps to satisfy the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> requirement. -</p></div><div class="sect2" title="5.30. Spoof US English Browser"><div class="titlepage"><div><div><h3 class="title"><a id="id2687100"></a>5.30. Spoof US English Browser</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.30. Spoof US English Browser"><div class="titlepage"><div><div><h3 class="title"><a id="id2979623"></a>5.30. Spoof US English Browser</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.spoof_english</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.spoof_charset</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.spoof_language</strong></span></td></tr></table><p> </p><p> This option causes Torbutton to set <span class="command"><strong>general.useragent.locale</strong></span> @@ -1012,13 +1012,13 @@ well as hooking <span class="command"><strong>navigator.language</strong></span> via its <a class="link" href="#jshooks" title="5.4. Hook Dangerous Javascript">javascript hooks</a>. </p><p> This setting helps to satisfy the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> and <a class="link" href="#location">Location Neutrality</a> requirements. -</p></div><div class="sect2" title="5.31. Don't send referrer during Tor Usage"><div class="titlepage"><div><div><h3 class="title"><a id="id2687193"></a>5.31. Don't send referrer during Tor Usage</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.disable_referer</strong></span> +</p></div><div class="sect2" title="5.31. Don't send referrer during Tor Usage"><div class="titlepage"><div><div><h3 class="title"><a id="id2979716"></a>5.31. Don't send referrer during Tor Usage</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.disable_referer</strong></span> </p><p> This option causes Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Network.http.sendSecureXSiteReferrer" target="_top">network.http.sendSecureXSiteReferrer</a> and <a class="ulink" href="http://kb.mozillazine.org/Network.http.sendRefererHeader" target="_top">network.http.sendRefererHeader</a> during Tor usage.</p><p> This setting also does not directly satisfy any Torbutton requirement, but some may desire to mask their referrer for general privacy concerns. -</p></div><div class="sect2" title="5.32. Strip platform and language off of Google Search Box queries"><div class="titlepage"><div><div><h3 class="title"><a id="id2687234"></a>5.32. Strip platform and language off of Google Search Box queries</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.fix_google_srch</strong></span> +</p></div><div class="sect2" title="5.32. Strip platform and language off of Google Search Box queries"><div class="titlepage"><div><div><h3 class="title"><a id="id2979756"></a>5.32. Strip platform and language off of Google Search Box queries</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.fix_google_srch</strong></span> </p><p> This option causes Torbutton to use the <a class="ulink" href="https://wiki.mozilla.org/Search_Service:API" target="_top">@mozilla.org/browser/search-service;1</a> @@ -1028,7 +1028,7 @@ </p><p> This setting helps Torbutton to fulfill its <a class="link" href="#setpreservation">Anonymity Set Preservation</a> requirement. -</p></div><div class="sect2" title="5.33. Automatically use an alternate search engine when presented with a Google Captcha"><div class="titlepage"><div><div><h3 class="title"><a id="id2687274"></a>5.33. Automatically use an alternate search engine when presented with a +</p></div><div class="sect2" title="5.33. Automatically use an alternate search engine when presented with a Google Captcha"><div class="titlepage"><div><div><h3 class="title"><a id="id2979797"></a>5.33. Automatically use an alternate search engine when presented with a Google Captcha</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.asked_google_captcha</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.dodge_google_captcha</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.google_redir_url</strong></span></td></tr></table><p> </p><p> @@ -1053,7 +1053,7 @@ encoded in the preferences <span class="command"><strong>extensions.torbutton.redir_url.[1-5]</strong></span>. -</p></div><div class="sect2" title="5.34. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2687355"></a>5.34. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.34. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2979878"></a>5.34. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.jar_certs</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.jar_ca_certs</strong></span></td></tr></table><p> </p><p> @@ -1132,7 +1132,24 @@ isolation is considered a <a class="link" href="#state">State Separation</a> feature. - </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=575230" target="_top">Bug 575230 - Provide option to + </p></li><li class="listitem">Give more visibility into and control over TLS +negotiation + <p> + +There are several <a class="ulink" href="https://trac.torproject.org/projects/tor/ticket/2482" target="_top">TLS issues +impacting Torbutton security</a>. It is not clear if these should be one +Firefox bug or several, but in particular we need better control over various +aspects of TLS connections. Firefox currently provides no observer capable of +extracting TLS parameters or certificates early enough to cancel a TLS +request. We would like to be able to provide <a class="ulink" href="https://www.eff.org/https-everywhere" target="_top">HTTPS-Everywhere</a> users with +the ability to <a class="ulink" href="https://trac.torproject.org/projects/tor/wiki/HTTPSEverywhere/SSLObservator…" target="_top">have +their certificates audited</a> by a <a class="ulink" href="http://www.networknotary.org/" target="_top">Perspectives</a>-style set of +notaries. The problem with this is that the API observer points do not exist +for any Firefox addon to actually block authentication token submission over a +TLS channel, so every addon to date (including Perspectives) is actually +providing users with notification *after* their authentication tokens have +already been compromised. This obviously needs to be fixed. + </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=575230" target="_top">Bug 575230 - Provide option to reduce precision of Date()</a><p> Currently it is possible to <a class="ulink" href="http://arstechnica.com/tech-policy/news/2010/02/firm-uses-typing-cadence-to…" target="_top">fingerprint @@ -1404,13 +1421,13 @@ with a bit of work. </p></li></ol></div><p> - </p></div><div class="sect2" title="7.2. Multi-state testing"><div class="titlepage"><div><div><h3 class="title"><a id="id2688437"></a>7.2. Multi-state testing</h3></div></div></div><p> + </p></div><div class="sect2" title="7.2. Multi-state testing"><div class="titlepage"><div><div><h3 class="title"><a id="id2980994"></a>7.2. Multi-state testing</h3></div></div></div><p> The tests in this section are geared towards a page that would instruct the user to toggle their Tor state after the fetch and perform some operations: mouseovers, stray clicks, and potentially reloads. - </p><div class="sect3" title="Cookies and Cache Correlation"><div class="titlepage"><div><div><h4 class="title"><a id="id2688449"></a>Cookies and Cache Correlation</h4></div></div></div><p> + </p><div class="sect3" title="Cookies and Cache Correlation"><div class="titlepage"><div><div><h4 class="title"><a id="id2981006"></a>Cookies and Cache Correlation</h4></div></div></div><p> The most obvious test is to set a cookie, ask the user to toggle tor, and then have them reload the page. The cookie should no longer be set if they are using the default Torbutton settings. In addition, it is possible to leverage @@ -1418,11 +1435,11 @@ identifiers</a>. The default settings of Torbutton should also protect against these from persisting across Tor Toggle. - </p></div><div class="sect3" title="Javascript timers and event handlers"><div class="titlepage"><div><div><h4 class="title"><a id="id2688472"></a>Javascript timers and event handlers</h4></div></div></div><p> + </p></div><div class="sect3" title="Javascript timers and event handlers"><div class="titlepage"><div><div><h4 class="title"><a id="id2981029"></a>Javascript timers and event handlers</h4></div></div></div><p> Javascript can set timers and register event handlers in the hopes of fetching URLs after the user has toggled Torbutton. - </p></div><div class="sect3" title="CSS Popups and non-script Dynamic Content"><div class="titlepage"><div><div><h4 class="title"><a id="id2688484"></a>CSS Popups and non-script Dynamic Content</h4></div></div></div><p> + </p></div><div class="sect3" title="CSS Popups and non-script Dynamic Content"><div class="titlepage"><div><div><h4 class="title"><a id="id2981042"></a>CSS Popups and non-script Dynamic Content</h4></div></div></div><p> Even if Javascript is disabled, CSS is still able to <a class="ulink" href="http://www.tjkdesign.com/articles/css%20pop%20ups/" target="_top">create popup-like @@ -1447,7 +1464,7 @@ submitting the test cases back to be run in the standard batch of Torbutton tests. - </p><div class="sect3" title="Some suggested vectors to investigate"><div class="titlepage"><div><div><h4 class="title"><a id="id2688539"></a>Some suggested vectors to investigate</h4></div></div></div><p> + </p><div class="sect3" title="Some suggested vectors to investigate"><div class="titlepage"><div><div><h4 class="title"><a id="id2981097"></a>Some suggested vectors to investigate</h4></div></div></div><p> </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">Strange ways to register Javascript <a class="ulink" href="http://en.wikipedia.org/wiki/DOM_Events" target="_top">events</a> and <a class="ulink" href="http://www.devshed.com/c/a/JavaScript/Using-Timers-in-JavaScript/" target="_top">timeouts</a> should be verified to actually be ineffective after Tor has been toggled.</li><li class="listitem">Other ways to cause Javascript to be executed after <span class="command"><strong>javascript.enabled</strong></span> has been toggled off.</li><li class="listitem">Odd ways to attempt to load plugins. Kyle Williams has had

1 0

[torbutton/master] Update compiled html.
by mikeperry＠torproject.org 26 Mar '11

26 Mar '11

commit 86a4285c12a2961c095c01a091e3da4eb6860873 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Fri Mar 25 17:17:07 2011 -0700 Update compiled html. --- website/design/index.html.en | 127 ++++++++++++++++++++++++------------------ 1 files changed, 72 insertions(+), 55 deletions(-) diff --git a/website/design/index.html.en b/website/design/index.html.en index 6bf094b..d8866c6 100644 --- a/website/design/index.html.en +++ b/website/design/index.html.en @@ -1,7 +1,7 @@ <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> -<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Torbutton Design Documentation</title><meta name="generator" content="DocBook XSL Stylesheets V1.75.2" /></head><body><div class="article" title="Torbutton Design Documentation"><div class="titlepage"><div><div><h2 class="title"><a id="design"></a>Torbutton Design Documentation</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Mike</span> <span class="surname">Perry</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:mikeperry.fscked/org">mikeperry.fscked/org</a>></code></p></div></div></div></div><div><p class="pubdate">Mar 25 2011</p></div></div><hr /></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="#id2647809">1. Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="#adversary">1.1. Adversary Model</a> </span></dt><dt><span class="sect2"><a href="#requirements">1.2. Torbutton Requirements</a></span></dt><dt><span class="sect2"><a href="#layout">1.3. Extension Layout</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2662790">2. Components</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2680078">2.1. Hooked Components</a></span></dt><dt><span class="sect2"><a href="#id2682465">2.2. New Components</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2684278">3. Chrome</a></span></dt><dd><dl><dt><span class="sect2"><a href="#browseroverlay">3.1. Browser Overlay - torbutton.xul</a></span></dt><dt><span class="sect2"><a href="#id2666921">3.2. Preferences Window - preferences.xul</a></span></dt><dt><span class="sect2"><a href="#id2659528">3.3. Other Windows</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2650612">4. Toggle Code Path</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2681148">4.1. Button Click</a></span></dt><dt>< span class="sect2"><a href="#id2683321">4.2. Proxy Update</a></span></dt><dt><span class="sect2"><a href="#id2662007">4.3. Settings Update</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2679416">5. Description of Options</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2674592">5.1. Test Settings</a></span></dt><dt><span class="sect2"><a href="#plugins">5.2. Disable plugins on Tor Usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2658766">5.3. Isolate Dynamic Content to Tor State (crucial)</a></span></dt><dt><span class="sect2"><a href="#jshooks">5.4. Hook Dangerous Javascript</a></span></dt><dt><span class="sect2"><a href="#id2668126">5.5. Resize windows to multiples of 50px during Tor usage (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2660426">5.6. Disable Updates During Tor</a></span></dt><dt><span class="sect2"><a href="#id2644084">5.7. Redirect Torbutton Updates Via Tor (recommended)</a></span></dt><dt><span c lass="sect2"><a href="#id2644128">5.8. Disable Search Suggestions during Tor (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2644167">5.9. Disable livemarks updates during Tor usage (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2644238">5.10. Block Tor/Non-Tor access to network from file:// urls (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2644310">5.11. Close all Tor/Non-Tor tabs and windows on toggle (optional)</a></span></dt><dt><span class="sect2"><a href="#id2644391">5.12. Isolate Access to History navigation to Tor state (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2644476">5.13. History Access Settings</a></span></dt><dt><span class="sect2"><a href="#id2644588">5.14. Clear History During Tor Toggle (optional)</a></span></dt><dt><span class="sect2"><a href="#id2686134">5.15. Block Password+Form saving during Tor/Non-Tor</a></span></dt><dt><span class="sect2"><a href="#id2686195">5.16. Block Tor dis k cache and clear all cache on Tor Toggle</a></span></dt><dt><span class="sect2"><a href="#id2686245">5.17. Block disk and memory cache during Tor</a></span></dt><dt><span class="sect2"><a href="#id2686298">5.18. Clear Cookies on Tor Toggle</a></span></dt><dt><span class="sect2"><a href="#id2686349">5.19. Store Non-Tor cookies in a protected jar</a></span></dt><dt><span class="sect2"><a href="#id2686405">5.20. Store both Non-Tor and Tor cookies in a protected jar (dangerous)</a></span></dt><dt><span class="sect2"><a href="#id2686444">5.21. Manage My Own Cookies (dangerous)</a></span></dt><dt><span class="sect2"><a href="#id2686459">5.22. Disable DOM Storage during Tor usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2686563">5.23. Clear HTTP Auth on Tor Toggle (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2686600">5.24. Clear cookies on Tor/Non-Tor shutdown</a></span></dt><dt><span class="sect2"><a href="#id2686655">5.25. Reload cookie ja r/clear cookies on Firefox crash</a></span></dt><dt><span class="sect2"><a href="#id2686731">5.26. On crash recovery or session restored startup, restore via: Tor, Non-Tor</a></span></dt><dt><span class="sect2"><a href="#id2686802">5.27. On normal startup, set state to: Tor, Non-Tor, Shutdown State</a></span></dt><dt><span class="sect2"><a href="#id2686861">5.28. Prevent session store from saving Non-Tor/Tor-loaded tabs</a></span></dt><dt><span class="sect2"><a href="#id2686926">5.29. Set user agent during Tor usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2687100">5.30. Spoof US English Browser</a></span></dt><dt><span class="sect2"><a href="#id2687193">5.31. Don't send referrer during Tor Usage</a></span></dt><dt><span class="sect2"><a href="#id2687234">5.32. Strip platform and language off of Google Search Box queries</a></span></dt><dt><span class="sect2"><a href="#id2687274">5.33. Automatically use an alternate search engine when presented with a -Google Captcha</a></span></dt><dt><span class="sect2"><a href="#id2687355">5.34. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)</a></span></dt></dl></dd><dt><span class="sect1"><a href="#FirefoxBugs">6. Relevant Firefox Bugs</a></span></dt><dd><dl><dt><span class="sect2"><a href="#FirefoxSecurity">6.1. Bugs impacting security</a></span></dt><dt><span class="sect2"><a href="#FirefoxWishlist">6.2. Bugs blocking functionality</a></span></dt><dt><span class="sect2"><a href="#FirefoxMiscBugs">6.3. Low Priority Bugs</a></span></dt></dl></dd><dt><span class="sect1"><a href="#TestPlan">7. Testing</a></span></dt><dd><dl><dt><span class="sect2"><a href="#SingleStateTesting">7.1. Single state testing</a></span></dt><dt><span class="sect2"><a href="#id2688437">7.2. Multi-state testing</a></span></dt><dt><span class="sect2"><a href="#HackTorbutton">7.3. Active testing (aka How to Hack Torbutton)</a></span></dt></dl></dd></dl></div><div class="sect1" title="1. Introduc tion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2647809"></a>1. Introduction</h2></div></div></div><p> +<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Torbutton Design Documentation</title><meta name="generator" content="DocBook XSL Stylesheets V1.75.2" /></head><body><div class="article" title="Torbutton Design Documentation"><div class="titlepage"><div><div><h2 class="title"><a id="design"></a>Torbutton Design Documentation</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Mike</span> <span class="surname">Perry</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:mikeperry.fscked/org">mikeperry.fscked/org</a>></code></p></div></div></div></div><div><p class="pubdate">Mar 25 2011</p></div></div><hr /></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="#id2940331">1. Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="#adversary">1.1. Adversary Model</a> </span></dt><dt><span class="sect2"><a href="#requirements">1.2. Torbutton Requirements</a></span></dt><dt><span class="sect2"><a href="#layout">1.3. Extension Layout</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2955313">2. Components</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2972601">2.1. Hooked Components</a></span></dt><dt><span class="sect2"><a href="#id2974988">2.2. New Components</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2976801">3. Chrome</a></span></dt><dd><dl><dt><span class="sect2"><a href="#browseroverlay">3.1. Browser Overlay - torbutton.xul</a></span></dt><dt><span class="sect2"><a href="#id2959444">3.2. Preferences Window - preferences.xul</a></span></dt><dt><span class="sect2"><a href="#id2952051">3.3. Other Windows</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2943135">4. Toggle Code Path</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2973670">4.1. Button Click</a></span></dt><dt>< span class="sect2"><a href="#id2975844">4.2. Proxy Update</a></span></dt><dt><span class="sect2"><a href="#id2954530">4.3. Settings Update</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2971938">5. Description of Options</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2967115">5.1. Test Settings</a></span></dt><dt><span class="sect2"><a href="#plugins">5.2. Disable plugins on Tor Usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2951289">5.3. Isolate Dynamic Content to Tor State (crucial)</a></span></dt><dt><span class="sect2"><a href="#jshooks">5.4. Hook Dangerous Javascript</a></span></dt><dt><span class="sect2"><a href="#id2960649">5.5. Resize windows to multiples of 50px during Tor usage (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2952949">5.6. Disable Updates During Tor</a></span></dt><dt><span class="sect2"><a href="#id2936606">5.7. Redirect Torbutton Updates Via Tor (recommended)</a></span></dt><dt><span c lass="sect2"><a href="#id2936650">5.8. Disable Search Suggestions during Tor (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2936689">5.9. Disable livemarks updates during Tor usage (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2936761">5.10. Block Tor/Non-Tor access to network from file:// urls (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2936833">5.11. Close all Tor/Non-Tor tabs and windows on toggle (optional)</a></span></dt><dt><span class="sect2"><a href="#id2936914">5.12. Isolate Access to History navigation to Tor state (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2936998">5.13. History Access Settings</a></span></dt><dt><span class="sect2"><a href="#id2937111">5.14. Clear History During Tor Toggle (optional)</a></span></dt><dt><span class="sect2"><a href="#id2978657">5.15. Block Password+Form saving during Tor/Non-Tor</a></span></dt><dt><span class="sect2"><a href="#id2978718">5.16. Block Tor dis k cache and clear all cache on Tor Toggle</a></span></dt><dt><span class="sect2"><a href="#id2978768">5.17. Block disk and memory cache during Tor</a></span></dt><dt><span class="sect2"><a href="#id2978820">5.18. Clear Cookies on Tor Toggle</a></span></dt><dt><span class="sect2"><a href="#id2978871">5.19. Store Non-Tor cookies in a protected jar</a></span></dt><dt><span class="sect2"><a href="#id2978928">5.20. Store both Non-Tor and Tor cookies in a protected jar (dangerous)</a></span></dt><dt><span class="sect2"><a href="#id2978967">5.21. Manage My Own Cookies (dangerous)</a></span></dt><dt><span class="sect2"><a href="#id2978982">5.22. Disable DOM Storage during Tor usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2979086">5.23. Clear HTTP Auth on Tor Toggle (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2979123">5.24. Clear cookies on Tor/Non-Tor shutdown</a></span></dt><dt><span class="sect2"><a href="#id2979178">5.25. Reload cookie ja r/clear cookies on Firefox crash</a></span></dt><dt><span class="sect2"><a href="#id2979253">5.26. On crash recovery or session restored startup, restore via: Tor, Non-Tor</a></span></dt><dt><span class="sect2"><a href="#id2979325">5.27. On normal startup, set state to: Tor, Non-Tor, Shutdown State</a></span></dt><dt><span class="sect2"><a href="#id2979384">5.28. Prevent session store from saving Non-Tor/Tor-loaded tabs</a></span></dt><dt><span class="sect2"><a href="#id2979449">5.29. Set user agent during Tor usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2979623">5.30. Spoof US English Browser</a></span></dt><dt><span class="sect2"><a href="#id2979716">5.31. Don't send referrer during Tor Usage</a></span></dt><dt><span class="sect2"><a href="#id2979756">5.32. Strip platform and language off of Google Search Box queries</a></span></dt><dt><span class="sect2"><a href="#id2979797">5.33. Automatically use an alternate search engine when presented with a +Google Captcha</a></span></dt><dt><span class="sect2"><a href="#id2979878">5.34. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)</a></span></dt></dl></dd><dt><span class="sect1"><a href="#FirefoxBugs">6. Relevant Firefox Bugs</a></span></dt><dd><dl><dt><span class="sect2"><a href="#FirefoxSecurity">6.1. Bugs impacting security</a></span></dt><dt><span class="sect2"><a href="#FirefoxWishlist">6.2. Bugs blocking functionality</a></span></dt><dt><span class="sect2"><a href="#FirefoxMiscBugs">6.3. Low Priority Bugs</a></span></dt></dl></dd><dt><span class="sect1"><a href="#TestPlan">7. Testing</a></span></dt><dd><dl><dt><span class="sect2"><a href="#SingleStateTesting">7.1. Single state testing</a></span></dt><dt><span class="sect2"><a href="#id2980994">7.2. Multi-state testing</a></span></dt><dt><span class="sect2"><a href="#HackTorbutton">7.3. Active testing (aka How to Hack Torbutton)</a></span></dt></dl></dd></dl></div><div class="sect1" title="1. Introduc tion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2940331"></a>1. Introduction</h2></div></div></div><p> This document describes the goals, operation, and testing procedures of the Torbutton Firefox extension. It is current as of Torbutton 1.2.5. @@ -232,13 +232,13 @@ obsolete and deprecated interfaces and has proved to be less than stable.</p><p>'Chrome' is a combination of XML and Javascript used to describe a window. Extensions are allowed to create 'overlays' that are 'bound' to existing XML window definitions, or they can create their own windows. The DTD for this XML -is called <a class="ulink" href="http://developer.mozilla.org/en/docs/XUL_Reference" target="_top">XUL</a>.</p></div></div><div class="sect1" title="2. Components"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2662790"></a>2. Components</h2></div></div></div><p> +is called <a class="ulink" href="http://developer.mozilla.org/en/docs/XUL_Reference" target="_top">XUL</a>.</p></div></div><div class="sect1" title="2. Components"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2955313"></a>2. Components</h2></div></div></div><p> Torbutton installs components for two purposes: hooking existing components to reimplement their interfaces; and creating new components that provide services to other pieces of the extension. - </p><div class="sect2" title="2.1. Hooked Components"><div class="titlepage"><div><div><h3 class="title"><a id="id2680078"></a>2.1. Hooked Components</h3></div></div></div><p>Torbutton makes extensive use of Contract ID hooking, and implements some + </p><div class="sect2" title="2.1. Hooked Components"><div class="titlepage"><div><div><h3 class="title"><a id="id2972601"></a>2.1. Hooked Components</h3></div></div></div><p>Torbutton makes extensive use of Contract ID hooking, and implements some of its own standalone components as well. Let's discuss the hooked components first.</p><div class="sect3" title="@mozilla.org/browser/sessionstore;1 - components/nsSessionStore36.js"><div class="titlepage"><div><div><h4 class="title"><a id="sessionstore"></a><a class="ulink" href="http://developer.mozilla.org/en/docs/nsISessionStore" target="_top">@mozilla.org/browser/sessionstore;1</a> - <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/nsSessi…" target="_top">components/nsSessionStore36.js</a></h4></div></div></div><p>These components address the <a class="link" href="#disk">Disk Avoidance</a> @@ -267,7 +267,7 @@ do not obey proxy settings, they can be manipulated to automatically connect back to arbitrary servers outside of Tor with no user intervention. Fixing this issue helps to satisfy Torbutton's <a class="link" href="#proxy">Proxy Obedience</a> Requirement. - </p></div><div class="sect3" title="@mozilla.org/browser/sessionstartup;1 - components/crash-observer.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2658953"></a><a class="ulink" href="http://lxr.mozilla.org/seamonkey/source/browser/components/sessionstore/src…" target="_top">@mozilla.org/browser/sessionstartup;1</a> - + </p></div><div class="sect3" title="@mozilla.org/browser/sessionstartup;1 - components/crash-observer.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2951475"></a><a class="ulink" href="http://lxr.mozilla.org/seamonkey/source/browser/components/sessionstore/src…" target="_top">@mozilla.org/browser/sessionstartup;1</a> - <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/crash-o…" target="_top">components/crash-observer.js</a></h4></div></div></div><p>This component wraps the Firefox Session Startup component that is in charge of <a class="ulink" href="http://developer.mozilla.org/en/docs/Session_store_API" target="_top">restoring saved sessions</a>. The wrapper's only job is to intercept the @@ -281,7 +281,7 @@ includes setting the Tor state to the one the user selected for crash recovery in the preferences window (<span class="command"><strong>extensions.torbutton.restore_tor</strong></span>), and restoring cookies for the corresponding cookie jar, if it exists.</p><p>By performing this notification, this component assists in the <a class="link" href="#proxy">Proxy Obedience</a>, and <a class="link" href="#isolation">Network Isolation</a> requirements. -</p></div><div class="sect3" title="@mozilla.org/browser/global-history;2 - components/ignore-history.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2679280"></a><a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/c…" target="_top">@mozilla.org/browser/global-history;2</a> +</p></div><div class="sect3" title="@mozilla.org/browser/global-history;2 - components/ignore-history.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2971802"></a><a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/c…" target="_top">@mozilla.org/browser/global-history;2</a> - <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/ignore-…" target="_top">components/ignore-history.js</a></h4></div></div></div><p>This component was contributed by <a class="ulink" href="http://www.collinjackson.com/" target="_top">Collin Jackson</a> as a method for defeating CSS and Javascript-based methods of history disclosure. The global-history component is what is used by Firefox to determine if a link was visited or not @@ -306,9 +306,9 @@ firing in the event the browser starts in Tor mode. This component helps satisfy the <a class="link" href="#isolation">Network Isolation</a> and <a class="link" href="#setpreservation">Anonymity Set Preservation</a> requirements. -</p></div></div><div class="sect2" title="2.2. New Components"><div class="titlepage"><div><div><h3 class="title"><a id="id2682465"></a>2.2. New Components</h3></div></div></div><p>Torbutton creates four new components that are used throughout the +</p></div></div><div class="sect2" title="2.2. New Components"><div class="titlepage"><div><div><h3 class="title"><a id="id2974988"></a>2.2. New Components</h3></div></div></div><p>Torbutton creates four new components that are used throughout the extension. These components do not hook any interfaces, nor are they used -anywhere besides Torbutton itself.</p><div class="sect3" title="@torproject.org/cookie-jar-selector;2 - components/cookie-jar-selector.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2658495"></a><a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-…" target="_top">@torproject.org/cookie-jar-selector;2 +anywhere besides Torbutton itself.</p><div class="sect3" title="@torproject.org/cookie-jar-selector;2 - components/cookie-jar-selector.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2951018"></a><a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-…" target="_top">@torproject.org/cookie-jar-selector;2 - components/cookie-jar-selector.js</a></h4></div></div></div><p>The cookie jar selector (also based on code from <a class="ulink" href="http://www.collinjackson.com/" target="_top">Collin Jackson</a>) is used by the Torbutton chrome to switch between Tor and Non-Tor cookies. Its operations are simple: sync cookies to disk, then @@ -317,7 +317,7 @@ move the current cookies.txt file to the appropriate backup location into place.</p><p> This component helps to address the <a class="link" href="#state">State Isolation</a> requirement of Torbutton. -</p></div><div class="sect3" title="@torproject.org/torbutton-logger;1 - components/torbutton-logger.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2683046"></a><a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/torbutt…" target="_top">@torproject.org/torbutton-logger;1 +</p></div><div class="sect3" title="@torproject.org/torbutton-logger;1 - components/torbutton-logger.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2975569"></a><a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/torbutt…" target="_top">@torproject.org/torbutton-logger;1 - components/torbutton-logger.js</a></h4></div></div></div><p>The torbutton logger component allows on-the-fly redirection of torbutton logging messages to either Firefox stderr (<span class="command"><strong>extensions.torbutton.logmethod=0</strong></span>), the Javascript error console @@ -369,7 +369,7 @@ reason are not passed to the Firefox content policy itself (see Firefox Bugs </p><p> This helps to fulfill both the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> and the <a class="link" href="#undiscoverability">Tor Undiscoverability</a> requirements of -Torbutton.</p></div></div></div><div class="sect1" title="3. Chrome"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2684278"></a>3. Chrome</h2></div></div></div><p>The chrome is where all the torbutton graphical elements and windows are +Torbutton.</p></div></div></div><div class="sect1" title="3. Chrome"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2976801"></a>3. Chrome</h2></div></div></div><p>The chrome is where all the torbutton graphical elements and windows are located. Each window is described as an <a class="ulink" href="http://developer.mozilla.org/en/docs/XUL_Reference" target="_top">XML file</a>, with zero or more Javascript files attached. The scope of these Javascript files is their containing window.</p><div class="sect2" title="3.1. Browser Overlay - torbutton.xul"><div class="titlepage"><div><div><h3 class="title"><a id="browseroverlay"></a>3.1. Browser Overlay - <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/tor…" target="_top">torbutton.xul</a></h3></div></div></div><p>The browser overlay, torbutton.xul, defines the toolbar button, the status @@ -496,9 +496,9 @@ enabled. This helps Torbutton fulfill its <a class="link" href="#disk">Disk Avoidance</a> and <a class="link" href="#state">State Separation</a> requirements. - </p></li></ol></div></div><div class="sect2" title="3.2. Preferences Window - preferences.xul"><div class="titlepage"><div><div><h3 class="title"><a id="id2666921"></a>3.2. Preferences Window - <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/pre…" target="_top">preferences.xul</a></h3></div></div></div><p>The preferences window of course lays out the Torbutton preferences, with -handlers located in <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/pre…" target="_top">chrome/content/preferences.js</a>.</p></div><div class="sect2" title="3.3. Other Windows"><div class="titlepage"><div><div><h3 class="title"><a id="id2659528"></a>3.3. Other Windows</h3></div></div></div><p>There are additional windows that describe popups for right clicking on -the status bar, the toolbutton, and the about page.</p></div></div><div class="sect1" title="4. Toggle Code Path"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2650612"></a>4. Toggle Code Path</h2></div></div></div><p> + </p></li></ol></div></div><div class="sect2" title="3.2. Preferences Window - preferences.xul"><div class="titlepage"><div><div><h3 class="title"><a id="id2959444"></a>3.2. Preferences Window - <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/pre…" target="_top">preferences.xul</a></h3></div></div></div><p>The preferences window of course lays out the Torbutton preferences, with +handlers located in <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/pre…" target="_top">chrome/content/preferences.js</a>.</p></div><div class="sect2" title="3.3. Other Windows"><div class="titlepage"><div><div><h3 class="title"><a id="id2952051"></a>3.3. Other Windows</h3></div></div></div><p>There are additional windows that describe popups for right clicking on +the status bar, the toolbutton, and the about page.</p></div></div><div class="sect1" title="4. Toggle Code Path"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2943135"></a>4. Toggle Code Path</h2></div></div></div><p> The act of toggling is connected to <code class="function">torbutton_toggle()</code> via the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/tor…" target="_top">torbutton.xul</a> @@ -519,7 +519,7 @@ conditions and leakage, especially with <a class="ulink" href="https://bugzilla. 409737</a> unfixed. The content policy does not allow any network activity whatsoever during this three stage transition. - </p><div class="sect2" title="4.1. Button Click"><div class="titlepage"><div><div><h3 class="title"><a id="id2681148"></a>4.1. Button Click</h3></div></div></div><p> + </p><div class="sect2" title="4.1. Button Click"><div class="titlepage"><div><div><h3 class="title"><a id="id2973670"></a>4.1. Button Click</h3></div></div></div><p> This is the first step in the toggling process. When the user clicks the toggle button or the toolbar, <code class="function">torbutton_toggle()</code> is @@ -532,7 +532,7 @@ observer</a> <span class="command"><strong>torbutton_unique_pref_observer</strong></span> to perform the rest of the toggle. - </p></div><div class="sect2" title="4.2. Proxy Update"><div class="titlepage"><div><div><h3 class="title"><a id="id2683321"></a>4.2. Proxy Update</h3></div></div></div><p> + </p></div><div class="sect2" title="4.2. Proxy Update"><div class="titlepage"><div><div><h3 class="title"><a id="id2975844"></a>4.2. Proxy Update</h3></div></div></div><p> When Torbutton receives any proxy change notifications via its <span class="command"><strong>torbutton_unique_pref_observer</strong></span>, it calls @@ -547,7 +547,7 @@ value. This is decoupled from the button click functionalty via the pref observer so that other addons (such as SwitchProxy) can switch the proxy settings between multiple proxies. - </p></div><div class="sect2" title="4.3. Settings Update"><div class="titlepage"><div><div><h3 class="title"><a id="id2662007"></a>4.3. Settings Update</h3></div></div></div><p> + </p></div><div class="sect2" title="4.3. Settings Update"><div class="titlepage"><div><div><h3 class="title"><a id="id2954530"></a>4.3. Settings Update</h3></div></div></div><p> The next stage is also handled by <code class="function">torbutton_update_status()</code>. This function sets scores of @@ -558,10 +558,10 @@ end of its work, it sets <span class="command"><strong>extensions.torbutton.settings_applied</strong></span>, which signifies the completion of the toggle operation to the <a class="link" href="#contentpolicy" title="@torproject.org/cssblocker;1 - components/cssblocker.js">content policy</a>. - </p></div></div><div class="sect1" title="5. Description of Options"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2679416"></a>5. Description of Options</h2></div></div></div><p>This section provides a detailed description of Torbutton's options. Each + </p></div></div><div class="sect1" title="5. Description of Options"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2971938"></a>5. Description of Options</h2></div></div></div><p>This section provides a detailed description of Torbutton's options. Each option is presented as the string from the preferences window, a summary, the preferences it touches, and the effect this has on the components, chrome, and -browser properties.</p><div class="sect2" title="5.1. Test Settings"><div class="titlepage"><div><div><h3 class="title"><a id="id2674592"></a>5.1. Test Settings</h3></div></div></div><p> +browser properties.</p><div class="sect2" title="5.1. Test Settings"><div class="titlepage"><div><div><h3 class="title"><a id="id2967115"></a>5.1. Test Settings</h3></div></div></div><p> This button under the Proxy Settings tab provides a way to verify that the proxy settings are correct, and actually do route through the Tor network. It performs this check by issuing an <a class="ulink" href="http://developer.mozilla.org/en/docs/XMLHttpRequest" target="_top">XMLHTTPRequest</a> @@ -620,7 +620,7 @@ all this and the plugin managed to find some way to load. Since most plugins completely ignore browser proxy settings, the actions performed by this setting are crucial to satisfying the <a class="link" href="#proxy">Proxy Obedience</a> requirement. - </p></div><div class="sect2" title="5.3. Isolate Dynamic Content to Tor State (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2658766"></a>5.3. Isolate Dynamic Content to Tor State (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.isolate_content</strong></span></p><p>Enabling this preference is what enables the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cssbloc…" target="_top">@torproject.org/cssblocker;1</a> content policy + </p></div><div class="sect2" title="5.3. Isolate Dynamic Content to Tor State (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2951289"></a>5.3. Isolate Dynamic Content to Tor State (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.isolate_content</strong></span></p><p>Enabling this preference is what enables the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cssbloc…" target="_top">@torproject.org/cssblocker;1</a> content policy mentioned above, and causes it to block content load attempts in pages an opposite Tor state from the current state. Freshly loaded <a class="ulink" href="https://developer.mozilla.org/en/XUL/tabbrowser" target="_top">browser tabs</a> are tagged @@ -672,7 +672,7 @@ We are still looking for a workaround as of Torbutton 1.2.5. -</p></div><div class="sect2" title="5.5. Resize windows to multiples of 50px during Tor usage (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2668126"></a>5.5. Resize windows to multiples of 50px during Tor usage (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.resize_windows</strong></span></p><p> +</p></div><div class="sect2" title="5.5. Resize windows to multiples of 50px during Tor usage (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2960649"></a>5.5. Resize windows to multiples of 50px during Tor usage (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.resize_windows</strong></span></p><p> This option drastically cuts down on the number of distinct anonymity sets that divide the Tor web userbase. Without this setting, the dimensions for a @@ -707,7 +707,7 @@ infer toolbar size/presence by the distance to the nearest 50 pixel roundoff). </p><p> This setting helps to meet the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> requirements. -</p></div><div class="sect2" title="5.6. Disable Updates During Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2660426"></a>5.6. Disable Updates During Tor</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_updates</strong></span></p><p>This setting causes Torbutton to disable the four <a class="ulink" href="http://wiki.mozilla.org/Update:Users/Checking_For_Updates#Preference_Contro…" target="_top">Firefox +</p></div><div class="sect2" title="5.6. Disable Updates During Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2952949"></a>5.6. Disable Updates During Tor</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_updates</strong></span></p><p>This setting causes Torbutton to disable the four <a class="ulink" href="http://wiki.mozilla.org/Update:Users/Checking_For_Updates#Preference_Contro…" target="_top">Firefox update settings</a> during Tor usage: <span class="command"><strong>extensions.update.enabled</strong></span>, <span class="command"><strong>app.update.enabled</strong></span>, @@ -717,7 +717,7 @@ update settings</a> during Tor checking for search plugin updates while Tor is enabled. </p><p> This setting satisfies the <a class="link" href="#updates">Update Safety</a> requirement. -</p></div><div class="sect2" title="5.7. Redirect Torbutton Updates Via Tor (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2644084"></a>5.7. Redirect Torbutton Updates Via Tor (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.update_torbutton_via_tor</strong></span></p><p>This setting causes Torbutton to install an +</p></div><div class="sect2" title="5.7. Redirect Torbutton Updates Via Tor (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2936606"></a>5.7. Redirect Torbutton Updates Via Tor (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.update_torbutton_via_tor</strong></span></p><p>This setting causes Torbutton to install an <a class="ulink" href="https://developer.mozilla.org/en/nsIProtocolProxyFilter" target="_top">nsIProtocolProxyFilter</a> in order to redirect all version update checks and Torbutton update downloads @@ -726,7 +726,7 @@ concerns about data retention done by <a class="ulink" href="https://www.addons. help censored users meet the <a class="link" href="#undiscoverability">Tor Undiscoverability</a> requirement. - </p></div><div class="sect2" title="5.8. Disable Search Suggestions during Tor (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2644128"></a>5.8. Disable Search Suggestions during Tor (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_search</strong></span></p><p> + </p></div><div class="sect2" title="5.8. Disable Search Suggestions during Tor (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2936650"></a>5.8. Disable Search Suggestions during Tor (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_search</strong></span></p><p> This setting causes Torbutton to disable <a class="ulink" href="http://kb.mozillazine.org/Browser.search.suggest.enabled" target="_top"><span class="command"><strong>browser.search.suggest.enabled</strong></span></a> during Tor usage. This governs if you get Google search suggestions during Tor @@ -737,7 +737,7 @@ this is recommended to be disabled. While this setting doesn't satisfy any Torbutton requirements, the fact that cookies are transmitted for partially typed queries does not seem desirable for Tor usage. -</p></div><div class="sect2" title="5.9. Disable livemarks updates during Tor usage (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2644167"></a>5.9. Disable livemarks updates during Tor usage (recommended)</h3></div></div></div><p>Option: +</p></div><div class="sect2" title="5.9. Disable livemarks updates during Tor usage (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2936689"></a>5.9. Disable livemarks updates during Tor usage (recommended)</h3></div></div></div><p>Option: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.disable_livemarks</strong></span></td></tr></table><p> </p><p> This option causes Torbutton to prevent Firefox from loading <a class="ulink" href="http://www.mozilla.com/firefox/livebookmarks.html" target="_top">Livemarks</a> during @@ -751,7 +751,7 @@ service</a> when Tor is enabled. This helps satisfy the <a class="link" href="#isolation">Network Isolation</a> and <a class="link" href="#setpreservation">Anonymity Set Preservation</a> requirements. -</p></div><div class="sect2" title="5.10. Block Tor/Non-Tor access to network from file:// urls (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2644238"></a>5.10. Block Tor/Non-Tor access to network from file:// urls (recommended)</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.10. Block Tor/Non-Tor access to network from file:// urls (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2936761"></a>5.10. Block Tor/Non-Tor access to network from file:// urls (recommended)</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.block_tor_file_net</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_nontor_file_net</strong></span></td></tr></table><p> </p><p> @@ -771,7 +771,7 @@ Isolation</a> requirement, by preventing file urls from executing network operations in opposite Tor states. Also, allowing pages to submit arbitrary files to arbitrary sites just generally seems like a bad idea. -</p></div><div class="sect2" title="5.11. Close all Tor/Non-Tor tabs and windows on toggle (optional)"><div class="titlepage"><div><div><h3 class="title"><a id="id2644310"></a>5.11. Close all Tor/Non-Tor tabs and windows on toggle (optional)</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.11. Close all Tor/Non-Tor tabs and windows on toggle (optional)"><div class="titlepage"><div><div><h3 class="title"><a id="id2936833"></a>5.11. Close all Tor/Non-Tor tabs and windows on toggle (optional)</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.close_nontor</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.close_tor</strong></span></td></tr></table><p> </p><p> @@ -795,7 +795,7 @@ out longer than necessary. While this setting doesn't satisfy any Torbutton requirements, the fact that cookies are transmitted for partially typed queries does not seem desirable for Tor usage. -</p></div><div class="sect2" title="5.12. Isolate Access to History navigation to Tor state (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2644391"></a>5.12. Isolate Access to History navigation to Tor state (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.block_js_history</strong></span></p><p> +</p></div><div class="sect2" title="5.12. Isolate Access to History navigation to Tor state (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2936914"></a>5.12. Isolate Access to History navigation to Tor state (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.block_js_history</strong></span></p><p> This setting determines if Torbutton installs an <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsISHistoryListen…" target="_top">nsISHistoryListener</a> attached to the <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsISHistory" target="_top">sessionHistory</a> of of each browser's <a class="ulink" href="https://developer.mozilla.org/en/XUL%3aProperty%3awebNavigation" target="_top">webNavigatator</a>. @@ -823,7 +823,7 @@ This setting helps to fulfill Torbutton's <a class="link" href="#state">State Separation</a> and (until Bug 409737 is fixed) <a class="link" href="#isolation">Network Isolation</a> requirements. - </p></div><div class="sect2" title="5.13. History Access Settings"><div class="titlepage"><div><div><h3 class="title"><a id="id2644476"></a>5.13. History Access Settings</h3></div></div></div><p>Options: + </p></div><div class="sect2" title="5.13. History Access Settings"><div class="titlepage"><div><div><h3 class="title"><a id="id2936998"></a>5.13. History Access Settings</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.block_thread</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_nthread</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_thwrite</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_nthwrite</strong></span></td></tr></table><p> </p><p>These four settings govern the behavior of the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/ignore-…" target="_top">components/ignore-history.js</a> history blocker component mentioned above. By hooking the browser's view of @@ -838,12 +838,12 @@ Database</a> and the older Firefox 2 mechanisms. </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements. -</p></div><div class="sect2" title="5.14. Clear History During Tor Toggle (optional)"><div class="titlepage"><div><div><h3 class="title"><a id="id2644588"></a>5.14. Clear History During Tor Toggle (optional)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_history</strong></span></p><p>This setting governs if Torbutton calls +</p></div><div class="sect2" title="5.14. Clear History During Tor Toggle (optional)"><div class="titlepage"><div><div><h3 class="title"><a id="id2937111"></a>5.14. Clear History During Tor Toggle (optional)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_history</strong></span></p><p>This setting governs if Torbutton calls <a class="ulink" href="https://developer.mozilla.org/en/nsIBrowserHistory#removeAllPages.28.29" target="_top">nsIBrowserHistory.removeAllPages</a> and <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsISHistory" target="_top">nsISHistory.PurgeHistory</a> for each tab on Tor toggle.</p><p> This setting is an optional way to help satisfy the <a class="link" href="#state">State Separation</a> requirement. -</p></div><div class="sect2" title="5.15. Block Password+Form saving during Tor/Non-Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2686134"></a>5.15. Block Password+Form saving during Tor/Non-Tor</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.15. Block Password+Form saving during Tor/Non-Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2978657"></a>5.15. Block Password+Form saving during Tor/Non-Tor</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.block_tforms</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_ntforms</strong></span></td></tr></table><p> </p><p>These settings govern if Torbutton disables <span class="command"><strong>browser.formfill.enable</strong></span> @@ -852,19 +852,19 @@ Since form fields can be read at any time by Javascript, this setting is a lot more important than it seems. </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements. -</p></div><div class="sect2" title="5.16. Block Tor disk cache and clear all cache on Tor Toggle"><div class="titlepage"><div><div><h3 class="title"><a id="id2686195"></a>5.16. Block Tor disk cache and clear all cache on Tor Toggle</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_cache</strong></span> +</p></div><div class="sect2" title="5.16. Block Tor disk cache and clear all cache on Tor Toggle"><div class="titlepage"><div><div><h3 class="title"><a id="id2978718"></a>5.16. Block Tor disk cache and clear all cache on Tor Toggle</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_cache</strong></span> </p><p>This option causes Torbutton to call <a class="ulink" href="https://developer.mozilla.org/en/nsICacheService#evictEntries.28.29" target="_top">nsICacheService.evictEntries(0)</a> on Tor toggle to remove all entries from the cache. In addition, this setting causes Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Browser.cache.disk.enable" target="_top">browser.cache.disk.enable</a> to false. </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements. -</p></div><div class="sect2" title="5.17. Block disk and memory cache during Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2686245"></a>5.17. Block disk and memory cache during Tor</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.block_cache</strong></span></p><p>This setting +</p></div><div class="sect2" title="5.17. Block disk and memory cache during Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2978768"></a>5.17. Block disk and memory cache during Tor</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.block_cache</strong></span></p><p>This setting causes Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Browser.cache.memory.enable" target="_top">browser.cache.memory.enable</a>, <a class="ulink" href="http://kb.mozillazine.org/Browser.cache.disk.enable" target="_top">browser.cache.disk.enable</a> and <a class="ulink" href="http://kb.mozillazine.org/Network.http.use-cache" target="_top">network.http.use-cache</a> to false during tor usage. </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements. -</p></div><div class="sect2" title="5.18. Clear Cookies on Tor Toggle"><div class="titlepage"><div><div><h3 class="title"><a id="id2686298"></a>5.18. Clear Cookies on Tor Toggle</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_cookies</strong></span> +</p></div><div class="sect2" title="5.18. Clear Cookies on Tor Toggle"><div class="titlepage"><div><div><h3 class="title"><a id="id2978820"></a>5.18. Clear Cookies on Tor Toggle</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_cookies</strong></span> </p><p> This setting causes Torbutton to call <a class="ulink" href="https://developer.mozilla.org/en/nsICookieManager#removeAll.28.29" target="_top">nsICookieManager.removeAll()</a> on @@ -874,7 +874,7 @@ which prevents them from being written to disk. </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements. -</p></div><div class="sect2" title="5.19. Store Non-Tor cookies in a protected jar"><div class="titlepage"><div><div><h3 class="title"><a id="id2686349"></a>5.19. Store Non-Tor cookies in a protected jar</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.cookie_jars</strong></span> +</p></div><div class="sect2" title="5.19. Store Non-Tor cookies in a protected jar"><div class="titlepage"><div><div><h3 class="title"><a id="id2978871"></a>5.19. Store Non-Tor cookies in a protected jar</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.cookie_jars</strong></span> </p><p> This setting causes Torbutton to use <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-…" target="_top">@torproject.org/cookie-jar-selector;2</a> to store @@ -887,15 +887,15 @@ which prevents them from being written to disk. </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements. -</p></div><div class="sect2" title="5.20. Store both Non-Tor and Tor cookies in a protected jar (dangerous)"><div class="titlepage"><div><div><h3 class="title"><a id="id2686405"></a>5.20. Store both Non-Tor and Tor cookies in a protected jar (dangerous)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.dual_cookie_jars</strong></span> +</p></div><div class="sect2" title="5.20. Store both Non-Tor and Tor cookies in a protected jar (dangerous)"><div class="titlepage"><div><div><h3 class="title"><a id="id2978928"></a>5.20. Store both Non-Tor and Tor cookies in a protected jar (dangerous)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.dual_cookie_jars</strong></span> </p><p> This setting causes Torbutton to use <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-…" target="_top">@torproject.org/cookie-jar-selector;2</a> to store both Tor and Non-Tor cookies into protected jars. </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement. -</p></div><div class="sect2" title="5.21. Manage My Own Cookies (dangerous)"><div class="titlepage"><div><div><h3 class="title"><a id="id2686444"></a>5.21. Manage My Own Cookies (dangerous)</h3></div></div></div><p>Options: None</p><p>This setting disables all Torbutton cookie handling by setting the above -cookie prefs all to false.</p></div><div class="sect2" title="5.22. Disable DOM Storage during Tor usage (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2686459"></a>5.22. Disable DOM Storage during Tor usage (crucial)</h3></div></div></div><div class="sect2" title="5.22.1. Do not write Tor/Non-Tor cookies to disk"><div class="titlepage"><div><div><h3 class="title"><a id="id2686461"></a>5.22.1. Do not write Tor/Non-Tor cookies to disk</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.21. Manage My Own Cookies (dangerous)"><div class="titlepage"><div><div><h3 class="title"><a id="id2978967"></a>5.21. Manage My Own Cookies (dangerous)</h3></div></div></div><p>Options: None</p><p>This setting disables all Torbutton cookie handling by setting the above +cookie prefs all to false.</p></div><div class="sect2" title="5.22. Disable DOM Storage during Tor usage (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2978982"></a>5.22. Disable DOM Storage during Tor usage (crucial)</h3></div></div></div><div class="sect2" title="5.22.1. Do not write Tor/Non-Tor cookies to disk"><div class="titlepage"><div><div><h3 class="title"><a id="id2978984"></a>5.22.1. Do not write Tor/Non-Tor cookies to disk</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.tor_memory_jar</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.nontor_memory_jar</strong></span></td></tr></table><p> </p><p> These settings (contributed by arno) cause Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Network.cookie.lifetimePolicy" target="_top">network.cookie.lifetimePolicy</a> @@ -915,13 +915,13 @@ usage to prevent <a class="ulink" href="http://developer.mozilla.org/en/docs/DOM:Storage" target="_top">DOM Storage</a> from being used to store persistent information across Tor states.</p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement. -</p></div><div class="sect2" title="5.23. Clear HTTP Auth on Tor Toggle (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2686563"></a>5.23. Clear HTTP Auth on Tor Toggle (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_http_auth</strong></span> +</p></div><div class="sect2" title="5.23. Clear HTTP Auth on Tor Toggle (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2979086"></a>5.23. Clear HTTP Auth on Tor Toggle (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_http_auth</strong></span> </p><p> This setting causes Torbutton to call <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsIHttpAuthManager" target="_top">nsIHttpAuthManager.clearAll()</a> every time Tor is toggled. </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement. -</p></div><div class="sect2" title="5.24. Clear cookies on Tor/Non-Tor shutdown"><div class="titlepage"><div><div><h3 class="title"><a id="id2686600"></a>5.24. Clear cookies on Tor/Non-Tor shutdown</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.shutdown_method</strong></span> +</p></div><div class="sect2" title="5.24. Clear cookies on Tor/Non-Tor shutdown"><div class="titlepage"><div><div><h3 class="title"><a id="id2979123"></a>5.24. Clear cookies on Tor/Non-Tor shutdown</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.shutdown_method</strong></span> </p><p> This option variable can actually take 3 values: 0, 1, and 2. 0 means no cookie clearing, 1 means clear only during Tor-enabled shutdown, and 2 means clear for both Tor and Non-Tor shutdown. When set to 1 or 2, Torbutton listens @@ -929,7 +929,7 @@ for the <a class="ulink" href="http://developer.mozilla.org/en/docs/Observer_Not <code class="function">https://git.torproject.org/checkout/torbutton/master/src/components/crash-o…</code> and use <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-…" target="_top">@torproject.org/cookie-jar-selector;2</a> to clear out all cookies and all cookie jars upon shutdown. </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement. -</p></div><div class="sect2" title="5.25. Reload cookie jar/clear cookies on Firefox crash"><div class="titlepage"><div><div><h3 class="title"><a id="id2686655"></a>5.25. Reload cookie jar/clear cookies on Firefox crash</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.25. Reload cookie jar/clear cookies on Firefox crash"><div class="titlepage"><div><div><h3 class="title"><a id="id2979178"></a>5.25. Reload cookie jar/clear cookies on Firefox crash</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.reload_crashed_jar</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.crashed</strong></span></td></tr></table><p> </p><p>This is no longer a user visible option, and is enabled by default. In the event of a crash, the Torbutton <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/crash-o…" target="_top">components/crash-observer.js</a> @@ -941,7 +941,7 @@ the chrome that listens for this update), and Torbutton will load the component.</p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement in the event of Firefox crashes. -</p></div><div class="sect2" title="5.26. On crash recovery or session restored startup, restore via: Tor, Non-Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2686731"></a>5.26. On crash recovery or session restored startup, restore via: Tor, Non-Tor</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.26. On crash recovery or session restored startup, restore via: Tor, Non-Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2979253"></a>5.26. On crash recovery or session restored startup, restore via: Tor, Non-Tor</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.restore_tor</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.crashed</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.normal_exit</strong></span></td></tr></table><p> </p><p>This option works with the Torbutton <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/crash-o…" target="_top">crash-observer.js</a> to set the Tor state after a crash is detected (via the @@ -957,7 +957,7 @@ setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement in the event of Firefox crashes by ensuring all cookies, settings and saved sessions are reloaded from a fixed Tor state. -</p></div><div class="sect2" title="5.27. On normal startup, set state to: Tor, Non-Tor, Shutdown State"><div class="titlepage"><div><div><h3 class="title"><a id="id2686802"></a>5.27. On normal startup, set state to: Tor, Non-Tor, Shutdown State</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.27. On normal startup, set state to: Tor, Non-Tor, Shutdown State"><div class="titlepage"><div><div><h3 class="title"><a id="id2979325"></a>5.27. On normal startup, set state to: Tor, Non-Tor, Shutdown State</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.startup_state</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.noncrashed</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.normal_exit</strong></span></td></tr></table><p> </p><p>This option also works with the Torbutton <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/crash-o…" target="_top">crash-observer.js</a> to set the Tor state after a normal startup is detected (via the @@ -967,7 +967,7 @@ false positives extensions.torbutton.normal_exit in torbutton_uninstall_observer() during Firefox exit and checks this value as well during startup. -</p></div><div class="sect2" title="5.28. Prevent session store from saving Non-Tor/Tor-loaded tabs"><div class="titlepage"><div><div><h3 class="title"><a id="id2686861"></a>5.28. Prevent session store from saving Non-Tor/Tor-loaded tabs</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.28. Prevent session store from saving Non-Tor/Tor-loaded tabs"><div class="titlepage"><div><div><h3 class="title"><a id="id2979384"></a>5.28. Prevent session store from saving Non-Tor/Tor-loaded tabs</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.nonontor_sessionstore</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.notor_sessionstore</strong></span></td></tr></table><p> </p><p>If these options are enabled, the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/nsSessi…" target="_top">replacement nsSessionStore.js</a> component checks the <span class="command"><strong>__tb_tor_fetched</strong></span> tag of tabs before writing them @@ -977,7 +977,7 @@ This setting helps to satisfy the <a class="link" href="#disk">Disk Avoidance</a requirement, and also helps to satisfy the <a class="link" href="#state">State Separation</a> requirement in the event of Firefox crashes. -</p></div><div class="sect2" title="5.29. Set user agent during Tor usage (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2686926"></a>5.29. Set user agent during Tor usage (crucial)</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.29. Set user agent during Tor usage (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2979449"></a>5.29. Set user agent during Tor usage (crucial)</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.set_uagent</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.platform_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.oscpu_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.buildID_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.productsub_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.appname_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.appversion_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.useragent_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.useragent_vendor</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.useragent_vendorSub</strong></span></td></tr></table><p> </p><p>On face, user agent switching appears to be straight-forward in Firefox. It provides several options for controlling the browser user agent string: @@ -1001,7 +1001,7 @@ certain resource:// files</a>. These cases are handled by Torbutton's </p><p> This setting helps to satisfy the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> requirement. -</p></div><div class="sect2" title="5.30. Spoof US English Browser"><div class="titlepage"><div><div><h3 class="title"><a id="id2687100"></a>5.30. Spoof US English Browser</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.30. Spoof US English Browser"><div class="titlepage"><div><div><h3 class="title"><a id="id2979623"></a>5.30. Spoof US English Browser</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.spoof_english</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.spoof_charset</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.spoof_language</strong></span></td></tr></table><p> </p><p> This option causes Torbutton to set <span class="command"><strong>general.useragent.locale</strong></span> @@ -1012,13 +1012,13 @@ This setting helps to satisfy the <a class="link" href="#setpreservation">Anonym well as hooking <span class="command"><strong>navigator.language</strong></span> via its <a class="link" href="#jshooks" title="5.4. Hook Dangerous Javascript">javascript hooks</a>. </p><p> This setting helps to satisfy the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> and <a class="link" href="#location">Location Neutrality</a> requirements. -</p></div><div class="sect2" title="5.31. Don't send referrer during Tor Usage"><div class="titlepage"><div><div><h3 class="title"><a id="id2687193"></a>5.31. Don't send referrer during Tor Usage</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.disable_referer</strong></span> +</p></div><div class="sect2" title="5.31. Don't send referrer during Tor Usage"><div class="titlepage"><div><div><h3 class="title"><a id="id2979716"></a>5.31. Don't send referrer during Tor Usage</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.disable_referer</strong></span> </p><p> This option causes Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Network.http.sendSecureXSiteReferrer" target="_top">network.http.sendSecureXSiteReferrer</a> and <a class="ulink" href="http://kb.mozillazine.org/Network.http.sendRefererHeader" target="_top">network.http.sendRefererHeader</a> during Tor usage.</p><p> This setting also does not directly satisfy any Torbutton requirement, but some may desire to mask their referrer for general privacy concerns. -</p></div><div class="sect2" title="5.32. Strip platform and language off of Google Search Box queries"><div class="titlepage"><div><div><h3 class="title"><a id="id2687234"></a>5.32. Strip platform and language off of Google Search Box queries</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.fix_google_srch</strong></span> +</p></div><div class="sect2" title="5.32. Strip platform and language off of Google Search Box queries"><div class="titlepage"><div><div><h3 class="title"><a id="id2979756"></a>5.32. Strip platform and language off of Google Search Box queries</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.fix_google_srch</strong></span> </p><p> This option causes Torbutton to use the <a class="ulink" href="https://wiki.mozilla.org/Search_Service:API" target="_top">@mozilla.org/browser/search-service;1</a> @@ -1028,7 +1028,7 @@ platform information. This setting strips off that info while Tor is enabled. </p><p> This setting helps Torbutton to fulfill its <a class="link" href="#setpreservation">Anonymity Set Preservation</a> requirement. -</p></div><div class="sect2" title="5.33. Automatically use an alternate search engine when presented with a Google Captcha"><div class="titlepage"><div><div><h3 class="title"><a id="id2687274"></a>5.33. Automatically use an alternate search engine when presented with a +</p></div><div class="sect2" title="5.33. Automatically use an alternate search engine when presented with a Google Captcha"><div class="titlepage"><div><div><h3 class="title"><a id="id2979797"></a>5.33. Automatically use an alternate search engine when presented with a Google Captcha</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.asked_google_captcha</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.dodge_google_captcha</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.google_redir_url</strong></span></td></tr></table><p> </p><p> @@ -1053,7 +1053,7 @@ options are duckduckgo.com, ixquick.com, bing.com, yahoo.com and scroogle.org. T encoded in the preferences <span class="command"><strong>extensions.torbutton.redir_url.[1-5]</strong></span>. -</p></div><div class="sect2" title="5.34. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2687355"></a>5.34. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.34. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2979878"></a>5.34. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.jar_certs</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.jar_ca_certs</strong></span></td></tr></table><p> </p><p> @@ -1132,7 +1132,24 @@ this functionality is considered a Torbutton security bug because cert isolation is considered a <a class="link" href="#state">State Separation</a> feature. - </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=575230" target="_top">Bug 575230 - Provide option to + </p></li><li class="listitem">Give more visibility into and control over TLS +negotiation + <p> + +There are several <a class="ulink" href="https://trac.torproject.org/projects/tor/ticket/2482" target="_top">TLS issues +impacting Torbutton security</a>. It is not clear if these should be one +Firefox bug or several, but in particular we need better control over various +aspects of TLS connections. Firefox currently provides no observer capable of +extracting TLS parameters or certificates early enough to cancel a TLS +request. We would like to be able to provide <a class="ulink" href="https://www.eff.org/https-everywhere" target="_top">HTTPS-Everywhere</a> users with +the ability to <a class="ulink" href="https://trac.torproject.org/projects/tor/wiki/HTTPSEverywhere/SSLObservator…" target="_top">have +their certificates audited</a> by a <a class="ulink" href="http://www.networknotary.org/" target="_top">Perspectives</a>-style set of +notaries. The problem with this is that the API observer points do not exist +for any Firefox addon to actually block authentication token submission over a +TLS channel, so every addon to date (including Perspectives) is actually +providing users with notification *after* their authentication tokens have +already been compromised. This obviously needs to be fixed. + </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=575230" target="_top">Bug 575230 - Provide option to reduce precision of Date()</a><p> Currently it is possible to <a class="ulink" href="http://arstechnica.com/tech-policy/news/2010/02/firm-uses-typing-cadence-to…" target="_top">fingerprint @@ -1404,13 +1421,13 @@ or complete, but it is automated and could be turned into something useful with a bit of work. </p></li></ol></div><p> - </p></div><div class="sect2" title="7.2. Multi-state testing"><div class="titlepage"><div><div><h3 class="title"><a id="id2688437"></a>7.2. Multi-state testing</h3></div></div></div><p> + </p></div><div class="sect2" title="7.2. Multi-state testing"><div class="titlepage"><div><div><h3 class="title"><a id="id2980994"></a>7.2. Multi-state testing</h3></div></div></div><p> The tests in this section are geared towards a page that would instruct the user to toggle their Tor state after the fetch and perform some operations: mouseovers, stray clicks, and potentially reloads. - </p><div class="sect3" title="Cookies and Cache Correlation"><div class="titlepage"><div><div><h4 class="title"><a id="id2688449"></a>Cookies and Cache Correlation</h4></div></div></div><p> + </p><div class="sect3" title="Cookies and Cache Correlation"><div class="titlepage"><div><div><h4 class="title"><a id="id2981006"></a>Cookies and Cache Correlation</h4></div></div></div><p> The most obvious test is to set a cookie, ask the user to toggle tor, and then have them reload the page. The cookie should no longer be set if they are using the default Torbutton settings. In addition, it is possible to leverage @@ -1418,11 +1435,11 @@ the cache to <a class="ulink" href="http://crypto.stanford.edu/sameorigin/safeca identifiers</a>. The default settings of Torbutton should also protect against these from persisting across Tor Toggle. - </p></div><div class="sect3" title="Javascript timers and event handlers"><div class="titlepage"><div><div><h4 class="title"><a id="id2688472"></a>Javascript timers and event handlers</h4></div></div></div><p> + </p></div><div class="sect3" title="Javascript timers and event handlers"><div class="titlepage"><div><div><h4 class="title"><a id="id2981029"></a>Javascript timers and event handlers</h4></div></div></div><p> Javascript can set timers and register event handlers in the hopes of fetching URLs after the user has toggled Torbutton. - </p></div><div class="sect3" title="CSS Popups and non-script Dynamic Content"><div class="titlepage"><div><div><h4 class="title"><a id="id2688484"></a>CSS Popups and non-script Dynamic Content</h4></div></div></div><p> + </p></div><div class="sect3" title="CSS Popups and non-script Dynamic Content"><div class="titlepage"><div><div><h4 class="title"><a id="id2981042"></a>CSS Popups and non-script Dynamic Content</h4></div></div></div><p> Even if Javascript is disabled, CSS is still able to <a class="ulink" href="http://www.tjkdesign.com/articles/css%20pop%20ups/" target="_top">create popup-like @@ -1447,7 +1464,7 @@ these attacks, playing with them, and reporting what you find (and potentially submitting the test cases back to be run in the standard batch of Torbutton tests. - </p><div class="sect3" title="Some suggested vectors to investigate"><div class="titlepage"><div><div><h4 class="title"><a id="id2688539"></a>Some suggested vectors to investigate</h4></div></div></div><p> + </p><div class="sect3" title="Some suggested vectors to investigate"><div class="titlepage"><div><div><h4 class="title"><a id="id2981097"></a>Some suggested vectors to investigate</h4></div></div></div><p> </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">Strange ways to register Javascript <a class="ulink" href="http://en.wikipedia.org/wiki/DOM_Events" target="_top">events</a> and <a class="ulink" href="http://www.devshed.com/c/a/JavaScript/Using-Timers-in-JavaScript/" target="_top">timeouts</a> should be verified to actually be ineffective after Tor has been toggled.</li><li class="listitem">Other ways to cause Javascript to be executed after <span class="command"><strong>javascript.enabled</strong></span> has been toggled off.</li><li class="listitem">Odd ways to attempt to load plugins. Kyle Williams has had

1 0

[torbutton/master] Add an item for TLS issues and APIs.
by mikeperry＠torproject.org 26 Mar '11

26 Mar '11

commit 09f55fbe0bc0ed2802fd1bd00790d1646ea6b64f Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Fri Mar 25 17:16:42 2011 -0700 Add an item for TLS issues and APIs. We don't have Bugzilla entries for this yet, but it should be listed. --- website/design/design.xml | 22 ++++++++++++++++++++++ 1 files changed, 22 insertions(+), 0 deletions(-) diff --git a/website/design/design.xml b/website/design/design.xml index 3f906b3..b137caf 100644 --- a/website/design/design.xml +++ b/website/design/design.xml @@ -2137,7 +2137,29 @@ feature. </para> </listitem> + <listitem>Give more visibility into and control over TLS +negotiation + <para> +There are several <ulink +url="https://trac.torproject.org/projects/tor/ticket/2482">TLS issues +impacting Torbutton security</ulink>. It is not clear if these should be one +Firefox bug or several, but in particular we need better control over various +aspects of TLS connections. Firefox currently provides no observer capable of +extracting TLS parameters or certificates early enough to cancel a TLS +request. We would like to be able to provide <ulink +url="https://www.eff.org/https-everywhere">HTTPS-Everywhere</ulink> users with +the ability to <ulink +url="https://trac.torproject.org/projects/tor/wiki/HTTPSEverywhere/SSLObservator…">have +their certificates audited</ulink> by a <ulink +url="http://www.networknotary.org/">Perspectives</ulink>-style set of +notaries. The problem with this is that the API observer points do not exist +for any Firefox addon to actually block authentication token submission over a +TLS channel, so every addon to date (including Perspectives) is actually +providing users with notification *after* their authentication tokens have +already been compromised. This obviously needs to be fixed. + </para> + </listitem> <listitem><ulink url="https://bugzilla.mozilla.org/show_bug.cgi?id=575230">Bug 575230 - Provide option to reduce precision of Date()</ulink>

1 0

[torbutton/master] Update Firefox bugs.
by mikeperry＠torproject.org 25 Mar '11

25 Mar '11

commit 9fcda9a81ac214101ac06995b70a43e07b63045f Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Fri Mar 25 16:23:30 2011 -0700 Update Firefox bugs. --- website/design/design.xml | 55 ++++++++++++++++++--------------------------- 1 files changed, 22 insertions(+), 33 deletions(-) diff --git a/website/design/design.xml b/website/design/design.xml index 22199ff..3f906b3 100644 --- a/website/design/design.xml +++ b/website/design/design.xml @@ -11,7 +11,7 @@ <address><email>mikeperry.fscked/org</email></address> </affiliation> </author> - <pubdate>Jun 28 2010</pubdate> + <pubdate>Mar 25 2011</pubdate> </articleinfo> <sect1> @@ -2070,34 +2070,6 @@ they are: </para> <orderedlist> - - <listitem><ulink url="https://bugzilla.mozilla.org/show_bug.cgi?id=429070">Bug 429070 - exposing Components.interfaces to untrusted content leaks information about installed @@ -2134,11 +2106,16 @@ provides a large amount of identifiable information</ulink> As <link linkend="fingerprinting">mentioned above</link>, a large amount of information is available from <ulink url="http://developer.mozilla.org/en/docs/DOM:window.screen">window.screen</ulink>. +The most sensative data to anonymity is actually that which is not used in +rendering - such as desktop resolution, and window decoration size. Currently, there is no way to obscure this information without Javascript -hooking. This bug is a feature request to provide some other method to change -these values. This bug interferes with Torbutton's ability to fulfill its -<link linkend="setpreservation">Anonymity Set Preservation</link> -requirement. +hooking. In addition, many of this same desktop and window decoration +resolution information is available via <ulink +url="https://developer.mozilla.org/En/CSS/Media_queries">CSS Media +Queries</ulink>, so perhaps some more lower-level rendering controls or +preferences need to be provided. These issues interfere with Torbutton's +ability to fulfill its <link linkend="setpreservation">Anonymity Set +Preservation</link> requirement. </para> </listitem> @@ -2180,6 +2157,18 @@ linkend="setpreservation">Anonymity Set Preservation</link> requirement. </para> </listitem> + <listitem><ulink +url="https://bugzilla.mozilla.org/show_bug.cgi?id=122752">SOCKS +Username/Password Support</ulink> + <para> +We need <ulink url="https://developer.mozilla.org/en/nsIProxyInfo">Firefox +APIs</ulink> or about:config settings to conrol the SOCKS Username and +Password fields. The reason why we need this support is to utilize an (as yet +unimplemented) scheme to separate Tor traffic based <ulink +url="https://gitweb.torproject.org/torspec.git/blob_plain/HEAD:/proposals/171-se…">on +SOCKS username/password</ulink>. + </para> + </listitem> <listitem><ulink url="https://bugzilla.mozilla.org/show_bug.cgi?id=409737">Bug 409737 -

1 0

[torbutton/master] Update compiled xml.
by mikeperry＠torproject.org 25 Mar '11

25 Mar '11

commit 263c6a6b3bb090c4865b1c747c62aeb27138fe06 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Fri Mar 25 16:24:57 2011 -0700 Update compiled xml. --- website/design/index.html.en | 129 +++++++++++++++++++++++------------------- 1 files changed, 70 insertions(+), 59 deletions(-) diff --git a/website/design/index.html.en b/website/design/index.html.en index b477db7..6bf094b 100644 --- a/website/design/index.html.en +++ b/website/design/index.html.en @@ -1,7 +1,7 @@ <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> -<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Torbutton Design Documentation</title><meta name="generator" content="DocBook XSL Stylesheets V1.75.2" /></head><body><div class="article" title="Torbutton Design Documentation"><div class="titlepage"><div><div><h2 class="title"><a id="design"></a>Torbutton Design Documentation</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Mike</span> <span class="surname">Perry</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:mikeperry.fscked/org">mikeperry.fscked/org</a>></code></p></div></div></div></div><div><p class="pubdate">Jun 28 2010</p></div></div><hr /></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="#id2748707">1. Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="#adversary">1.1. Adversary Model</a> </span></dt><dt><span class="sect2"><a href="#requirements">1.2. Torbutton Requirements</a></span></dt><dt><span class="sect2"><a href="#layout">1.3. Extension Layout</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2763688">2. Components</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2780976">2.1. Hooked Components</a></span></dt><dt><span class="sect2"><a href="#id2783364">2.2. New Components</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2785176">3. Chrome</a></span></dt><dd><dl><dt><span class="sect2"><a href="#browseroverlay">3.1. Browser Overlay - torbutton.xul</a></span></dt><dt><span class="sect2"><a href="#id2767819">3.2. Preferences Window - preferences.xul</a></span></dt><dt><span class="sect2"><a href="#id2760426">3.3. Other Windows</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2751510">4. Toggle Code Path</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2782046">4.1. Button Click</a></span></dt><dt>< span class="sect2"><a href="#id2784219">4.2. Proxy Update</a></span></dt><dt><span class="sect2"><a href="#id2762905">4.3. Settings Update</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2780314">5. Description of Options</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2775490">5.1. Test Settings</a></span></dt><dt><span class="sect2"><a href="#plugins">5.2. Disable plugins on Tor Usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2759665">5.3. Isolate Dynamic Content to Tor State (crucial)</a></span></dt><dt><span class="sect2"><a href="#jshooks">5.4. Hook Dangerous Javascript</a></span></dt><dt><span class="sect2"><a href="#id2769025">5.5. Resize windows to multiples of 50px during Tor usage (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2761324">5.6. Disable Updates During Tor</a></span></dt><dt><span class="sect2"><a href="#id2744982">5.7. Redirect Torbutton Updates Via Tor (recommended)</a></span></dt><dt><span c lass="sect2"><a href="#id2745026">5.8. Disable Search Suggestions during Tor (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2745065">5.9. Disable livemarks updates during Tor usage (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2745136">5.10. Block Tor/Non-Tor access to network from file:// urls (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2745208">5.11. Close all Tor/Non-Tor tabs and windows on toggle (optional)</a></span></dt><dt><span class="sect2"><a href="#id2745290">5.12. Isolate Access to History navigation to Tor state (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2745374">5.13. History Access Settings</a></span></dt><dt><span class="sect2"><a href="#id2745486">5.14. Clear History During Tor Toggle (optional)</a></span></dt><dt><span class="sect2"><a href="#id2787032">5.15. Block Password+Form saving during Tor/Non-Tor</a></span></dt><dt><span class="sect2"><a href="#id2787093">5.16. Block Tor dis k cache and clear all cache on Tor Toggle</a></span></dt><dt><span class="sect2"><a href="#id2787143">5.17. Block disk and memory cache during Tor</a></span></dt><dt><span class="sect2"><a href="#id2787196">5.18. Clear Cookies on Tor Toggle</a></span></dt><dt><span class="sect2"><a href="#id2787247">5.19. Store Non-Tor cookies in a protected jar</a></span></dt><dt><span class="sect2"><a href="#id2787303">5.20. Store both Non-Tor and Tor cookies in a protected jar (dangerous)</a></span></dt><dt><span class="sect2"><a href="#id2787342">5.21. Manage My Own Cookies (dangerous)</a></span></dt><dt><span class="sect2"><a href="#id2787357">5.22. Disable DOM Storage during Tor usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2787461">5.23. Clear HTTP Auth on Tor Toggle (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2787498">5.24. Clear cookies on Tor/Non-Tor shutdown</a></span></dt><dt><span class="sect2"><a href="#id2787554">5.25. Reload cookie ja r/clear cookies on Firefox crash</a></span></dt><dt><span class="sect2"><a href="#id2787629">5.26. On crash recovery or session restored startup, restore via: Tor, Non-Tor</a></span></dt><dt><span class="sect2"><a href="#id2787700">5.27. On normal startup, set state to: Tor, Non-Tor, Shutdown State</a></span></dt><dt><span class="sect2"><a href="#id2787759">5.28. Prevent session store from saving Non-Tor/Tor-loaded tabs</a></span></dt><dt><span class="sect2"><a href="#id2787824">5.29. Set user agent during Tor usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2787998">5.30. Spoof US English Browser</a></span></dt><dt><span class="sect2"><a href="#id2788091">5.31. Don't send referrer during Tor Usage</a></span></dt><dt><span class="sect2"><a href="#id2788132">5.32. Strip platform and language off of Google Search Box queries</a></span></dt><dt><span class="sect2"><a href="#id2788173">5.33. Automatically use an alternate search engine when presented with a -Google Captcha</a></span></dt><dt><span class="sect2"><a href="#id2788253">5.34. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)</a></span></dt></dl></dd><dt><span class="sect1"><a href="#FirefoxBugs">6. Relevant Firefox Bugs</a></span></dt><dd><dl><dt><span class="sect2"><a href="#FirefoxSecurity">6.1. Bugs impacting security</a></span></dt><dt><span class="sect2"><a href="#FirefoxWishlist">6.2. Bugs blocking functionality</a></span></dt><dt><span class="sect2"><a href="#FirefoxMiscBugs">6.3. Low Priority Bugs</a></span></dt></dl></dd><dt><span class="sect1"><a href="#TestPlan">7. Testing</a></span></dt><dd><dl><dt><span class="sect2"><a href="#SingleStateTesting">7.1. Single state testing</a></span></dt><dt><span class="sect2"><a href="#id2789303">7.2. Multi-state testing</a></span></dt><dt><span class="sect2"><a href="#HackTorbutton">7.3. Active testing (aka How to Hack Torbutton)</a></span></dt></dl></dd></dl></div><div class="sect1" title="1. Introduc tion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2748707"></a>1. Introduction</h2></div></div></div><p> +<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Torbutton Design Documentation</title><meta name="generator" content="DocBook XSL Stylesheets V1.75.2" /></head><body><div class="article" title="Torbutton Design Documentation"><div class="titlepage"><div><div><h2 class="title"><a id="design"></a>Torbutton Design Documentation</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Mike</span> <span class="surname">Perry</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:mikeperry.fscked/org">mikeperry.fscked/org</a>></code></p></div></div></div></div><div><p class="pubdate">Mar 25 2011</p></div></div><hr /></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="#id2647809">1. Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="#adversary">1.1. Adversary Model</a> </span></dt><dt><span class="sect2"><a href="#requirements">1.2. Torbutton Requirements</a></span></dt><dt><span class="sect2"><a href="#layout">1.3. Extension Layout</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2662790">2. Components</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2680078">2.1. Hooked Components</a></span></dt><dt><span class="sect2"><a href="#id2682465">2.2. New Components</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2684278">3. Chrome</a></span></dt><dd><dl><dt><span class="sect2"><a href="#browseroverlay">3.1. Browser Overlay - torbutton.xul</a></span></dt><dt><span class="sect2"><a href="#id2666921">3.2. Preferences Window - preferences.xul</a></span></dt><dt><span class="sect2"><a href="#id2659528">3.3. Other Windows</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2650612">4. Toggle Code Path</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2681148">4.1. Button Click</a></span></dt><dt>< span class="sect2"><a href="#id2683321">4.2. Proxy Update</a></span></dt><dt><span class="sect2"><a href="#id2662007">4.3. Settings Update</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2679416">5. Description of Options</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2674592">5.1. Test Settings</a></span></dt><dt><span class="sect2"><a href="#plugins">5.2. Disable plugins on Tor Usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2658766">5.3. Isolate Dynamic Content to Tor State (crucial)</a></span></dt><dt><span class="sect2"><a href="#jshooks">5.4. Hook Dangerous Javascript</a></span></dt><dt><span class="sect2"><a href="#id2668126">5.5. Resize windows to multiples of 50px during Tor usage (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2660426">5.6. Disable Updates During Tor</a></span></dt><dt><span class="sect2"><a href="#id2644084">5.7. Redirect Torbutton Updates Via Tor (recommended)</a></span></dt><dt><span c lass="sect2"><a href="#id2644128">5.8. Disable Search Suggestions during Tor (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2644167">5.9. Disable livemarks updates during Tor usage (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2644238">5.10. Block Tor/Non-Tor access to network from file:// urls (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2644310">5.11. Close all Tor/Non-Tor tabs and windows on toggle (optional)</a></span></dt><dt><span class="sect2"><a href="#id2644391">5.12. Isolate Access to History navigation to Tor state (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2644476">5.13. History Access Settings</a></span></dt><dt><span class="sect2"><a href="#id2644588">5.14. Clear History During Tor Toggle (optional)</a></span></dt><dt><span class="sect2"><a href="#id2686134">5.15. Block Password+Form saving during Tor/Non-Tor</a></span></dt><dt><span class="sect2"><a href="#id2686195">5.16. Block Tor dis k cache and clear all cache on Tor Toggle</a></span></dt><dt><span class="sect2"><a href="#id2686245">5.17. Block disk and memory cache during Tor</a></span></dt><dt><span class="sect2"><a href="#id2686298">5.18. Clear Cookies on Tor Toggle</a></span></dt><dt><span class="sect2"><a href="#id2686349">5.19. Store Non-Tor cookies in a protected jar</a></span></dt><dt><span class="sect2"><a href="#id2686405">5.20. Store both Non-Tor and Tor cookies in a protected jar (dangerous)</a></span></dt><dt><span class="sect2"><a href="#id2686444">5.21. Manage My Own Cookies (dangerous)</a></span></dt><dt><span class="sect2"><a href="#id2686459">5.22. Disable DOM Storage during Tor usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2686563">5.23. Clear HTTP Auth on Tor Toggle (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2686600">5.24. Clear cookies on Tor/Non-Tor shutdown</a></span></dt><dt><span class="sect2"><a href="#id2686655">5.25. Reload cookie ja r/clear cookies on Firefox crash</a></span></dt><dt><span class="sect2"><a href="#id2686731">5.26. On crash recovery or session restored startup, restore via: Tor, Non-Tor</a></span></dt><dt><span class="sect2"><a href="#id2686802">5.27. On normal startup, set state to: Tor, Non-Tor, Shutdown State</a></span></dt><dt><span class="sect2"><a href="#id2686861">5.28. Prevent session store from saving Non-Tor/Tor-loaded tabs</a></span></dt><dt><span class="sect2"><a href="#id2686926">5.29. Set user agent during Tor usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2687100">5.30. Spoof US English Browser</a></span></dt><dt><span class="sect2"><a href="#id2687193">5.31. Don't send referrer during Tor Usage</a></span></dt><dt><span class="sect2"><a href="#id2687234">5.32. Strip platform and language off of Google Search Box queries</a></span></dt><dt><span class="sect2"><a href="#id2687274">5.33. Automatically use an alternate search engine when presented with a +Google Captcha</a></span></dt><dt><span class="sect2"><a href="#id2687355">5.34. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)</a></span></dt></dl></dd><dt><span class="sect1"><a href="#FirefoxBugs">6. Relevant Firefox Bugs</a></span></dt><dd><dl><dt><span class="sect2"><a href="#FirefoxSecurity">6.1. Bugs impacting security</a></span></dt><dt><span class="sect2"><a href="#FirefoxWishlist">6.2. Bugs blocking functionality</a></span></dt><dt><span class="sect2"><a href="#FirefoxMiscBugs">6.3. Low Priority Bugs</a></span></dt></dl></dd><dt><span class="sect1"><a href="#TestPlan">7. Testing</a></span></dt><dd><dl><dt><span class="sect2"><a href="#SingleStateTesting">7.1. Single state testing</a></span></dt><dt><span class="sect2"><a href="#id2688437">7.2. Multi-state testing</a></span></dt><dt><span class="sect2"><a href="#HackTorbutton">7.3. Active testing (aka How to Hack Torbutton)</a></span></dt></dl></dd></dl></div><div class="sect1" title="1. Introduc tion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2647809"></a>1. Introduction</h2></div></div></div><p> This document describes the goals, operation, and testing procedures of the Torbutton Firefox extension. It is current as of Torbutton 1.2.5. @@ -232,13 +232,13 @@ obsolete and deprecated interfaces and has proved to be less than stable.</p><p>'Chrome' is a combination of XML and Javascript used to describe a window. Extensions are allowed to create 'overlays' that are 'bound' to existing XML window definitions, or they can create their own windows. The DTD for this XML -is called <a class="ulink" href="http://developer.mozilla.org/en/docs/XUL_Reference" target="_top">XUL</a>.</p></div></div><div class="sect1" title="2. Components"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2763688"></a>2. Components</h2></div></div></div><p> +is called <a class="ulink" href="http://developer.mozilla.org/en/docs/XUL_Reference" target="_top">XUL</a>.</p></div></div><div class="sect1" title="2. Components"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2662790"></a>2. Components</h2></div></div></div><p> Torbutton installs components for two purposes: hooking existing components to reimplement their interfaces; and creating new components that provide services to other pieces of the extension. - </p><div class="sect2" title="2.1. Hooked Components"><div class="titlepage"><div><div><h3 class="title"><a id="id2780976"></a>2.1. Hooked Components</h3></div></div></div><p>Torbutton makes extensive use of Contract ID hooking, and implements some + </p><div class="sect2" title="2.1. Hooked Components"><div class="titlepage"><div><div><h3 class="title"><a id="id2680078"></a>2.1. Hooked Components</h3></div></div></div><p>Torbutton makes extensive use of Contract ID hooking, and implements some of its own standalone components as well. Let's discuss the hooked components first.</p><div class="sect3" title="@mozilla.org/browser/sessionstore;1 - components/nsSessionStore36.js"><div class="titlepage"><div><div><h4 class="title"><a id="sessionstore"></a><a class="ulink" href="http://developer.mozilla.org/en/docs/nsISessionStore" target="_top">@mozilla.org/browser/sessionstore;1</a> - <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/nsSessi…" target="_top">components/nsSessionStore36.js</a></h4></div></div></div><p>These components address the <a class="link" href="#disk">Disk Avoidance</a> @@ -267,7 +267,7 @@ do not obey proxy settings, they can be manipulated to automatically connect back to arbitrary servers outside of Tor with no user intervention. Fixing this issue helps to satisfy Torbutton's <a class="link" href="#proxy">Proxy Obedience</a> Requirement. - </p></div><div class="sect3" title="@mozilla.org/browser/sessionstartup;1 - components/crash-observer.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2759851"></a><a class="ulink" href="http://lxr.mozilla.org/seamonkey/source/browser/components/sessionstore/src…" target="_top">@mozilla.org/browser/sessionstartup;1</a> - + </p></div><div class="sect3" title="@mozilla.org/browser/sessionstartup;1 - components/crash-observer.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2658953"></a><a class="ulink" href="http://lxr.mozilla.org/seamonkey/source/browser/components/sessionstore/src…" target="_top">@mozilla.org/browser/sessionstartup;1</a> - <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/crash-o…" target="_top">components/crash-observer.js</a></h4></div></div></div><p>This component wraps the Firefox Session Startup component that is in charge of <a class="ulink" href="http://developer.mozilla.org/en/docs/Session_store_API" target="_top">restoring saved sessions</a>. The wrapper's only job is to intercept the @@ -281,7 +281,7 @@ includes setting the Tor state to the one the user selected for crash recovery in the preferences window (<span class="command"><strong>extensions.torbutton.restore_tor</strong></span>), and restoring cookies for the corresponding cookie jar, if it exists.</p><p>By performing this notification, this component assists in the <a class="link" href="#proxy">Proxy Obedience</a>, and <a class="link" href="#isolation">Network Isolation</a> requirements. -</p></div><div class="sect3" title="@mozilla.org/browser/global-history;2 - components/ignore-history.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2780178"></a><a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/c…" target="_top">@mozilla.org/browser/global-history;2</a> +</p></div><div class="sect3" title="@mozilla.org/browser/global-history;2 - components/ignore-history.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2679280"></a><a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/c…" target="_top">@mozilla.org/browser/global-history;2</a> - <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/ignore-…" target="_top">components/ignore-history.js</a></h4></div></div></div><p>This component was contributed by <a class="ulink" href="http://www.collinjackson.com/" target="_top">Collin Jackson</a> as a method for defeating CSS and Javascript-based methods of history disclosure. The global-history component is what is used by Firefox to determine if a link was visited or not @@ -306,9 +306,9 @@ firing in the event the browser starts in Tor mode. This component helps satisfy the <a class="link" href="#isolation">Network Isolation</a> and <a class="link" href="#setpreservation">Anonymity Set Preservation</a> requirements. -</p></div></div><div class="sect2" title="2.2. New Components"><div class="titlepage"><div><div><h3 class="title"><a id="id2783364"></a>2.2. New Components</h3></div></div></div><p>Torbutton creates four new components that are used throughout the +</p></div></div><div class="sect2" title="2.2. New Components"><div class="titlepage"><div><div><h3 class="title"><a id="id2682465"></a>2.2. New Components</h3></div></div></div><p>Torbutton creates four new components that are used throughout the extension. These components do not hook any interfaces, nor are they used -anywhere besides Torbutton itself.</p><div class="sect3" title="@torproject.org/cookie-jar-selector;2 - components/cookie-jar-selector.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2759394"></a><a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-…" target="_top">@torproject.org/cookie-jar-selector;2 +anywhere besides Torbutton itself.</p><div class="sect3" title="@torproject.org/cookie-jar-selector;2 - components/cookie-jar-selector.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2658495"></a><a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-…" target="_top">@torproject.org/cookie-jar-selector;2 - components/cookie-jar-selector.js</a></h4></div></div></div><p>The cookie jar selector (also based on code from <a class="ulink" href="http://www.collinjackson.com/" target="_top">Collin Jackson</a>) is used by the Torbutton chrome to switch between Tor and Non-Tor cookies. Its operations are simple: sync cookies to disk, then @@ -317,7 +317,7 @@ move the current cookies.txt file to the appropriate backup location into place.</p><p> This component helps to address the <a class="link" href="#state">State Isolation</a> requirement of Torbutton. -</p></div><div class="sect3" title="@torproject.org/torbutton-logger;1 - components/torbutton-logger.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2783944"></a><a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/torbutt…" target="_top">@torproject.org/torbutton-logger;1 +</p></div><div class="sect3" title="@torproject.org/torbutton-logger;1 - components/torbutton-logger.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2683046"></a><a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/torbutt…" target="_top">@torproject.org/torbutton-logger;1 - components/torbutton-logger.js</a></h4></div></div></div><p>The torbutton logger component allows on-the-fly redirection of torbutton logging messages to either Firefox stderr (<span class="command"><strong>extensions.torbutton.logmethod=0</strong></span>), the Javascript error console @@ -369,7 +369,7 @@ reason are not passed to the Firefox content policy itself (see Firefox Bugs </p><p> This helps to fulfill both the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> and the <a class="link" href="#undiscoverability">Tor Undiscoverability</a> requirements of -Torbutton.</p></div></div></div><div class="sect1" title="3. Chrome"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2785176"></a>3. Chrome</h2></div></div></div><p>The chrome is where all the torbutton graphical elements and windows are +Torbutton.</p></div></div></div><div class="sect1" title="3. Chrome"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2684278"></a>3. Chrome</h2></div></div></div><p>The chrome is where all the torbutton graphical elements and windows are located. Each window is described as an <a class="ulink" href="http://developer.mozilla.org/en/docs/XUL_Reference" target="_top">XML file</a>, with zero or more Javascript files attached. The scope of these Javascript files is their containing window.</p><div class="sect2" title="3.1. Browser Overlay - torbutton.xul"><div class="titlepage"><div><div><h3 class="title"><a id="browseroverlay"></a>3.1. Browser Overlay - <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/tor…" target="_top">torbutton.xul</a></h3></div></div></div><p>The browser overlay, torbutton.xul, defines the toolbar button, the status @@ -496,9 +496,9 @@ enabled. This helps Torbutton fulfill its <a class="link" href="#disk">Disk Avoidance</a> and <a class="link" href="#state">State Separation</a> requirements. - </p></li></ol></div></div><div class="sect2" title="3.2. Preferences Window - preferences.xul"><div class="titlepage"><div><div><h3 class="title"><a id="id2767819"></a>3.2. Preferences Window - <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/pre…" target="_top">preferences.xul</a></h3></div></div></div><p>The preferences window of course lays out the Torbutton preferences, with -handlers located in <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/pre…" target="_top">chrome/content/preferences.js</a>.</p></div><div class="sect2" title="3.3. Other Windows"><div class="titlepage"><div><div><h3 class="title"><a id="id2760426"></a>3.3. Other Windows</h3></div></div></div><p>There are additional windows that describe popups for right clicking on -the status bar, the toolbutton, and the about page.</p></div></div><div class="sect1" title="4. Toggle Code Path"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2751510"></a>4. Toggle Code Path</h2></div></div></div><p> + </p></li></ol></div></div><div class="sect2" title="3.2. Preferences Window - preferences.xul"><div class="titlepage"><div><div><h3 class="title"><a id="id2666921"></a>3.2. Preferences Window - <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/pre…" target="_top">preferences.xul</a></h3></div></div></div><p>The preferences window of course lays out the Torbutton preferences, with +handlers located in <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/pre…" target="_top">chrome/content/preferences.js</a>.</p></div><div class="sect2" title="3.3. Other Windows"><div class="titlepage"><div><div><h3 class="title"><a id="id2659528"></a>3.3. Other Windows</h3></div></div></div><p>There are additional windows that describe popups for right clicking on +the status bar, the toolbutton, and the about page.</p></div></div><div class="sect1" title="4. Toggle Code Path"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2650612"></a>4. Toggle Code Path</h2></div></div></div><p> The act of toggling is connected to <code class="function">torbutton_toggle()</code> via the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/tor…" target="_top">torbutton.xul</a> @@ -519,7 +519,7 @@ conditions and leakage, especially with <a class="ulink" href="https://bugzilla. 409737</a> unfixed. The content policy does not allow any network activity whatsoever during this three stage transition. - </p><div class="sect2" title="4.1. Button Click"><div class="titlepage"><div><div><h3 class="title"><a id="id2782046"></a>4.1. Button Click</h3></div></div></div><p> + </p><div class="sect2" title="4.1. Button Click"><div class="titlepage"><div><div><h3 class="title"><a id="id2681148"></a>4.1. Button Click</h3></div></div></div><p> This is the first step in the toggling process. When the user clicks the toggle button or the toolbar, <code class="function">torbutton_toggle()</code> is @@ -532,7 +532,7 @@ observer</a> <span class="command"><strong>torbutton_unique_pref_observer</strong></span> to perform the rest of the toggle. - </p></div><div class="sect2" title="4.2. Proxy Update"><div class="titlepage"><div><div><h3 class="title"><a id="id2784219"></a>4.2. Proxy Update</h3></div></div></div><p> + </p></div><div class="sect2" title="4.2. Proxy Update"><div class="titlepage"><div><div><h3 class="title"><a id="id2683321"></a>4.2. Proxy Update</h3></div></div></div><p> When Torbutton receives any proxy change notifications via its <span class="command"><strong>torbutton_unique_pref_observer</strong></span>, it calls @@ -547,7 +547,7 @@ value. This is decoupled from the button click functionalty via the pref observer so that other addons (such as SwitchProxy) can switch the proxy settings between multiple proxies. - </p></div><div class="sect2" title="4.3. Settings Update"><div class="titlepage"><div><div><h3 class="title"><a id="id2762905"></a>4.3. Settings Update</h3></div></div></div><p> + </p></div><div class="sect2" title="4.3. Settings Update"><div class="titlepage"><div><div><h3 class="title"><a id="id2662007"></a>4.3. Settings Update</h3></div></div></div><p> The next stage is also handled by <code class="function">torbutton_update_status()</code>. This function sets scores of @@ -558,10 +558,10 @@ end of its work, it sets <span class="command"><strong>extensions.torbutton.settings_applied</strong></span>, which signifies the completion of the toggle operation to the <a class="link" href="#contentpolicy" title="@torproject.org/cssblocker;1 - components/cssblocker.js">content policy</a>. - </p></div></div><div class="sect1" title="5. Description of Options"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2780314"></a>5. Description of Options</h2></div></div></div><p>This section provides a detailed description of Torbutton's options. Each + </p></div></div><div class="sect1" title="5. Description of Options"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2679416"></a>5. Description of Options</h2></div></div></div><p>This section provides a detailed description of Torbutton's options. Each option is presented as the string from the preferences window, a summary, the preferences it touches, and the effect this has on the components, chrome, and -browser properties.</p><div class="sect2" title="5.1. Test Settings"><div class="titlepage"><div><div><h3 class="title"><a id="id2775490"></a>5.1. Test Settings</h3></div></div></div><p> +browser properties.</p><div class="sect2" title="5.1. Test Settings"><div class="titlepage"><div><div><h3 class="title"><a id="id2674592"></a>5.1. Test Settings</h3></div></div></div><p> This button under the Proxy Settings tab provides a way to verify that the proxy settings are correct, and actually do route through the Tor network. It performs this check by issuing an <a class="ulink" href="http://developer.mozilla.org/en/docs/XMLHttpRequest" target="_top">XMLHTTPRequest</a> @@ -620,7 +620,7 @@ all this and the plugin managed to find some way to load. Since most plugins completely ignore browser proxy settings, the actions performed by this setting are crucial to satisfying the <a class="link" href="#proxy">Proxy Obedience</a> requirement. - </p></div><div class="sect2" title="5.3. Isolate Dynamic Content to Tor State (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2759665"></a>5.3. Isolate Dynamic Content to Tor State (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.isolate_content</strong></span></p><p>Enabling this preference is what enables the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cssbloc…" target="_top">@torproject.org/cssblocker;1</a> content policy + </p></div><div class="sect2" title="5.3. Isolate Dynamic Content to Tor State (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2658766"></a>5.3. Isolate Dynamic Content to Tor State (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.isolate_content</strong></span></p><p>Enabling this preference is what enables the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cssbloc…" target="_top">@torproject.org/cssblocker;1</a> content policy mentioned above, and causes it to block content load attempts in pages an opposite Tor state from the current state. Freshly loaded <a class="ulink" href="https://developer.mozilla.org/en/XUL/tabbrowser" target="_top">browser tabs</a> are tagged @@ -672,7 +672,7 @@ We are still looking for a workaround as of Torbutton 1.2.5. -</p></div><div class="sect2" title="5.5. Resize windows to multiples of 50px during Tor usage (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2769025"></a>5.5. Resize windows to multiples of 50px during Tor usage (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.resize_windows</strong></span></p><p> +</p></div><div class="sect2" title="5.5. Resize windows to multiples of 50px during Tor usage (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2668126"></a>5.5. Resize windows to multiples of 50px during Tor usage (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.resize_windows</strong></span></p><p> This option drastically cuts down on the number of distinct anonymity sets that divide the Tor web userbase. Without this setting, the dimensions for a @@ -707,7 +707,7 @@ infer toolbar size/presence by the distance to the nearest 50 pixel roundoff). </p><p> This setting helps to meet the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> requirements. -</p></div><div class="sect2" title="5.6. Disable Updates During Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2761324"></a>5.6. Disable Updates During Tor</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_updates</strong></span></p><p>This setting causes Torbutton to disable the four <a class="ulink" href="http://wiki.mozilla.org/Update:Users/Checking_For_Updates#Preference_Contro…" target="_top">Firefox +</p></div><div class="sect2" title="5.6. Disable Updates During Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2660426"></a>5.6. Disable Updates During Tor</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_updates</strong></span></p><p>This setting causes Torbutton to disable the four <a class="ulink" href="http://wiki.mozilla.org/Update:Users/Checking_For_Updates#Preference_Contro…" target="_top">Firefox update settings</a> during Tor usage: <span class="command"><strong>extensions.update.enabled</strong></span>, <span class="command"><strong>app.update.enabled</strong></span>, @@ -717,7 +717,7 @@ update settings</a> during Tor checking for search plugin updates while Tor is enabled. </p><p> This setting satisfies the <a class="link" href="#updates">Update Safety</a> requirement. -</p></div><div class="sect2" title="5.7. Redirect Torbutton Updates Via Tor (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2744982"></a>5.7. Redirect Torbutton Updates Via Tor (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.update_torbutton_via_tor</strong></span></p><p>This setting causes Torbutton to install an +</p></div><div class="sect2" title="5.7. Redirect Torbutton Updates Via Tor (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2644084"></a>5.7. Redirect Torbutton Updates Via Tor (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.update_torbutton_via_tor</strong></span></p><p>This setting causes Torbutton to install an <a class="ulink" href="https://developer.mozilla.org/en/nsIProtocolProxyFilter" target="_top">nsIProtocolProxyFilter</a> in order to redirect all version update checks and Torbutton update downloads @@ -726,7 +726,7 @@ concerns about data retention done by <a class="ulink" href="https://www.addons. help censored users meet the <a class="link" href="#undiscoverability">Tor Undiscoverability</a> requirement. - </p></div><div class="sect2" title="5.8. Disable Search Suggestions during Tor (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2745026"></a>5.8. Disable Search Suggestions during Tor (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_search</strong></span></p><p> + </p></div><div class="sect2" title="5.8. Disable Search Suggestions during Tor (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2644128"></a>5.8. Disable Search Suggestions during Tor (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_search</strong></span></p><p> This setting causes Torbutton to disable <a class="ulink" href="http://kb.mozillazine.org/Browser.search.suggest.enabled" target="_top"><span class="command"><strong>browser.search.suggest.enabled</strong></span></a> during Tor usage. This governs if you get Google search suggestions during Tor @@ -737,7 +737,7 @@ this is recommended to be disabled. While this setting doesn't satisfy any Torbutton requirements, the fact that cookies are transmitted for partially typed queries does not seem desirable for Tor usage. -</p></div><div class="sect2" title="5.9. Disable livemarks updates during Tor usage (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2745065"></a>5.9. Disable livemarks updates during Tor usage (recommended)</h3></div></div></div><p>Option: +</p></div><div class="sect2" title="5.9. Disable livemarks updates during Tor usage (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2644167"></a>5.9. Disable livemarks updates during Tor usage (recommended)</h3></div></div></div><p>Option: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.disable_livemarks</strong></span></td></tr></table><p> </p><p> This option causes Torbutton to prevent Firefox from loading <a class="ulink" href="http://www.mozilla.com/firefox/livebookmarks.html" target="_top">Livemarks</a> during @@ -751,7 +751,7 @@ service</a> when Tor is enabled. This helps satisfy the <a class="link" href="#isolation">Network Isolation</a> and <a class="link" href="#setpreservation">Anonymity Set Preservation</a> requirements. -</p></div><div class="sect2" title="5.10. Block Tor/Non-Tor access to network from file:// urls (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2745136"></a>5.10. Block Tor/Non-Tor access to network from file:// urls (recommended)</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.10. Block Tor/Non-Tor access to network from file:// urls (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2644238"></a>5.10. Block Tor/Non-Tor access to network from file:// urls (recommended)</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.block_tor_file_net</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_nontor_file_net</strong></span></td></tr></table><p> </p><p> @@ -771,7 +771,7 @@ Isolation</a> requirement, by preventing file urls from executing network operations in opposite Tor states. Also, allowing pages to submit arbitrary files to arbitrary sites just generally seems like a bad idea. -</p></div><div class="sect2" title="5.11. Close all Tor/Non-Tor tabs and windows on toggle (optional)"><div class="titlepage"><div><div><h3 class="title"><a id="id2745208"></a>5.11. Close all Tor/Non-Tor tabs and windows on toggle (optional)</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.11. Close all Tor/Non-Tor tabs and windows on toggle (optional)"><div class="titlepage"><div><div><h3 class="title"><a id="id2644310"></a>5.11. Close all Tor/Non-Tor tabs and windows on toggle (optional)</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.close_nontor</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.close_tor</strong></span></td></tr></table><p> </p><p> @@ -795,7 +795,7 @@ out longer than necessary. While this setting doesn't satisfy any Torbutton requirements, the fact that cookies are transmitted for partially typed queries does not seem desirable for Tor usage. -</p></div><div class="sect2" title="5.12. Isolate Access to History navigation to Tor state (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2745290"></a>5.12. Isolate Access to History navigation to Tor state (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.block_js_history</strong></span></p><p> +</p></div><div class="sect2" title="5.12. Isolate Access to History navigation to Tor state (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2644391"></a>5.12. Isolate Access to History navigation to Tor state (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.block_js_history</strong></span></p><p> This setting determines if Torbutton installs an <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsISHistoryListen…" target="_top">nsISHistoryListener</a> attached to the <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsISHistory" target="_top">sessionHistory</a> of of each browser's <a class="ulink" href="https://developer.mozilla.org/en/XUL%3aProperty%3awebNavigation" target="_top">webNavigatator</a>. @@ -823,7 +823,7 @@ This setting helps to fulfill Torbutton's <a class="link" href="#state">State Separation</a> and (until Bug 409737 is fixed) <a class="link" href="#isolation">Network Isolation</a> requirements. - </p></div><div class="sect2" title="5.13. History Access Settings"><div class="titlepage"><div><div><h3 class="title"><a id="id2745374"></a>5.13. History Access Settings</h3></div></div></div><p>Options: + </p></div><div class="sect2" title="5.13. History Access Settings"><div class="titlepage"><div><div><h3 class="title"><a id="id2644476"></a>5.13. History Access Settings</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.block_thread</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_nthread</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_thwrite</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_nthwrite</strong></span></td></tr></table><p> </p><p>These four settings govern the behavior of the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/ignore-…" target="_top">components/ignore-history.js</a> history blocker component mentioned above. By hooking the browser's view of @@ -838,12 +838,12 @@ Database</a> and the older Firefox 2 mechanisms. </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements. -</p></div><div class="sect2" title="5.14. Clear History During Tor Toggle (optional)"><div class="titlepage"><div><div><h3 class="title"><a id="id2745486"></a>5.14. Clear History During Tor Toggle (optional)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_history</strong></span></p><p>This setting governs if Torbutton calls +</p></div><div class="sect2" title="5.14. Clear History During Tor Toggle (optional)"><div class="titlepage"><div><div><h3 class="title"><a id="id2644588"></a>5.14. Clear History During Tor Toggle (optional)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_history</strong></span></p><p>This setting governs if Torbutton calls <a class="ulink" href="https://developer.mozilla.org/en/nsIBrowserHistory#removeAllPages.28.29" target="_top">nsIBrowserHistory.removeAllPages</a> and <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsISHistory" target="_top">nsISHistory.PurgeHistory</a> for each tab on Tor toggle.</p><p> This setting is an optional way to help satisfy the <a class="link" href="#state">State Separation</a> requirement. -</p></div><div class="sect2" title="5.15. Block Password+Form saving during Tor/Non-Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2787032"></a>5.15. Block Password+Form saving during Tor/Non-Tor</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.15. Block Password+Form saving during Tor/Non-Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2686134"></a>5.15. Block Password+Form saving during Tor/Non-Tor</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.block_tforms</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_ntforms</strong></span></td></tr></table><p> </p><p>These settings govern if Torbutton disables <span class="command"><strong>browser.formfill.enable</strong></span> @@ -852,19 +852,19 @@ Since form fields can be read at any time by Javascript, this setting is a lot more important than it seems. </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements. -</p></div><div class="sect2" title="5.16. Block Tor disk cache and clear all cache on Tor Toggle"><div class="titlepage"><div><div><h3 class="title"><a id="id2787093"></a>5.16. Block Tor disk cache and clear all cache on Tor Toggle</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_cache</strong></span> +</p></div><div class="sect2" title="5.16. Block Tor disk cache and clear all cache on Tor Toggle"><div class="titlepage"><div><div><h3 class="title"><a id="id2686195"></a>5.16. Block Tor disk cache and clear all cache on Tor Toggle</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_cache</strong></span> </p><p>This option causes Torbutton to call <a class="ulink" href="https://developer.mozilla.org/en/nsICacheService#evictEntries.28.29" target="_top">nsICacheService.evictEntries(0)</a> on Tor toggle to remove all entries from the cache. In addition, this setting causes Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Browser.cache.disk.enable" target="_top">browser.cache.disk.enable</a> to false. </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements. -</p></div><div class="sect2" title="5.17. Block disk and memory cache during Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2787143"></a>5.17. Block disk and memory cache during Tor</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.block_cache</strong></span></p><p>This setting +</p></div><div class="sect2" title="5.17. Block disk and memory cache during Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2686245"></a>5.17. Block disk and memory cache during Tor</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.block_cache</strong></span></p><p>This setting causes Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Browser.cache.memory.enable" target="_top">browser.cache.memory.enable</a>, <a class="ulink" href="http://kb.mozillazine.org/Browser.cache.disk.enable" target="_top">browser.cache.disk.enable</a> and <a class="ulink" href="http://kb.mozillazine.org/Network.http.use-cache" target="_top">network.http.use-cache</a> to false during tor usage. </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements. -</p></div><div class="sect2" title="5.18. Clear Cookies on Tor Toggle"><div class="titlepage"><div><div><h3 class="title"><a id="id2787196"></a>5.18. Clear Cookies on Tor Toggle</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_cookies</strong></span> +</p></div><div class="sect2" title="5.18. Clear Cookies on Tor Toggle"><div class="titlepage"><div><div><h3 class="title"><a id="id2686298"></a>5.18. Clear Cookies on Tor Toggle</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_cookies</strong></span> </p><p> This setting causes Torbutton to call <a class="ulink" href="https://developer.mozilla.org/en/nsICookieManager#removeAll.28.29" target="_top">nsICookieManager.removeAll()</a> on @@ -874,7 +874,7 @@ which prevents them from being written to disk. </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements. -</p></div><div class="sect2" title="5.19. Store Non-Tor cookies in a protected jar"><div class="titlepage"><div><div><h3 class="title"><a id="id2787247"></a>5.19. Store Non-Tor cookies in a protected jar</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.cookie_jars</strong></span> +</p></div><div class="sect2" title="5.19. Store Non-Tor cookies in a protected jar"><div class="titlepage"><div><div><h3 class="title"><a id="id2686349"></a>5.19. Store Non-Tor cookies in a protected jar</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.cookie_jars</strong></span> </p><p> This setting causes Torbutton to use <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-…" target="_top">@torproject.org/cookie-jar-selector;2</a> to store @@ -887,15 +887,15 @@ which prevents them from being written to disk. </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements. -</p></div><div class="sect2" title="5.20. Store both Non-Tor and Tor cookies in a protected jar (dangerous)"><div class="titlepage"><div><div><h3 class="title"><a id="id2787303"></a>5.20. Store both Non-Tor and Tor cookies in a protected jar (dangerous)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.dual_cookie_jars</strong></span> +</p></div><div class="sect2" title="5.20. Store both Non-Tor and Tor cookies in a protected jar (dangerous)"><div class="titlepage"><div><div><h3 class="title"><a id="id2686405"></a>5.20. Store both Non-Tor and Tor cookies in a protected jar (dangerous)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.dual_cookie_jars</strong></span> </p><p> This setting causes Torbutton to use <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-…" target="_top">@torproject.org/cookie-jar-selector;2</a> to store both Tor and Non-Tor cookies into protected jars. </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement. -</p></div><div class="sect2" title="5.21. Manage My Own Cookies (dangerous)"><div class="titlepage"><div><div><h3 class="title"><a id="id2787342"></a>5.21. Manage My Own Cookies (dangerous)</h3></div></div></div><p>Options: None</p><p>This setting disables all Torbutton cookie handling by setting the above -cookie prefs all to false.</p></div><div class="sect2" title="5.22. Disable DOM Storage during Tor usage (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2787357"></a>5.22. Disable DOM Storage during Tor usage (crucial)</h3></div></div></div><div class="sect2" title="5.22.1. Do not write Tor/Non-Tor cookies to disk"><div class="titlepage"><div><div><h3 class="title"><a id="id2787359"></a>5.22.1. Do not write Tor/Non-Tor cookies to disk</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.21. Manage My Own Cookies (dangerous)"><div class="titlepage"><div><div><h3 class="title"><a id="id2686444"></a>5.21. Manage My Own Cookies (dangerous)</h3></div></div></div><p>Options: None</p><p>This setting disables all Torbutton cookie handling by setting the above +cookie prefs all to false.</p></div><div class="sect2" title="5.22. Disable DOM Storage during Tor usage (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2686459"></a>5.22. Disable DOM Storage during Tor usage (crucial)</h3></div></div></div><div class="sect2" title="5.22.1. Do not write Tor/Non-Tor cookies to disk"><div class="titlepage"><div><div><h3 class="title"><a id="id2686461"></a>5.22.1. Do not write Tor/Non-Tor cookies to disk</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.tor_memory_jar</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.nontor_memory_jar</strong></span></td></tr></table><p> </p><p> These settings (contributed by arno) cause Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Network.cookie.lifetimePolicy" target="_top">network.cookie.lifetimePolicy</a> @@ -915,13 +915,13 @@ usage to prevent <a class="ulink" href="http://developer.mozilla.org/en/docs/DOM:Storage" target="_top">DOM Storage</a> from being used to store persistent information across Tor states.</p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement. -</p></div><div class="sect2" title="5.23. Clear HTTP Auth on Tor Toggle (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2787461"></a>5.23. Clear HTTP Auth on Tor Toggle (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_http_auth</strong></span> +</p></div><div class="sect2" title="5.23. Clear HTTP Auth on Tor Toggle (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2686563"></a>5.23. Clear HTTP Auth on Tor Toggle (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_http_auth</strong></span> </p><p> This setting causes Torbutton to call <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsIHttpAuthManager" target="_top">nsIHttpAuthManager.clearAll()</a> every time Tor is toggled. </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement. -</p></div><div class="sect2" title="5.24. Clear cookies on Tor/Non-Tor shutdown"><div class="titlepage"><div><div><h3 class="title"><a id="id2787498"></a>5.24. Clear cookies on Tor/Non-Tor shutdown</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.shutdown_method</strong></span> +</p></div><div class="sect2" title="5.24. Clear cookies on Tor/Non-Tor shutdown"><div class="titlepage"><div><div><h3 class="title"><a id="id2686600"></a>5.24. Clear cookies on Tor/Non-Tor shutdown</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.shutdown_method</strong></span> </p><p> This option variable can actually take 3 values: 0, 1, and 2. 0 means no cookie clearing, 1 means clear only during Tor-enabled shutdown, and 2 means clear for both Tor and Non-Tor shutdown. When set to 1 or 2, Torbutton listens @@ -929,7 +929,7 @@ for the <a class="ulink" href="http://developer.mozilla.org/en/docs/Observer_Not <code class="function">https://git.torproject.org/checkout/torbutton/master/src/components/crash-o…</code> and use <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-…" target="_top">@torproject.org/cookie-jar-selector;2</a> to clear out all cookies and all cookie jars upon shutdown. </p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement. -</p></div><div class="sect2" title="5.25. Reload cookie jar/clear cookies on Firefox crash"><div class="titlepage"><div><div><h3 class="title"><a id="id2787554"></a>5.25. Reload cookie jar/clear cookies on Firefox crash</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.25. Reload cookie jar/clear cookies on Firefox crash"><div class="titlepage"><div><div><h3 class="title"><a id="id2686655"></a>5.25. Reload cookie jar/clear cookies on Firefox crash</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.reload_crashed_jar</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.crashed</strong></span></td></tr></table><p> </p><p>This is no longer a user visible option, and is enabled by default. In the event of a crash, the Torbutton <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/crash-o…" target="_top">components/crash-observer.js</a> @@ -941,7 +941,7 @@ the chrome that listens for this update), and Torbutton will load the component.</p><p> This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement in the event of Firefox crashes. -</p></div><div class="sect2" title="5.26. On crash recovery or session restored startup, restore via: Tor, Non-Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2787629"></a>5.26. On crash recovery or session restored startup, restore via: Tor, Non-Tor</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.26. On crash recovery or session restored startup, restore via: Tor, Non-Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2686731"></a>5.26. On crash recovery or session restored startup, restore via: Tor, Non-Tor</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.restore_tor</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.crashed</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.normal_exit</strong></span></td></tr></table><p> </p><p>This option works with the Torbutton <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/crash-o…" target="_top">crash-observer.js</a> to set the Tor state after a crash is detected (via the @@ -957,7 +957,7 @@ setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement in the event of Firefox crashes by ensuring all cookies, settings and saved sessions are reloaded from a fixed Tor state. -</p></div><div class="sect2" title="5.27. On normal startup, set state to: Tor, Non-Tor, Shutdown State"><div class="titlepage"><div><div><h3 class="title"><a id="id2787700"></a>5.27. On normal startup, set state to: Tor, Non-Tor, Shutdown State</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.27. On normal startup, set state to: Tor, Non-Tor, Shutdown State"><div class="titlepage"><div><div><h3 class="title"><a id="id2686802"></a>5.27. On normal startup, set state to: Tor, Non-Tor, Shutdown State</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.startup_state</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.noncrashed</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.normal_exit</strong></span></td></tr></table><p> </p><p>This option also works with the Torbutton <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/crash-o…" target="_top">crash-observer.js</a> to set the Tor state after a normal startup is detected (via the @@ -967,7 +967,7 @@ false positives extensions.torbutton.normal_exit in torbutton_uninstall_observer() during Firefox exit and checks this value as well during startup. -</p></div><div class="sect2" title="5.28. Prevent session store from saving Non-Tor/Tor-loaded tabs"><div class="titlepage"><div><div><h3 class="title"><a id="id2787759"></a>5.28. Prevent session store from saving Non-Tor/Tor-loaded tabs</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.28. Prevent session store from saving Non-Tor/Tor-loaded tabs"><div class="titlepage"><div><div><h3 class="title"><a id="id2686861"></a>5.28. Prevent session store from saving Non-Tor/Tor-loaded tabs</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.nonontor_sessionstore</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.notor_sessionstore</strong></span></td></tr></table><p> </p><p>If these options are enabled, the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/nsSessi…" target="_top">replacement nsSessionStore.js</a> component checks the <span class="command"><strong>__tb_tor_fetched</strong></span> tag of tabs before writing them @@ -977,7 +977,7 @@ This setting helps to satisfy the <a class="link" href="#disk">Disk Avoidance</a requirement, and also helps to satisfy the <a class="link" href="#state">State Separation</a> requirement in the event of Firefox crashes. -</p></div><div class="sect2" title="5.29. Set user agent during Tor usage (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2787824"></a>5.29. Set user agent during Tor usage (crucial)</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.29. Set user agent during Tor usage (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2686926"></a>5.29. Set user agent during Tor usage (crucial)</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.set_uagent</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.platform_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.oscpu_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.buildID_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.productsub_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.appname_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.appversion_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.useragent_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.useragent_vendor</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.useragent_vendorSub</strong></span></td></tr></table><p> </p><p>On face, user agent switching appears to be straight-forward in Firefox. It provides several options for controlling the browser user agent string: @@ -1001,7 +1001,7 @@ certain resource:// files</a>. These cases are handled by Torbutton's </p><p> This setting helps to satisfy the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> requirement. -</p></div><div class="sect2" title="5.30. Spoof US English Browser"><div class="titlepage"><div><div><h3 class="title"><a id="id2787998"></a>5.30. Spoof US English Browser</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.30. Spoof US English Browser"><div class="titlepage"><div><div><h3 class="title"><a id="id2687100"></a>5.30. Spoof US English Browser</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.spoof_english</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.spoof_charset</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.spoof_language</strong></span></td></tr></table><p> </p><p> This option causes Torbutton to set <span class="command"><strong>general.useragent.locale</strong></span> @@ -1012,13 +1012,13 @@ This setting helps to satisfy the <a class="link" href="#setpreservation">Anonym well as hooking <span class="command"><strong>navigator.language</strong></span> via its <a class="link" href="#jshooks" title="5.4. Hook Dangerous Javascript">javascript hooks</a>. </p><p> This setting helps to satisfy the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> and <a class="link" href="#location">Location Neutrality</a> requirements. -</p></div><div class="sect2" title="5.31. Don't send referrer during Tor Usage"><div class="titlepage"><div><div><h3 class="title"><a id="id2788091"></a>5.31. Don't send referrer during Tor Usage</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.disable_referer</strong></span> +</p></div><div class="sect2" title="5.31. Don't send referrer during Tor Usage"><div class="titlepage"><div><div><h3 class="title"><a id="id2687193"></a>5.31. Don't send referrer during Tor Usage</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.disable_referer</strong></span> </p><p> This option causes Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Network.http.sendSecureXSiteReferrer" target="_top">network.http.sendSecureXSiteReferrer</a> and <a class="ulink" href="http://kb.mozillazine.org/Network.http.sendRefererHeader" target="_top">network.http.sendRefererHeader</a> during Tor usage.</p><p> This setting also does not directly satisfy any Torbutton requirement, but some may desire to mask their referrer for general privacy concerns. -</p></div><div class="sect2" title="5.32. Strip platform and language off of Google Search Box queries"><div class="titlepage"><div><div><h3 class="title"><a id="id2788132"></a>5.32. Strip platform and language off of Google Search Box queries</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.fix_google_srch</strong></span> +</p></div><div class="sect2" title="5.32. Strip platform and language off of Google Search Box queries"><div class="titlepage"><div><div><h3 class="title"><a id="id2687234"></a>5.32. Strip platform and language off of Google Search Box queries</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.fix_google_srch</strong></span> </p><p> This option causes Torbutton to use the <a class="ulink" href="https://wiki.mozilla.org/Search_Service:API" target="_top">@mozilla.org/browser/search-service;1</a> @@ -1028,7 +1028,7 @@ platform information. This setting strips off that info while Tor is enabled. </p><p> This setting helps Torbutton to fulfill its <a class="link" href="#setpreservation">Anonymity Set Preservation</a> requirement. -</p></div><div class="sect2" title="5.33. Automatically use an alternate search engine when presented with a Google Captcha"><div class="titlepage"><div><div><h3 class="title"><a id="id2788173"></a>5.33. Automatically use an alternate search engine when presented with a +</p></div><div class="sect2" title="5.33. Automatically use an alternate search engine when presented with a Google Captcha"><div class="titlepage"><div><div><h3 class="title"><a id="id2687274"></a>5.33. Automatically use an alternate search engine when presented with a Google Captcha</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.asked_google_captcha</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.dodge_google_captcha</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.google_redir_url</strong></span></td></tr></table><p> </p><p> @@ -1053,7 +1053,7 @@ options are duckduckgo.com, ixquick.com, bing.com, yahoo.com and scroogle.org. T encoded in the preferences <span class="command"><strong>extensions.torbutton.redir_url.[1-5]</strong></span>. -</p></div><div class="sect2" title="5.34. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2788253"></a>5.34. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)</h3></div></div></div><p>Options: +</p></div><div class="sect2" title="5.34. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2687355"></a>5.34. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)</h3></div></div></div><p>Options: </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.jar_certs</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.jar_ca_certs</strong></span></td></tr></table><p> </p><p> @@ -1108,11 +1108,15 @@ provides a large amount of identifiable information</a><p> As <a class="link" href="#fingerprinting">mentioned above</a>, a large amount of information is available from <a class="ulink" href="http://developer.mozilla.org/en/docs/DOM:window.screen" target="_top">window.screen</a>. +The most sensative data to anonymity is actually that which is not used in +rendering - such as desktop resolution, and window decoration size. Currently, there is no way to obscure this information without Javascript -hooking. This bug is a feature request to provide some other method to change -these values. This bug interferes with Torbutton's ability to fulfill its -<a class="link" href="#setpreservation">Anonymity Set Preservation</a> -requirement. +hooking. In addition, many of this same desktop and window decoration +resolution information is available via <a class="ulink" href="https://developer.mozilla.org/En/CSS/Media_queries" target="_top">CSS Media +Queries</a>, so perhaps some more lower-level rendering controls or +preferences need to be provided. These issues interfere with Torbutton's +ability to fulfill its <a class="link" href="#setpreservation">Anonymity Set +Preservation</a> requirement. </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=435159" target="_top">Bug 435159 - nsNSSCertificateDB::DeleteCertificate has race conditions</a><p> @@ -1141,7 +1145,14 @@ precision timer can still be used to fingerprint aspects of a browser's javascript engine and processor, and apparently also a user's typing cadence. This bug hinders Torbutton's ability to satisfy its <a class="link" href="#setpreservation">Anonymity Set Preservation</a> requirement. - </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=409737" target="_top">Bug 409737 - + </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=122752" target="_top">SOCKS +Username/Password Support</a><p> +We need <a class="ulink" href="https://developer.mozilla.org/en/nsIProxyInfo" target="_top">Firefox +APIs</a> or about:config settings to conrol the SOCKS Username and +Password fields. The reason why we need this support is to utilize an (as yet +unimplemented) scheme to separate Tor traffic based <a class="ulink" href="https://gitweb.torproject.org/torspec.git/blob_plain/HEAD:/proposals/171-se…" target="_top">on +SOCKS username/password</a>. + </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=409737" target="_top">Bug 409737 - javascript.enabled and docShell.allowJavascript do not disable all event handlers</a><p> @@ -1393,13 +1404,13 @@ or complete, but it is automated and could be turned into something useful with a bit of work. </p></li></ol></div><p> - </p></div><div class="sect2" title="7.2. Multi-state testing"><div class="titlepage"><div><div><h3 class="title"><a id="id2789303"></a>7.2. Multi-state testing</h3></div></div></div><p> + </p></div><div class="sect2" title="7.2. Multi-state testing"><div class="titlepage"><div><div><h3 class="title"><a id="id2688437"></a>7.2. Multi-state testing</h3></div></div></div><p> The tests in this section are geared towards a page that would instruct the user to toggle their Tor state after the fetch and perform some operations: mouseovers, stray clicks, and potentially reloads. - </p><div class="sect3" title="Cookies and Cache Correlation"><div class="titlepage"><div><div><h4 class="title"><a id="id2789315"></a>Cookies and Cache Correlation</h4></div></div></div><p> + </p><div class="sect3" title="Cookies and Cache Correlation"><div class="titlepage"><div><div><h4 class="title"><a id="id2688449"></a>Cookies and Cache Correlation</h4></div></div></div><p> The most obvious test is to set a cookie, ask the user to toggle tor, and then have them reload the page. The cookie should no longer be set if they are using the default Torbutton settings. In addition, it is possible to leverage @@ -1407,11 +1418,11 @@ the cache to <a class="ulink" href="http://crypto.stanford.edu/sameorigin/safeca identifiers</a>. The default settings of Torbutton should also protect against these from persisting across Tor Toggle. - </p></div><div class="sect3" title="Javascript timers and event handlers"><div class="titlepage"><div><div><h4 class="title"><a id="id2789338"></a>Javascript timers and event handlers</h4></div></div></div><p> + </p></div><div class="sect3" title="Javascript timers and event handlers"><div class="titlepage"><div><div><h4 class="title"><a id="id2688472"></a>Javascript timers and event handlers</h4></div></div></div><p> Javascript can set timers and register event handlers in the hopes of fetching URLs after the user has toggled Torbutton. - </p></div><div class="sect3" title="CSS Popups and non-script Dynamic Content"><div class="titlepage"><div><div><h4 class="title"><a id="id2789350"></a>CSS Popups and non-script Dynamic Content</h4></div></div></div><p> + </p></div><div class="sect3" title="CSS Popups and non-script Dynamic Content"><div class="titlepage"><div><div><h4 class="title"><a id="id2688484"></a>CSS Popups and non-script Dynamic Content</h4></div></div></div><p> Even if Javascript is disabled, CSS is still able to <a class="ulink" href="http://www.tjkdesign.com/articles/css%20pop%20ups/" target="_top">create popup-like @@ -1436,7 +1447,7 @@ these attacks, playing with them, and reporting what you find (and potentially submitting the test cases back to be run in the standard batch of Torbutton tests. - </p><div class="sect3" title="Some suggested vectors to investigate"><div class="titlepage"><div><div><h4 class="title"><a id="id2789405"></a>Some suggested vectors to investigate</h4></div></div></div><p> + </p><div class="sect3" title="Some suggested vectors to investigate"><div class="titlepage"><div><div><h4 class="title"><a id="id2688539"></a>Some suggested vectors to investigate</h4></div></div></div><p> </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">Strange ways to register Javascript <a class="ulink" href="http://en.wikipedia.org/wiki/DOM_Events" target="_top">events</a> and <a class="ulink" href="http://www.devshed.com/c/a/JavaScript/Using-Timers-in-JavaScript/" target="_top">timeouts</a> should be verified to actually be ineffective after Tor has been toggled.</li><li class="listitem">Other ways to cause Javascript to be executed after <span class="command"><strong>javascript.enabled</strong></span> has been toggled off.</li><li class="listitem">Odd ways to attempt to load plugins. Kyle Williams has had

1 0

Jump to page: