[tor-bugs] #34025 [Applications/Orbot]: Orbot connects directly to raw.githubusercontent.com on startup

Mon Apr 27 17:22:57 UTC 2020

#34025: Orbot connects directly to raw.githubusercontent.com on startup
-------------------------+------------------------------------
 Reporter:  cypherpunks  |          Owner:  n8fr8
     Type:  defect       |         Status:  new
 Priority:  Medium       |      Component:  Applications/Orbot
  Version:               |       Severity:  Normal
 Keywords:               |  Actual Points:
Parent ID:               |         Points:
 Reviewer:               |        Sponsor:
-------------------------+------------------------------------
 While leak testing Orbot, I noticed that it creates a connection to
 raw.githubusercontent.org

 https://github.com/guardianproject/orbot/blob/master/app/src/main/java/org/torproject/android/OrbotApp.java#L42

 I dont know why this is even necessary as the app store updaters already
 provide a notification, this doesn't seem to have ever actually notified
 me about an update, but it sure does let M$ know who all the orbot users
 might be.

 Maybe if it's really necessary it could make the connection over... tor?

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/34025>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online