[or-cvs] r20360: {torbutton} Update built html. (torbutton/trunk/website/design)
mikeperry at seul.org
mikeperry at seul.org
Mon Aug 24 17:58:41 UTC 2009
Author: mikeperry
Date: 2009-08-24 13:58:41 -0400 (Mon, 24 Aug 2009)
New Revision: 20360
Modified:
torbutton/trunk/website/design/index.html.en
Log:
Update built html.
Modified: torbutton/trunk/website/design/index.html.en
===================================================================
--- torbutton/trunk/website/design/index.html.en 2009-08-24 17:56:29 UTC (rev 20359)
+++ torbutton/trunk/website/design/index.html.en 2009-08-24 17:58:41 UTC (rev 20360)
@@ -1,8 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
-<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Torbutton Design Documentation</title><meta name="generator" content="DocBook XSL Stylesheets V1.73.2" /></head><body><div class="article" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title"><a id="design"></a>Torbutton Design Documentation</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Mike</span> <span class="surname">Perry</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:mikeperry.fscked/org">mikeperry.fscked/org</a>></code></p></div></div></div></div><div><p class="pubdate">July 31 2008</p></div></div><hr /></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="#id3003794">1. Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="#adversary">1.1. Adversary Model</a></span></dt><dt><span class="sect2"><a href="#requirements">1.2. Torbutton Requirements</a></span></dt><dt><span class="sect2"><a href="#layout">1.3. Extension Layout</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id3013108">2. Components</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id3036294">2.1. Hooked Components</a></span></dt><dt><span class="sect2"><a href="#id3026957">2.2. New Components</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id3017231">3. Chrome</a></span></dt><dd><dl><dt><span class="sect2"><a href="#browseroverlay">3.1. Browser Overlay - torbutton.xul</a></span></dt><dt><span class="sect2"><a href="#id3030186">3.2. Preferences Window - preferences.xul</a></span></dt><dt><span class="sect2"><a href="#id3038907">3.3. Other Windows</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id3027471">4. Toggle Code Path</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id3034877">4.1. Button Click</a></span></dt><dt><span class="sect2"><a href="#id3012015">4.2. Proxy Update</a></span></dt><dt><span class="sect2"><a href="#id3031243">4.3. Settings Update</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id3038096">5. Description of Options</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id3040114">5.1. Test Settings</a></span></dt><dt><span class="sect2"><a href="#plugins">5.2. Disable plugins on Tor Usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id3023634">5.3. Isolate Dynamic Content to Tor State (crucial)</a></span></dt><dt><span class="sect2"><a href="#jshooks">5.4. Hook Dangerous Javascript (crucial)</a></span></dt><dt><span class="sect2"><a href="#id3016866">5.5. Resize windows to multiples of 50px during Tor usage (recommended)</a></span></dt><dt><span class="sect2"><a href="#id3009112">5.6. Disable Updates During Tor</a></span></dt><dt><span class="sect2"><a href="#id3015999">5.7. Disable Search Suggestions during Tor (recommended)</a></span></dt><dt><span class="sect2"><a href="#id3021562">5.8. Block Tor/Non-Tor access to network from file:// urls (recommended)</a></span></dt><dt><span class="sect2"><a href="#id3005056">5.9. Close all Tor/Non-Tor tabs and windows on toggle (optional)</a></span></dt><dt><span class="sect2"><a href="#id3005596">5.10. Isolate Access to History navigation to Tor state (crucial)</a></span></dt><dt><span class="sect2"><a href="#id3013147">5.11. History Access Settings</a></span></dt><dt><span class="sect2"><a href="#id2998046">5.12. Clear History During Tor Toggle (optional)</a></span></dt><dt><span class="sect2"><a href="#id2998091">5.13. Block Password+Form saving during Tor/Non-Tor</a></span></dt><dt><span class="sect2"><a href="#id2998158">5.14. Block Tor disk cache and clear all cache on Tor Toggle</a></span></dt><dt><span class="sect2"><a href="#id2998213">5.15. Block disk and memory cache during Tor</a></span></dt><dt><span class="sect2"><a href="#id2998270">5.16. Clear Cookies on Tor Toggle</a></span></dt><dt><span class="sect2"><a href="#id2998324">5.17. Store Non-Tor cookies in a protected jar</a></span></dt><dt><span class="sect2"><a href="#id2998384">5.18. Store both Non-Tor and Tor cookies in a protected jar (dangerous)</a></span></dt><dt><span class="sect2"><a href="#id2998423">5.19. Manage My Own Cookies (dangerous)</a></span></dt><dt><span class="sect2"><a href="#id2998439">5.20. Disable DOM Storage during Tor usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id3040260">5.21. Clear HTTP Auth on Tor Toggle (recommended)</a></span></dt><dt><span class="sect2"><a href="#id3040298">5.22. Clear cookies on Tor/Non-Tor shutdown</a></span></dt><dt><span class="sect2"><a href="#id3040352">5.23. Reload cookie jar/clear cookies on Firefox crash</a></span></dt><dt><span class="sect2"><a href="#id3040427">5.24. On crash recovery or session restored startup, restore via: Tor, Non-Tor</a></span></dt><dt><span class="sect2"><a href="#id3040500">5.25. On normal startup, set state to: Tor, Non-Tor, Shutdown State</a></span></dt><dt><span class="sect2"><a href="#id3040558">5.26. Prevent session store from saving Non-Tor/Tor-loaded tabs</a></span></dt><dt><span class="sect2"><a href="#id3040623">5.27. Set user agent during Tor usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id3040811">5.28. Spoof US English Browser</a></span></dt><dt><span class="sect2"><a href="#id3040904">5.29. Don't send referrer during Tor Usage</a></span></dt><dt><span class="sect2"><a href="#id3040944">5.30. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)</a></span></dt></dl></dd><dt><span class="sect1"><a href="#FirefoxBugs">6. Relevant Firefox Bugs</a></span></dt><dd><dl><dt><span class="sect2"><a href="#FirefoxSecurity">6.1. Bugs impacting security</a></span></dt><dt><span class="sect2"><a href="#FirefoxWishlist">6.2. Bugs blocking functionality</a></span></dt><dt><span class="sect2"><a href="#FirefoxMiscBugs">6.3. Low Priority Bugs</a></span></dt></dl></dd><dt><span class="sect1"><a href="#TestPlan">7. Testing</a></span></dt><dd><dl><dt><span class="sect2"><a href="#Categories">7.1. Single state testing</a></span></dt><dt><span class="sect2"><a href="#id3042058">7.2. Multi-state testing</a></span></dt><dt><span class="sect2"><a href="#id3042129">7.3. Active testing (aka How to Hack Torbutton)</a></span></dt></dl></dd></dl></div><div class="sect1" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3003794"></a>1. Introduction</h2></div></div></div><p>
+<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Torbutton Design Documentation</title><meta name="generator" content="DocBook XSL Stylesheets V1.74.0" /></head><body><div class="article" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title"><a id="design"></a>Torbutton Design Documentation</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Mike</span> <span class="surname">Perry</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:mikeperry.fscked/org">mikeperry.fscked/org</a>></code></p></div></div></div></div><div><p class="pubdate">Aug 23 2009</p></div></div><hr /></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="#id2504786">1. Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="#adversary">1.1. Adversary Model</a></span></dt><dt><span class="sect2"><a href="#requirements">1.2. Torbutton Requirements</a></span></dt><dt><span class="sect2"><a href="#layout">1.3. Extension Layout</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2512920">2. Components</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2500232">2.1. Hooked Components</a></span></dt><dt><span class="sect2"><a href="#id2537040">2.2. New Components</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2510754">3. Chrome</a></span></dt><dd><dl><dt><span class="sect2"><a href="#browseroverlay">3.1. Browser Overlay - torbutton.xul</a></span></dt><dt><span class="sect2"><a href="#id2535909">3.2. Preferences Window - preferences.xul</a></span></dt><dt><span class="sect2"><a href="#id2513535">3.3. Other Windows</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2523148">4. Toggle Code Path</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2500968">4.1. Button Click</a></span></dt><dt><span class="sect2"><a href="#id2528928">4.2. Proxy Update</a></span></dt><dt><span class="sect2"><a href="#id2516670">4.3. Settings Update</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2533475">5. Description of Options</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2510742">5.1. Test Settings</a></span></dt><dt><span class="sect2"><a href="#plugins">5.2. Disable plugins on Tor Usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2532809">5.3. Isolate Dynamic Content to Tor State (crucial)</a></span></dt><dt><span class="sect2"><a href="#jshooks">5.4. Hook Dangerous Javascript</a></span></dt><dt><span class="sect2"><a href="#id2524160">5.5. Resize windows to multiples of 50px during Tor usage (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2531732">5.6. Disable Updates During Tor</a></span></dt><dt><span class="sect2"><a href="#id2520455">5.7. Disable Search Suggestions during Tor (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2526104">5.8. Block Tor/Non-Tor access to network from file:// urls (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2496362">5.9. Close all Tor/Non-Tor tabs and windows on toggle (optional)</a></span></dt><dt><span class="sect2"><a href="#id2496443">5.10. Isolate Access to History navigation to Tor state (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2496530">5.11. History Access Settings</a></span></dt><dt><span class="sect2"><a href="#id2496644">5.12. Clear History During Tor Toggle (optional)</a></span></dt><dt><span class="sect2"><a href="#id2496690">5.13. Block Password+Form saving during Tor/Non-Tor</a></span></dt><dt><span class="sect2"><a href="#id2496756">5.14. Block Tor disk cache and clear all cache on Tor Toggle</a></span></dt><dt><span class="sect2"><a href="#id2496811">5.15. Block disk and memory cache during Tor</a></span></dt><dt><span class="sect2"><a href="#id2496868">5.16. Clear Cookies on Tor Toggle</a></span></dt><dt><span class="sect2"><a href="#id2496924">5.17. Store Non-Tor cookies in a protected jar</a></span></dt><dt><span class="sect2"><a href="#id2538465">5.18. Store both Non-Tor and Tor cookies in a protected jar (dangerous)</a></span></dt><dt><span class="sect2"><a href="#id2538503">5.19. Manage My Own Cookies (dangerous)</a></span></dt><dt><span class="sect2"><a href="#id2538518">5.20. Disable DOM Storage during Tor usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2538622">5.21. Clear HTTP Auth on Tor Toggle (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2538660">5.22. Clear cookies on Tor/Non-Tor shutdown</a></span></dt><dt><span class="sect2"><a href="#id2538714">5.23. Reload cookie jar/clear cookies on Firefox crash</a></span></dt><dt><span class="sect2"><a href="#id2538788">5.24. On crash recovery or session restored startup, restore via: Tor, Non-Tor</a></span></dt><dt><span class="sect2"><a href="#id2538861">5.25. On normal startup, set state to: Tor, Non-Tor, Shutdown State</a></span></dt><dt><span class="sect2"><a href="#id2538920">5.26. Prevent session store from saving Non-Tor/Tor-loaded tabs</a></span></dt><dt><span class="sect2"><a href="#id2538984">5.27. Set user agent during Tor usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2539158">5.28. Spoof US English Browser</a></span></dt><dt><span class="sect2"><a href="#id2539251">5.29. Don't send referrer during Tor Usage</a></span></dt><dt><span class="sect2"><a href="#id2539292">5.30. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)</a></span></dt></dl></dd><dt><span class="sect1"><a href="#FirefoxBugs">6. Relevant Firefox Bugs</a></span></dt><dd><dl><dt><span class="sect2"><a href="#FirefoxSecurity">6.1. Bugs impacting security</a></span></dt><dt><span class="sect2"><a href="#FirefoxWishlist">6.2. Bugs blocking functionality</a></span></dt><dt><span class="sect2"><a href="#FirefoxMiscBugs">6.3. Low Priority Bugs</a></span></dt></dl></dd><dt><span class="sect1"><a href="#TestPlan">7. Testing</a></span></dt><dd><dl><dt><span class="sect2"><a href="#Categories">7.1. Single state testing</a></span></dt><dt><span class="sect2"><a href="#id2540301">7.2. Multi-state testing</a></span></dt><dt><span class="sect2"><a href="#id2540372">7.3. Active testing (aka How to Hack Torbutton)</a></span></dt></dl></dd></dl></div><div class="sect1" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2504786"></a>1. Introduction</h2></div></div></div><p>
This document describes the goals, operation, and testing procedures of the
-Torbutton Firefox extension. It is current as of Torbutton 1.2.0.
+Torbutton Firefox extension. It is current as of Torbutton 1.2.2.
</p><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="adversary"></a>1.1. Adversary Model</h3></div></div></div><p>
@@ -78,7 +79,7 @@
can cause the browser to perform network activity after Tor has been disabled,
thus allowing the adversary to correlate Tor and Non-Tor activity and reveal
a user's non-Tor IP address. Javascript
-also allows the adversary to execute <a class="ulink" href="http://gemal.dk/browserspy/css.html" target="_top">history disclosure attacks</a>:
+also allows the adversary to execute <a class="ulink" href="http://browserspy.dk/css.php" target="_top">history disclosure attacks</a>:
to query the history via the different attributes of 'visited' links to search
for particular google queries, sites, or even to <a class="ulink" href="http://www.mikeonads.com/2008/07/13/using-your-browser-url-history-estimate-gender/" target="_top">profile
users based on gender and other classifications</a>. Finally,
@@ -94,7 +95,7 @@
browser proxy settings - and often independent of its own proxy settings.
Sites that have plugin content don't even have to be malicious to obtain a
user's
-Non-Tor IP (it usually leaks by itself), though <a class="ulink" href="http://www.metasploit.com/research/projects/decloak/" target="_top">plenty of active
+Non-Tor IP (it usually leaks by itself), though <a class="ulink" href="http://decloak.net" target="_top">plenty of active
exploits</a> are possible as well. In addition, plugins can be used to store unique identifiers that are more
difficult to clear than standard cookies.
<a class="ulink" href="http://epic.org/privacy/cookies/flash.html" target="_top">Flash-based
@@ -132,7 +133,7 @@
There is an absurd amount of information available to websites via attributes
of the browser. This information can be used to reduce anonymity set, or even
-<a class="ulink" href="http://0x000000.com/index.php?i=520&bin=1000001000" target="_top">uniquely
+<a class="ulink" href="http://mandark.fr/0x000000/articles/Total_Recall_On_Firefox..html" target="_top">uniquely
fingerprint individual users</a>. </p><p>
For illustration, let's perform a
back-of-the-envelope calculation on the number of anonymity sets for just the
@@ -156,7 +157,7 @@
Of course, this space is non-uniform and prone to incremental changes.
However, if a bit vector space consisting of the above extracted attributes
-were used instead of the hash approach from <a class="ulink" href="http://0x000000.com/index.php?i=520&bin=1000001000" target="_top">The Hacker
+were used instead of the hash approach from <a class="ulink" href="http://mandark.fr/0x000000/articles/Total_Recall_On_Firefox..html" target="_top">The Hacker
Webzine article above</a>, minor changes in browser window resolution will
no longer generate totally new identifiers.
@@ -214,7 +215,7 @@
provide full Tor protection in the event a third-party proxy switcher has
enabled the Tor proxy settings.</p></li></ol></div></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="layout"></a>1.3. Extension Layout</h3></div></div></div><p>Firefox extensions consist of two main categories of code: 'Components' and
'Chrome'. Components are a fancy name for classes that implement a given
-interface or interfaces. In Firefox, components <a class="ulink" href="http://www.xulplanet.com/references/xpcomref/creatingcomps.html" target="_top">can be
+interface or interfaces. In Firefox, components <a class="ulink" href="https://developer.mozilla.org/en/XPCOM" target="_top">can be
written</a> in C++,
Javascript, or a mixture of both. Components have two identifiers: their
'<a class="ulink" href="http://www.mozilla.org/projects/xpcom/book/cxc/html/quicktour2.html#1005005" target="_top">Contract
@@ -230,13 +231,13 @@
stable.</p><p>'Chrome' is a combination of XML and Javascript used to describe a window.
Extensions are allowed to create 'overlays' that are 'bound' to existing XML
window definitions, or they can create their own windows. The DTD for this XML
-is called <a class="ulink" href="http://developer.mozilla.org/en/docs/XUL_Reference" target="_top">XUL</a>.</p></div></div><div class="sect1" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3013108"></a>2. Components</h2></div></div></div><p>
+is called <a class="ulink" href="http://developer.mozilla.org/en/docs/XUL_Reference" target="_top">XUL</a>.</p></div></div><div class="sect1" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2512920"></a>2. Components</h2></div></div></div><p>
Torbutton installs components for two purposes: hooking existing components to
reimplement their interfaces; and creating new components that provide
services to other pieces of the extension.
-
- </p><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3036294"></a>2.1. Hooked Components</h3></div></div></div><p>Torbutton makes extensive use of Contract ID hooking, and implements some
+
+ </p><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2500232"></a>2.1. Hooked Components</h3></div></div></div><p>Torbutton makes extensive use of Contract ID hooking, and implements some
of its own standalone components as well. Let's discuss the hooked components
first.</p><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="sessionstore"></a><a class="ulink" href="http://developer.mozilla.org/en/docs/nsISessionStore" target="_top">@mozilla.org/browser/sessionstore;1</a> -
<a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/nsSessionStore2.js" target="_top">components/nsSessionStore2.js</a>
@@ -254,7 +255,18 @@
with a couple of modifications to prevent tabs that were loaded with Tor
enabled from being written to disk, and some version detection code to
determine which component to load. The <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/nsSessionStore3.diff" target="_top">diff against the original session
-store</a> is included in the SVN repository.</p></div><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id3032598"></a><a class="ulink" href="http://lxr.mozilla.org/seamonkey/source/browser/components/sessionstore/src/nsSessionStartup.js" target="_top">@mozilla.org/browser/sessionstartup;1</a> -
+store</a> is included in the SVN repository.</p></div><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="appblocker"></a><a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/uriloader/external-protocol-service%3B1" target="_top">@mozilla.org/uriloader/external-protocol-service;1
+</a> and <a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/uriloader/external-helper-app-service%3B1" target="_top">@mozilla.org/uriloader/external-helper-app-service;1</a>
+- <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/external-app-blocker.js" target="_top">components/external-app-blocker.js</a></h4></div></div></div><p>
+Due to <a class="link" href="#FirefoxBugs" title="6. Relevant Firefox Bugs">Firefox Bug</a> <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=440892" target="_top">440892</a> allowing Firefox 3.x to automatically launch some
+applications without user intervention, Torbutton had to wrap the two
+components involved in launching external applications to provide user
+confirmation before doing so while Tor is enabled. Since external applications
+do not obey proxy settings, they can be manipulated to automatically connect
+back to arbitrary servers outside of Tor with no user intervention. Fixing
+this issue helps to satisfy Torbutton's <a class="link" href="#proxy">Proxy
+Obedience</a> Requirement.
+ </p></div><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id2515280"></a><a class="ulink" href="http://lxr.mozilla.org/seamonkey/source/browser/components/sessionstore/src/nsSessionStartup.js" target="_top">@mozilla.org/browser/sessionstartup;1</a> -
<a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/crash-observer.js" target="_top">components/crash-observer.js</a></h4></div></div></div><p>This component wraps the Firefox Session Startup component that is in
charge of <a class="ulink" href="http://developer.mozilla.org/en/docs/Session_store_API" target="_top">restoring saved
sessions</a>. The wrapper's only job is to intercept the
@@ -262,27 +274,27 @@
browser crashed and the session needs to be restored. The wrapper notifies the
Torbutton chrome that the browser crashed by setting the pref
<span class="command"><strong>extensions.torbutton.crashed</strong></span>, or that it is a normal
-startup via the pref <span class="command"><strong>extensions.torbutton.noncrashed</strong></span>. The Torbutton Chrome <a class="ulink" href="http://www.xulplanet.com/references/xpcomref/ifaces/nsIPrefBranch2.html#method_addObserver" target="_top">listens for a
+startup via the pref <span class="command"><strong>extensions.torbutton.noncrashed</strong></span>. The Torbutton Chrome <a class="ulink" href="https://developer.mozilla.org/en/NsIPrefBranch2#addObserver.28.29" target="_top">listens for a
preference change</a> for this value and then does the appropriate cleanup. This
includes setting the Tor state to the one the user selected for crash recovery
in the preferences window (<span class="command"><strong>extensions.torbutton.restore_tor</strong></span>), and
restoring cookies for the corresponding cookie jar, if it exists.</p><p>By performing this notification, this component assists in the
<a class="link" href="#proxy">Proxy Obedience</a>, and <a class="link" href="#isolation">Network Isolation</a> requirements.
-</p></div><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id3039706"></a><a class="ulink" href="http://www.xulplanet.com/references/xpcomref/comps/c_browserglobalhistory2.html" target="_top">@mozilla.org/browser/global-history;2</a>
+</p></div><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id2535655"></a><a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/browser/global-history;2" target="_top">@mozilla.org/browser/global-history;2</a>
- <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/ignore-history.js" target="_top">components/ignore-history.js</a></h4></div></div></div><p>This component was contributed by <a class="ulink" href="http://www.collinjackson.com/" target="_top">Collin Jackson</a> as a method for defeating
CSS and Javascript-based methods of history disclosure. The global-history
component is what is used by Firefox to determine if a link was visited or not
-(to apply the appropriate style to the link). By hooking the <a class="ulink" href="http://www.xulplanet.com/references/xpcomref/ifaces/nsIGlobalHistory2.html#method_isVisited" target="_top">isVisited</a>
-and <a class="ulink" href="http://www.xulplanet.com/references/xpcomref/ifaces/nsIGlobalHistory2.html#method_addURI" target="_top">addURI</a>
+(to apply the appropriate style to the link). By hooking the <a class="ulink" href="https://developer.mozilla.org/en/nsIGlobalHistory2#isVisited.28.29" target="_top">isVisited</a>
+and <a class="ulink" href="https://developer.mozilla.org/en/nsIGlobalHistory2#addURI.28.29" target="_top">addURI</a>
methods, Torbutton is able to selectively prevent history items from being
added or being displayed as visited, depending on the Tor state and the user's
preferences.
</p><p>
This component helps satisfy the <a class="link" href="#state">State Separation</a>
and <a class="link" href="#disk">Disk Avoidance</a> requirements of Torbutton.
-</p></div></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3026957"></a>2.2. New Components</h3></div></div></div><p>Torbutton creates four new components that are used throughout the
+</p></div></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2537040"></a>2.2. New Components</h3></div></div></div><p>Torbutton creates four new components that are used throughout the
extension. These components do not hook any interfaces, nor are they used
-anywhere besides Torbutton itself.</p><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id3037450"></a><a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/cookie-jar-selector.js" target="_top">@stanford.edu/cookie-jar-selector;2
+anywhere besides Torbutton itself.</p><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id2512827"></a><a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/cookie-jar-selector.js" target="_top">@stanford.edu/cookie-jar-selector;2
- components/cookie-jar-selector.js</a></h4></div></div></div><p>The cookie jar selector (also based on code from <a class="ulink" href="http://www.collinjackson.com/" target="_top">Collin
Jackson</a>) is used by the Torbutton chrome to switch between
Tor and Non-Tor cookies. Its operations are simple: sync cookies to disk, then
@@ -291,7 +303,7 @@
into place.</p><p>
This component helps to address the <a class="link" href="#state">State
Isolation</a> requirement of Torbutton.
-</p></div><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id3031428"></a><a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/torbutton-logger.js" target="_top">@torproject.org/torbutton-logger;1
+</p></div><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id2510826"></a><a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/torbutton-logger.js" target="_top">@torproject.org/torbutton-logger;1
- components/torbutton-logger.js</a></h4></div></div></div><p>The torbutton logger component allows on-the-fly redirection of torbutton
logging messages to either Firefox stderr
(<span class="command"><strong>extensions.torbutton.logmethod=0</strong></span>), the Javascript error console
@@ -300,14 +312,14 @@
change the loglevel on the fly by changing
<span class="command"><strong>extensions.torbutton.loglevel</strong></span> (1-5, 1 is most verbose).
</p></div><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="windowmapper"></a><a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/window-mapper.js" target="_top">@torproject.org/content-window-mapper;1
-- components/window-mapper.js</a></h4></div></div></div><p>Torbutton tags Firefox <a class="ulink" href="http://www.xulplanet.com/references/elemref/ref_tabbrowser.html" target="_top">tabs</a> with a special variable that indicates the Tor
+- components/window-mapper.js</a></h4></div></div></div><p>Torbutton tags Firefox <a class="ulink" href="https://developer.mozilla.org/en/XUL_Tutorial/Tabboxes" target="_top">tabs</a> with a special variable that indicates the Tor
state the tab was most recently used under to fetch a page. The problem is
that for many Firefox events, it is not possible to determine the tab that is
actually receiving the event. The Torbutton window mapper allows the Torbutton
-chrome and other components to look up a <a class="ulink" href="http://www.xulplanet.com/references/elemref/ref_tabbrowser.html" target="_top">browser
-tab</a> for a given <a class="ulink" href="http://www.xulplanet.com/references/xpcomref/ifaces/nsIDOMWindow.html" target="_top">HTML content
+chrome and other components to look up a <a class="ulink" href="https://developer.mozilla.org/en/XUL/tabbrowser" target="_top">browser
+tab</a> for a given <a class="ulink" href="https://developer.mozilla.org/en/nsIDOMWindow" target="_top">HTML content
window</a>. It does this by traversing all windows and all browsers, until it
-finds the browser with the requested <a class="ulink" href="http://www.xulplanet.com/references/elemref/ref_browser.html#prop_contentWindow" target="_top">contentWindow</a> element. Since the content policy
+finds the browser with the requested <a class="ulink" href="https://developer.mozilla.org/en/XUL/tabbrowser#p-contentWindow" target="_top">contentWindow</a> element. Since the content policy
and page loading in general can generate hundreds of these lookups, this
result is cached inside the component.
</p></div><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="contentpolicy"></a><a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/cssblocker.js" target="_top">@torproject.org/cssblocker;1
@@ -316,9 +328,9 @@
However, CSS is still able to perform network operations by loading styles for
onmouseover events and other operations. In addition, favicons can still be
loaded by the browser. The cssblocker component prevents this by implementing
-and registering an <a class="ulink" href="http://www.xulplanet.com/references/xpcomref/ifaces/nsIContentPolicy.html" target="_top">nsIContentPolicy</a>.
+and registering an <a class="ulink" href="https://developer.mozilla.org/en/nsIContentPolicy" target="_top">nsIContentPolicy</a>.
When an nsIContentPolicy is registered, Firefox checks every attempted network
-request against its <a class="ulink" href="http://www.xulplanet.com/references/xpcomref/ifaces/nsIContentPolicy.html#method_shouldLoad" target="_top">shouldLoad</a>
+request against its <a class="ulink" href="https://developer.mozilla.org/en/nsIContentPolicy#shouldLoad()" target="_top">shouldLoad</a>
member function to determine if the load should proceed. In Torbutton's case,
the content policy looks up the appropriate browser tab using the <a class="link" href="#windowmapper" title="@torproject.org/content-window-mapper;1 - components/window-mapper.js">window mapper</a>,
and checks that tab's load tag against the current Tor state. If the tab was
@@ -343,23 +355,25 @@
</p><p>
This helps to fulfill both the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> and the <a class="link" href="#undiscoverability">Tor Undiscoverability</a> requirements of
-Torbutton.</p></div></div></div><div class="sect1" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3017231"></a>3. Chrome</h2></div></div></div><p>The chrome is where all the torbutton graphical elements and windows are
+Torbutton.</p></div></div></div><div class="sect1" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2510754"></a>3. Chrome</h2></div></div></div><p>The chrome is where all the torbutton graphical elements and windows are
located. Each window is described as an <a class="ulink" href="http://developer.mozilla.org/en/docs/XUL_Reference" target="_top">XML file</a>, with zero or more Javascript
files attached. The scope of these Javascript files is their containing
window.</p><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="browseroverlay"></a>3.1. Browser Overlay - <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/chrome/content/torbutton.xul" target="_top">torbutton.xul</a></h3></div></div></div><p>The browser overlay, torbutton.xul, defines the toolbar button, the status
bar, and events for toggling the button. The overlay code is in <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/chrome/content/torbutton.js" target="_top">chrome/content/torbutton.js</a>.
It contains event handlers for preference update, shutdown, upgrade, and
-location change events.</p><p>The <a class="ulink" href="http://www.xulplanet.com/references/xpcomref/comps/c_docloaderservice1.html" target="_top">location
-change</a> <a class="ulink" href="http://www.xulplanet.com/references/xpcomref/ifaces/nsIWebProgressListener.html" target="_top">webprogress
-listener</a>, <span class="command"><strong>torbutton_weblistener</strong></span> is perhaps the
-most important part of the chrome from a security standpoint. It is a <a class="ulink" href="http://www.xulplanet.com/references/xpcomref/ifaces/nsIWebProgressListener.html" target="_top">web
-progress listener</a> that handles
-receiving an event every time a page load or iframe load occurs. This class
-eventually calls down to <code class="function">torbutton_update_tags()</code> and
-<code class="function">torbutton_hookdoc()</code>, which apply the browser Tor load state tags, plugin
-permissions, and install the Javascript hooks to hook the <a class="ulink" href="http://phrogz.net/objJob/object.asp?id=224" target="_top">Date</a> object and
-the <a class="ulink" href="http://developer.mozilla.org/en/docs/DOM:window.navigator" target="_top">navigator</a> object (for timezone and platform information,
-respectively).</p><p>
+location change events.</p><p>The <a class="ulink" href="https://developer.mozilla.org/en/nsIWebProgressListener#onLocationChange" target="_top">location
+change</a> <a class="ulink" href="https://developer.mozilla.org/en/nsIWebProgress" target="_top">webprogress
+listener</a>, <span class="command"><strong>torbutton_weblistener</strong></span> is one of the most
+important parts of the chrome from a security standpoint. It is a <a class="ulink" href="https://developer.mozilla.org/en/nsIWebProgressListener" target="_top">webprogress
+listener</a> that handles receiving an event every time a page load or
+iframe load occurs. This class eventually calls down to
+<code class="function">torbutton_update_tags()</code> and
+<code class="function">torbutton_hookdoc()</code>, which apply the browser Tor load
+state tags, plugin permissions, and install the Javascript hooks to hook the
+<a class="ulink" href="https://developer.mozilla.org/en/DOM/window.screen" target="_top">window.screen</a>
+object to obfuscate browser and desktop resolution information.
+
+</p><p>
The browser overlay helps to satisfy a number of Torbutton requirements. These
are better enumerated in each of the Torbutton preferences below. However,
there are also a number of Firefox preferences set in
@@ -407,11 +421,39 @@
plugins. The mechanisms for handling this are described under the "Disable
Plugins During Tor Usage" preference. This helps fulfill the <a class="link" href="#proxy">Proxy Obedience</a> requirement, by preventing external
applications from accessing network resources at the command of Tor-fetched
-pages.
- </p></li></ol></div></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3030186"></a>3.2. Preferences Window - <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/chrome/content/preferences.xul" target="_top">preferences.xul</a></h3></div></div></div><p>The preferences window of course lays out the Torbutton preferences, with
-handlers located in <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/chrome/content/preferences.js" target="_top">chrome/content/preferences.js</a>.</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3038907"></a>3.3. Other Windows</h3></div></div></div><p>There are additional windows that describe popups for right clicking on
-the status bar, the toolbutton, and the about page.</p></div></div><div class="sect1" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3027471"></a>4. Toggle Code Path</h2></div></div></div><p>
+pages. Unfortunately, due to <a class="link" href="#FirefoxBugs" title="6. Relevant Firefox Bugs">Firefox Bug</a>
+<a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=440892" target="_top">440892</a>,
+these prefs are no longer obeyed. They are set still anyway out of respect for
+the dead.
+ </p></li><li><a class="ulink" href="http://kb.mozillazine.org/Browser.sessionstore.max_tabs_undo" target="_top">browser.sessionstore.max_tabs_undo</a><p>
+To help satisfy the Torbutton <a class="link" href="#state">State Separation</a>
+and <a class="link" href="#isolation">Network Isolation</a> requirements,
+Torbutton needs to purge the Undo Tab history on toggle to prevent repeat
+"Undo Close" operations from accidentally restoring tabs from a different Tor
+State. This purge is accomplished by setting this preference to 0 and then
+restoring it to the previous user value upon toggle.
+
+ </p></li><li><span class="command"><strong>security.enable_ssl2</strong></span><p>
+TLS Session IDs can persist for an indefinite duration, providing an
+identifier that is sent to TLS sites that can be used to link activity. This
+is particularly troublesome now that we have certificate verification in place
+in Firefox 3: The OCSP server can use this Session ID to build a history of
+TLS sites someone visits, and also correlate their activity as users move from
+network to network (such as home to work to coffee shop, etc), inside and
+outside of Tor. To handle this and to help satisfy our <a class="link" href="#state">State Separation Requirement</a>, we currently
+toggle
+<span class="command"><strong>security.enable_ssl2</strong></span>, which clears the SSL Session ID
+cache via the pref observer at <a class="ulink" href="http://mxr.mozilla.org/security/source/security/manager/ssl/src/nsNSSComponent.cpp#2134" target="_top">nsNSSComponent.cpp
+line 2134</a>. This is an arcane and potentially fragile fix. It would be
+better if there were a more standard interface for accomplishing the same
+thing. <a class="link" href="#FirefoxBugs" title="6. Relevant Firefox Bugs">Firefox Bug</a> <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=448747" target="_top">448747</a> has
+been filed for this.
+
+ </p></li></ol></div></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2535909"></a>3.2. Preferences Window - <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/chrome/content/preferences.xul" target="_top">preferences.xul</a></h3></div></div></div><p>The preferences window of course lays out the Torbutton preferences, with
+handlers located in <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/chrome/content/preferences.js" target="_top">chrome/content/preferences.js</a>.</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2513535"></a>3.3. Other Windows</h3></div></div></div><p>There are additional windows that describe popups for right clicking on
+the status bar, the toolbutton, and the about page.</p></div></div><div class="sect1" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2523148"></a>4. Toggle Code Path</h2></div></div></div><p>
+
The act of toggling is connected to <code class="function">torbutton_toggle()</code>
via the <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/chrome/content/torbutton.xul" target="_top">torbutton.xul</a>
and <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/chrome/content/popup.xul" target="_top">popup.xul</a>
@@ -431,7 +473,7 @@
409737</a> unfixed. The content policy does not allow any network activity
whatsoever during this three stage transition.
- </p><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3034877"></a>4.1. Button Click</h3></div></div></div><p>
+ </p><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2500968"></a>4.1. Button Click</h3></div></div></div><p>
This is the first step in the toggling process. When the user clicks the
toggle button or the toolbar, <code class="function">torbutton_toggle()</code> is
@@ -439,12 +481,12 @@
proxy settings to the selected Tor settings, and then sets the proxy settings
to the opposite state, and sets the pref
<span class="command"><strong>extensions.torbutton.tor_enabled</strong></span> to reflect the new state.
-It is this proxy pref update that gives notification via the <a class="ulink" href="http://www.xulplanet.com/references/xpcomref/ifaces/nsIPrefBranch2.html#method_addObserver" target="_top">pref
+It is this proxy pref update that gives notification via the <a class="ulink" href="https://developer.mozilla.org/en/NsIPrefBranch2#addObserver.28.29" target="_top">pref
observer</a>
<span class="command"><strong>torbutton_unique_pref_observer</strong></span> to perform the rest of the
toggle.
- </p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3012015"></a>4.2. Proxy Update</h3></div></div></div><p>
+ </p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2528928"></a>4.2. Proxy Update</h3></div></div></div><p>
When Torbutton receives any proxy change notifications via its
<span class="command"><strong>torbutton_unique_pref_observer</strong></span>, it calls
@@ -459,7 +501,7 @@
observer so that other addons (such as SwitchProxy) can switch the proxy
settings between multiple proxies.
- </p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3031243"></a>4.3. Settings Update</h3></div></div></div><p>
+ </p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2516670"></a>4.3. Settings Update</h3></div></div></div><p>
The next stage is also handled by
<code class="function">torbutton_update_status()</code>. This function sets scores of
@@ -470,10 +512,10 @@
<span class="command"><strong>extensions.torbutton.settings_applied</strong></span>, which signifies the
completion of the toggle operation to the <a class="link" href="#contentpolicy" title="@torproject.org/cssblocker;1 - components/cssblocker.js">content policy</a>.
- </p></div></div><div class="sect1" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3038096"></a>5. Description of Options</h2></div></div></div><p>This section provides a detailed description of Torbutton's options. Each
+ </p></div></div><div class="sect1" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2533475"></a>5. Description of Options</h2></div></div></div><p>This section provides a detailed description of Torbutton's options. Each
option is presented as the string from the preferences window, a summary, the
preferences it touches, and the effect this has on the components, chrome, and
-browser properties.</p><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3040114"></a>5.1. Test Settings</h3></div></div></div><p>
+browser properties.</p><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2510742"></a>5.1. Test Settings</h3></div></div></div><p>
This button under the Proxy Settings tab provides a way to verify that the
proxy settings are correct, and actually do route through the Tor network. It
performs this check by issuing an <a class="ulink" href="http://developer.mozilla.org/en/docs/XMLHttpRequest" target="_top">XMLHTTPRequest</a>
@@ -488,9 +530,19 @@
window</a>
callback <code class="function">torbutton_prefs_test_settings()</code> in <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/chrome/content/preferences.js" target="_top">preferences.js</a>.
- </p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="plugins"></a>5.2. Disable plugins on Tor Usage (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_tor_plugins</strong></span></p><p>Enabling this preference causes the above mentioned Torbutton chrome web progress
+ </p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="plugins"></a>5.2. Disable plugins on Tor Usage (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_tor_plugins</strong></span></p><p>Java and plugins <a class="ulink" href="http://java.sun.com/j2se/1.5.0/docs/api/java/net/class-use/NetworkInterface.html" target="_top">can query</a> the <a class="ulink" href="http://www.rgagnon.com/javadetails/java-0095.html" target="_top">local IP
+address</a> and report it back to the
+remote site. They can also <a class="ulink" href="http://decloak.net" target="_top">bypass proxy settings</a> and directly connect to a
+remote site without Tor. Every browser plugin we have tested with Firefox has
+some form of network capability, and every one ignores proxy settings or worse - only
+partially obeys them. This includes but is not limited to:
+QuickTime, Windows Media Player, RealPlayer, mplayerplug-in, AcroRead, and
+Flash.
+
+ </p><p>
+Enabling this preference causes the above mentioned Torbutton chrome web progress
listener <span class="command"><strong>torbutton_weblistener</strong></span> to disable Java via <span class="command"><strong>security.enable_java</strong></span> and to disable
- plugins via the browser <a class="ulink" href="http://www.xulplanet.com/references/xpcomref/ifaces/nsIDocShell.html" target="_top">docShell</a>
+ plugins via the browser <a class="ulink" href="https://developer.mozilla.org/en/XUL%3aProperty%3adocShell" target="_top">docShell</a>
attribute <span class="command"><strong>allowPlugins</strong></span>. These flags are set every time a new window is
created (<code class="function">torbutton_tag_new_browser()</code>), every time a web
load
@@ -499,40 +551,38 @@
(<code class="function">torbutton_update_status()</code>). As a backup measure, plugins are also
prevented from loading by the content policy in <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/cssblocker.js" target="_top">@torproject.org/cssblocker;1</a> if Tor is
enabled and this option is set.
- </p><p>Even all this turns out to be insufficient if the user directly
- clicks on a plugin-handled mime-type. <a class="ulink" href="http://www.janusvm.com/goldy/pdf/" target="_top">In this case</a> (and also <a class="ulink" href="http://www.janusvm.com/goldy/side-channels/frames/" target="_top">this
-one</a>), the browser decides that
- maybe it should ignore all these other settings and load the plugin anyways,
- because maybe the user really did want to load it (never mind this same
- load-style could happen automatically with meta-refresh or any number of
- other ways..). To handle these cases, Torbutton stores a list of plugin-handled
- mime-types, and sets the pref
+ </p><p>All of this turns out to be insufficient if the user directly clicks
+on a plugin-handled mime-type. <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=401296" target="_top">In this case</a>,
+the browser decides that maybe it should ignore all these other settings and
+load the plugin anyways, because maybe the user really did want to load it
+(never mind this same load-style could happen automatically with meta-refresh
+or any number of other ways..). To handle these cases, Torbutton stores a list
+of plugin-handled mime-types, and sets the pref
<span class="command"><strong>plugin.disable_full_page_plugin_for_types</strong></span> to this list.
Additionally, (since nothing can be assumed when relying on Firefox
-preferences and internals) if it detects a load of one of them from the web progress
- listener, it cancels the request, tells the associated DOMWindow
-to stop loading, clears the document, AND throws an exception. Anything short
-of all this and
- the plugin managed to find some way to load.
+preferences and internals) if it detects a load of one of them from the web
+progress listener, it cancels the request, tells the associated DOMWindow to
+stop loading, clears the document, AND throws an exception. Anything short of
+all this and the plugin managed to find some way to load.
</p><p>
All this could be avoided, of course, if Firefox would either <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=401296" target="_top">obey
allowPlugins</a> for directly visited URLs, or notify its content policy for such
loads either <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=309524" target="_top">via</a> <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=380556" target="_top">shouldProcess</a> or shouldLoad. The fact that it does not is
- not very encouraging.
+ not very encouraging.
</p><p>
Since most plugins completely ignore browser proxy settings, the actions
performed by this setting are crucial to satisfying the <a class="link" href="#proxy">Proxy Obedience</a> requirement.
- </p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3023634"></a>5.3. Isolate Dynamic Content to Tor State (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.isolate_content</strong></span></p><p>Enabling this preference is what enables the <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/cssblocker.js" target="_top">@torproject.org/cssblocker;1</a> content policy
+ </p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2532809"></a>5.3. Isolate Dynamic Content to Tor State (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.isolate_content</strong></span></p><p>Enabling this preference is what enables the <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/cssblocker.js" target="_top">@torproject.org/cssblocker;1</a> content policy
mentioned above, and causes it to block content load attempts in pages an
-opposite Tor state from the current state. Freshly loaded <a class="ulink" href="http://www.xulplanet.com/references/elemref/ref_tabbrowser.html" target="_top">browser
-tabs</a> are tagged
+opposite Tor state from the current state. Freshly loaded <a class="ulink" href="https://developer.mozilla.org/en/XUL/tabbrowser" target="_top">browser
+tabs</a> are tagged
with a <span class="command"><strong>__tb_load_state</strong></span> member in
<code class="function">torbutton_update_tags()</code> and this
value is compared against the current tor state in the content policy.</p><p>It also kills all Javascript in each page loaded under that state by
-toggling the <span class="command"><strong>allowJavascript</strong></span> <a class="ulink" href="http://www.xulplanet.com/references/xpcomref/ifaces/nsIDocShell.html" target="_top">docShell</a> property, and issues a
-<a class="ulink" href="http://www.xulplanet.com/references/xpcomref/ifaces/nsIWebNavigation.html#method_stop" target="_top">webNavigation.stop(webNavigation.STOP_ALL)</a> to each browser tab (the
+toggling the <span class="command"><strong>allowJavascript</strong></span> <a class="ulink" href="https://developer.mozilla.org/en/XUL%3aProperty%3adocShell" target="_top">docShell</a> property, and issues a
+<a class="ulink" href="https://developer.mozilla.org/en/XPCOM_Interface_Reference/nsIWebNavigation#stop()" target="_top">webNavigation.stop(webNavigation.STOP_ALL)</a> to each browser tab (the
equivalent of hitting the STOP button).</p><p>
Unfortunately, <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=409737" target="_top">Firefox bug
@@ -551,32 +601,33 @@
</p><p>
This setting is responsible for satisfying the <a class="link" href="#isolation">Network Isolation</a> requirement.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="jshooks"></a>5.4. Hook Dangerous Javascript (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.kill_bad_js</strong></span></p><p>This setting enables injection of the <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/chrome/content/jshooks.js" target="_top">Javascript
-hooking code</a>. Javascript is injected into
-pages to hook the <a class="ulink" href="http://phrogz.net/objJob/object.asp?id=224" target="_top">Date
-class</a> to mask your timezone. This is done in the chrome in
+</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="jshooks"></a>5.4. Hook Dangerous Javascript</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.kill_bad_js</strong></span></p><p>This setting enables injection of the <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/chrome/content/jshooks.js" target="_top">Javascript
+hooking code</a>. This is done in the chrome in
<code class="function">torbutton_hookdoc()</code>, which is called ultimately by both the
-<a class="ulink" href="http://www.xulplanet.com/references/xpcomref/ifaces/nsIWebProgressListener.html" target="_top">webprogress
+<a class="ulink" href="https://developer.mozilla.org/en/nsIWebProgressListener" target="_top">webprogress
listener</a> <span class="command"><strong>torbutton_weblistener</strong></span> and the <a class="link" href="#contentpolicy" title="@torproject.org/cssblocker;1 - components/cssblocker.js">content policy</a> (the latter being a hack to handle
-javascript: urls). This behavior helps to satisfy the <a class="link" href="#location">Location Neutrality</a> requirement.
+javascript: urls).
-</p><p>
-
-In addition, this setting also hooks various resolution properties of the
-<a class="ulink" href="http://developer.mozilla.org/en/docs/DOM:window" target="_top">window</a>,
-<a class="ulink" href="http://developer.mozilla.org/en/docs/DOM:window.screen" target="_top">window.screen</a>,
-and <a class="ulink" href="http://developer.mozilla.org/en/docs/DOM:window.navigator" target="_top">window.navigator</a>
-to mask window size information and user agent properties not handled by the
-standard Firefox user agent override settings. The resolution hooks
+In the Firefox 2 days, this option did a lot more than
+it does now. It used to be responsible for timezone and improved useragent
+spoofing, and history object cloaking. However, now it only provides
+obfuscation of the <a class="ulink" href="https://developer.mozilla.org/en/DOM/window.screen" target="_top">window.screen</a>
+object to mask your browser and desktop resolution.
+The resolution hooks
effectively make the Firefox browser window appear to websites as if the renderable area
takes up the entire desktop, has no toolbar or other GUI element space, and
the desktop itself has no toolbars.
These hooks drastically reduce the amount of information available to do <a class="link" href="#fingerprinting">anonymity set reduction attacks</a> and help to
meet the <a class="link" href="#setpreservation">Anonymity Set Preservation</a>
-requirements.
+requirements. Unfortunately, Gregory Fleischer discovered it is still possible
+to retrieve the original screen values by using <a class="ulink" href="http://pseudo-flaw.net/tor/torbutton/unmask-sandbox-xpcnativewrapper.html" target="_top">XPCNativeWrapper</a>
+or <a class="ulink" href="http://pseudo-flaw.net/tor/torbutton/unmask-components-lookupmethod.html" target="_top">Components.lookupMethod</a>.
+We are still looking for a workaround as of Torbutton 1.2.2.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3016866"></a>5.5. Resize windows to multiples of 50px during Tor usage (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.resize_windows</strong></span></p><p>
+
+</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2524160"></a>5.5. Resize windows to multiples of 50px during Tor usage (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.resize_windows</strong></span></p><p>
+
This option drastically cuts down on the number of distinct anonymity sets
that divide the Tor web userbase. Without this setting, the dimensions for a
typical browser window range from 600-1200 horizontal pixels and 400-1000
@@ -610,7 +661,7 @@
</p><p>
This setting helps to meet the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> requirements.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3009112"></a>5.6. Disable Updates During Tor</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_updates</strong></span></p><p>This setting causes Torbutton to disable the four <a class="ulink" href="http://wiki.mozilla.org/Update:Users/Checking_For_Updates#Preference_Controls_and_State" target="_top">Firefox
+</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2531732"></a>5.6. Disable Updates During Tor</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_updates</strong></span></p><p>This setting causes Torbutton to disable the four <a class="ulink" href="http://wiki.mozilla.org/Update:Users/Checking_For_Updates#Preference_Controls_and_State" target="_top">Firefox
update settings</a> during Tor
usage: <span class="command"><strong>extensions.update.enabled</strong></span>,
<span class="command"><strong>app.update.enabled</strong></span>,
@@ -620,7 +671,7 @@
checking for search plugin updates while Tor is enabled.
</p><p>
This setting satisfies the <a class="link" href="#updates">Update Safety</a> requirement.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3015999"></a>5.7. Disable Search Suggestions during Tor (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_search</strong></span></p><p>
+</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2520455"></a>5.7. Disable Search Suggestions during Tor (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_search</strong></span></p><p>
This setting causes Torbutton to disable <a class="ulink" href="http://kb.mozillazine.org/Browser.search.suggest.enabled" target="_top"><span class="command"><strong>browser.search.suggest.enabled</strong></span></a>
during Tor usage.
This governs if you get Google search suggestions during Tor
@@ -631,7 +682,7 @@
While this setting doesn't satisfy any Torbutton requirements, the fact that
cookies are transmitted for partially typed queries does not seem desirable
for Tor usage.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3021562"></a>5.8. Block Tor/Non-Tor access to network from file:// urls (recommended)</h3></div></div></div><p>Option:
+</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2526104"></a>5.8. Block Tor/Non-Tor access to network from file:// urls (recommended)</h3></div></div></div><p>Option:
</p><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="command"><strong>extensions.torbutton.block_tor_file_net</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_nontor_file_net</strong></span></td></tr></table><p>
</p><p>
@@ -651,7 +702,7 @@
operations in opposite Tor states. Also, allowing pages to submit arbitrary
files to arbitrary sites just generally seems like a bad idea.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3005056"></a>5.9. Close all Tor/Non-Tor tabs and windows on toggle (optional)</h3></div></div></div><p>Options:
+</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2496362"></a>5.9. Close all Tor/Non-Tor tabs and windows on toggle (optional)</h3></div></div></div><p>Options:
</p><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="command"><strong>extensions.torbutton.close_nontor</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.close_tor</strong></span></td></tr></table><p>
</p><p>
@@ -675,10 +726,10 @@
While this setting doesn't satisfy any Torbutton requirements, the fact that
cookies are transmitted for partially typed queries does not seem desirable
for Tor usage.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3005596"></a>5.10. Isolate Access to History navigation to Tor state (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.block_js_history</strong></span></p><p>
-This setting determines if Torbutton installs an <a class="ulink" href="http://www.xulplanet.com/references/xpcomref/ifaces/nsISHistoryListener.html" target="_top">nsISHistoryListener</a>
-attached to the <a class="ulink" href="http://www.xulplanet.com/references/xpcomref/ifaces/nsISHistory.html" target="_top">sessionHistory</a> of
-of each browser's <a class="ulink" href="http://www.xulplanet.com/references/xpcomref/comps/c_webshell1.html" target="_top">webNavigatator</a>.
+</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2496443"></a>5.10. Isolate Access to History navigation to Tor state (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.block_js_history</strong></span></p><p>
+This setting determines if Torbutton installs an <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsISHistoryListener" target="_top">nsISHistoryListener</a>
+attached to the <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsISHistory" target="_top">sessionHistory</a> of
+of each browser's <a class="ulink" href="https://developer.mozilla.org/en/XUL%3aProperty%3awebNavigation" target="_top">webNavigatator</a>.
The nsIShistoryListener is instantiated with a reference to the containing
browser window and blocks the back, forward, and reload buttons on the browser
navigation bar when Tor is in an opposite state than the one to load the
@@ -703,13 +754,13 @@
Separation</a> and (until Bug 409737 is fixed) <a class="link" href="#isolation">Network Isolation</a>
requirements.
- </p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3013147"></a>5.11. History Access Settings</h3></div></div></div><p>Options:
+ </p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2496530"></a>5.11. History Access Settings</h3></div></div></div><p>Options:
</p><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="command"><strong>extensions.torbutton.block_thread</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_nthread</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_thwrite</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_nthwrite</strong></span></td></tr></table><p>
</p><p>These four settings govern the behavior of the <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/ignore-history.js" target="_top">components/ignore-history.js</a>
history blocker component mentioned above. By hooking the browser's view of
-the history itself via the <a class="ulink" href="http://www.xulplanet.com/references/xpcomref/comps/c_browserglobalhistory2.html" target="_top">mozilla.org/browser/global-history;2</a>
-and <a class="ulink" href="http://www.xulplanet.com/references/xpcomref/comps/c_browsernavhistoryservice1.html" target="_top">@mozilla.org/browser/nav-history-service;1</a>
-components, this mechanism defeats all document-based <a class="ulink" href="http://gemal.dk/browserspy/css.html" target="_top">history disclosure
+the history itself via the <a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/browser/global-history;2" target="_top">@mozilla.org/browser/global-history;2</a>
+and <a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/browser/nav-history-service;1" target="_top">@mozilla.org/browser/nav-history-service;1</a>
+components, this mechanism defeats all document-based <a class="ulink" href="http://browserspy.dk/css.php" target="_top">history disclosure
attacks</a>, including <a class="ulink" href="http://ha.ckers.org/weird/CSS-history.cgi" target="_top">CSS-only attacks</a>.
The component also hooks functions involved in writing history to disk via
@@ -718,12 +769,12 @@
</p><p>
This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2998046"></a>5.12. Clear History During Tor Toggle (optional)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_history</strong></span></p><p>This setting governs if Torbutton calls
-<a class="ulink" href="http://www.xulplanet.com/references/xpcomref/ifaces/nsIBrowserHistory.html#method_removeAllPages" target="_top">nsIBrowserHistory.removeAllPages</a>
-and <a class="ulink" href="http://www.xulplanet.com/references/xpcomref/ifaces/nsISHistory.html#method_PurgeHistory" target="_top">nsISHistory.PurgeHistory</a>
+</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2496644"></a>5.12. Clear History During Tor Toggle (optional)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_history</strong></span></p><p>This setting governs if Torbutton calls
+<a class="ulink" href="https://developer.mozilla.org/en/nsIBrowserHistory#removeAllPages.28.29" target="_top">nsIBrowserHistory.removeAllPages</a>
+and <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsISHistory" target="_top">nsISHistory.PurgeHistory</a>
for each tab on Tor toggle.</p><p>
This setting is an optional way to help satisfy the <a class="link" href="#state">State Separation</a> requirement.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2998091"></a>5.13. Block Password+Form saving during Tor/Non-Tor</h3></div></div></div><p>Options:
+</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2496690"></a>5.13. Block Password+Form saving during Tor/Non-Tor</h3></div></div></div><p>Options:
</p><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="command"><strong>extensions.torbutton.block_tforms</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_ntforms</strong></span></td></tr></table><p>
</p><p>These settings govern if Torbutton disables
<span class="command"><strong>browser.formfill.enable</strong></span>
@@ -732,29 +783,29 @@
more important than it seems.
</p><p>
This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2998158"></a>5.14. Block Tor disk cache and clear all cache on Tor Toggle</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_cache</strong></span>
- </p><p>This option causes Torbutton to call <a class="ulink" href="http://www.xulplanet.com/references/xpcomref/ifaces/nsICacheService.html#method_evictEntries" target="_top">nsICacheService.evictEntries(0)</a>
+</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2496756"></a>5.14. Block Tor disk cache and clear all cache on Tor Toggle</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_cache</strong></span>
+ </p><p>This option causes Torbutton to call <a class="ulink" href="https://developer.mozilla.org/en/nsICacheService#evictEntries.28.29" target="_top">nsICacheService.evictEntries(0)</a>
on Tor toggle to remove all entries from the cache. In addition, this setting
causes Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Browser.cache.disk.enable" target="_top">browser.cache.disk.enable</a> to false.
</p><p>
This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2998213"></a>5.15. Block disk and memory cache during Tor</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.block_cache</strong></span></p><p>This setting
+</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2496811"></a>5.15. Block disk and memory cache during Tor</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.block_cache</strong></span></p><p>This setting
causes Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Browser.cache.memory.enable" target="_top">browser.cache.memory.enable</a>,
<a class="ulink" href="http://kb.mozillazine.org/Browser.cache.disk.enable" target="_top">browser.cache.disk.enable</a> and
<a class="ulink" href="http://kb.mozillazine.org/Network.http.use-cache" target="_top">network.http.use-cache</a> to false during tor usage.
</p><p>
This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2998270"></a>5.16. Clear Cookies on Tor Toggle</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_cookies</strong></span>
+</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2496868"></a>5.16. Clear Cookies on Tor Toggle</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_cookies</strong></span>
</p><p>
-This setting causes Torbutton to call <a class="ulink" href="http://www.xulplanet.com/references/xpcomref/ifaces/nsICookieManager.html#method_removeAll" target="_top">nsICookieManager.removeAll()</a> on
+This setting causes Torbutton to call <a class="ulink" href="https://developer.mozilla.org/en/nsICookieManager#removeAll.28.29" target="_top">nsICookieManager.removeAll()</a> on
every Tor toggle. In addition, this sets <a class="ulink" href="http://kb.mozillazine.org/Network.cookie.lifetimePolicy" target="_top">network.cookie.lifetimePolicy</a>
to 2 for Tor usage, which causes all cookies to be demoted to session cookies,
which prevents them from being written to disk.
</p><p>
This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2998324"></a>5.17. Store Non-Tor cookies in a protected jar</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.cookie_jars</strong></span>
+</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2496924"></a>5.17. Store Non-Tor cookies in a protected jar</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.cookie_jars</strong></span>
</p><p>
This setting causes Torbutton to use <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/cookie-jar-selector.js" target="_top">@stanford.edu/cookie-jar-selector;2</a> to store
@@ -767,15 +818,15 @@
</p><p>
This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2998384"></a>5.18. Store both Non-Tor and Tor cookies in a protected jar (dangerous)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.dual_cookie_jars</strong></span>
+</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2538465"></a>5.18. Store both Non-Tor and Tor cookies in a protected jar (dangerous)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.dual_cookie_jars</strong></span>
</p><p>
This setting causes Torbutton to use <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/cookie-jar-selector.js" target="_top">@stanford.edu/cookie-jar-selector;2</a> to store
both Tor and Non-Tor cookies into protected jars.
</p><p>
This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2998423"></a>5.19. Manage My Own Cookies (dangerous)</h3></div></div></div><p>Options: None</p><p>This setting disables all Torbutton cookie handling by setting the above
-cookie prefs all to false.</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2998439"></a>5.20. Disable DOM Storage during Tor usage (crucial)</h3></div></div></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2998441"></a>5.20.1. Do not write Tor/Non-Tor cookies to disk</h3></div></div></div><p>Options:
+</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2538503"></a>5.19. Manage My Own Cookies (dangerous)</h3></div></div></div><p>Options: None</p><p>This setting disables all Torbutton cookie handling by setting the above
+cookie prefs all to false.</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2538518"></a>5.20. Disable DOM Storage during Tor usage (crucial)</h3></div></div></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2538520"></a>5.20.1. Do not write Tor/Non-Tor cookies to disk</h3></div></div></div><p>Options:
</p><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="command"><strong>extensions.torbutton.tor_memory_jar</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.nontor_memory_jar</strong></span></td></tr></table><p>
</p><p>
These settings (contributed by arno) cause Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Network.cookie.lifetimePolicy" target="_top">network.cookie.lifetimePolicy</a>
@@ -795,13 +846,13 @@
<a class="ulink" href="http://developer.mozilla.org/en/docs/DOM:Storage" target="_top">DOM Storage</a> from
being used to store persistent information across Tor states.</p><p>
This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3040260"></a>5.21. Clear HTTP Auth on Tor Toggle (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_http_auth</strong></span>
+</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2538622"></a>5.21. Clear HTTP Auth on Tor Toggle (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_http_auth</strong></span>
</p><p>
-This setting causes Torbutton to call <a class="ulink" href="http://www.xulplanet.com/references/xpcomref/ifaces/nsIHttpAuthManager.html#method_clearAll" target="_top">nsIHttpAuthManager.clearAll()</a>
+This setting causes Torbutton to call <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsIHttpAuthManager" target="_top">nsIHttpAuthManager.clearAll()</a>
every time Tor is toggled.
</p><p>
This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3040298"></a>5.22. Clear cookies on Tor/Non-Tor shutdown</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.shutdown_method</strong></span>
+</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2538660"></a>5.22. Clear cookies on Tor/Non-Tor shutdown</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.shutdown_method</strong></span>
</p><p> This option variable can actually take 3 values: 0, 1, and 2. 0 means no
cookie clearing, 1 means clear only during Tor-enabled shutdown, and 2 means
clear for both Tor and Non-Tor shutdown. When set to 1 or 2, Torbutton listens
@@ -809,19 +860,19 @@
<code class="function">torbutton_uninstall_observer()</code> and use <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/cookie-jar-selector.js" target="_top">@stanford.edu/cookie-jar-selector;2</a>
to clear out all cookies and all cookie jars upon shutdown. </p><p>
This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3040352"></a>5.23. Reload cookie jar/clear cookies on Firefox crash</h3></div></div></div><p>Options:
+</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2538714"></a>5.23. Reload cookie jar/clear cookies on Firefox crash</h3></div></div></div><p>Options:
</p><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="command"><strong>extensions.torbutton.reload_crashed_jar</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.crashed</strong></span></td></tr></table><p>
</p><p>This is no longer a user visible option, and is enabled by default. In
the event of a crash, the Torbutton <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/crash-observer.js" target="_top">components/crash-observer.js</a>
component will notify the Chrome (via the
- <span class="command"><strong>extensions.torbutton.crashed</strong></span> pref and a <a class="ulink" href="http://www.xulplanet.com/references/xpcomref/ifaces/nsIPrefBranch2.html#method_addObserver" target="_top">pref
+ <span class="command"><strong>extensions.torbutton.crashed</strong></span> pref and a <a class="ulink" href="https://developer.mozilla.org/en/NsIPrefBranch2#addObserver.28.29" target="_top">pref
observer</a> in
the chrome that listens for this update), and Torbutton will load the
correct jar for the current Tor state via the <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/cookie-jar-selector.js" target="_top">@stanford.edu/cookie-jar-selector;2</a>
component.</p><p>
This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement in the event of Firefox
crashes.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3040427"></a>5.24. On crash recovery or session restored startup, restore via: Tor, Non-Tor</h3></div></div></div><p>Options:
+</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2538788"></a>5.24. On crash recovery or session restored startup, restore via: Tor, Non-Tor</h3></div></div></div><p>Options:
</p><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="command"><strong>extensions.torbutton.restore_tor</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.crashed</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.normal_exit</strong></span></td></tr></table><p>
</p><p>This option works with the Torbutton <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/crash-observer.js" target="_top">crash-observer.js</a>
to set the Tor state after a crash is detected (via the
@@ -837,7 +888,7 @@
requirement in the event of Firefox crashes by ensuring all cookies,
settings and saved sessions are reloaded from a fixed Tor state.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3040500"></a>5.25. On normal startup, set state to: Tor, Non-Tor, Shutdown State</h3></div></div></div><p>Options:
+</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2538861"></a>5.25. On normal startup, set state to: Tor, Non-Tor, Shutdown State</h3></div></div></div><p>Options:
</p><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="command"><strong>extensions.torbutton.startup_state</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.noncrashed</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.normal_exit</strong></span></td></tr></table><p>
</p><p>This option also works with the Torbutton <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/crash-observer.js" target="_top">crash-observer.js</a>
to set the Tor state after a normal startup is detected (via the
@@ -847,7 +898,7 @@
extensions.torbutton.normal_exit in torbutton_uninstall_observer() during
Firefox exit and checks this value as well during startup.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3040558"></a>5.26. Prevent session store from saving Non-Tor/Tor-loaded tabs</h3></div></div></div><p>Options:
+</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2538920"></a>5.26. Prevent session store from saving Non-Tor/Tor-loaded tabs</h3></div></div></div><p>Options:
</p><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="command"><strong>extensions.torbutton.nonontor_sessionstore</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.notor_sessionstore</strong></span></td></tr></table><p>
</p><p>If these options are enabled, the <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/nsSessionStore3.js" target="_top">replacement nsSessionStore.js</a>
component checks the <span class="command"><strong>__tb_tor_fetched</strong></span> tag of tabs before writing them
@@ -857,33 +908,31 @@
requirement, and also helps to satisfy the <a class="link" href="#state">State Separation</a> requirement in the event of Firefox
crashes.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3040623"></a>5.27. Set user agent during Tor usage (crucial)</h3></div></div></div><p>Options:
- </p><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="command"><strong>extensions.torbutton.set_uagent</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.oscpu_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.platform_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.productsub_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.appname_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.appversion_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.useragent_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.useragent_vendor</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.useragent_vendorSub</strong></span></td></tr></table><p>
+</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2538984"></a>5.27. Set user agent during Tor usage (crucial)</h3></div></div></div><p>Options:
+ </p><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="command"><strong>extensions.torbutton.set_uagent</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.platform_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.oscpu_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.buildID_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.productsub_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.appname_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.appversion_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.useragent_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.useragent_vendor</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.useragent_vendorSub</strong></span></td></tr></table><p>
</p><p>On face, user agent switching appears to be straight-forward in Firefox.
It provides several options for controlling the browser user agent string:
<span class="command"><strong>general.appname.override</strong></span>,
<span class="command"><strong>general.appversion.override</strong></span>,
<span class="command"><strong>general.platform.override</strong></span>,
+<span class="command"><strong>general.oscpu.override</strong></span>,
+<span class="command"><strong>general.productSub.override</strong></span>,
+<span class="command"><strong>general.buildID.override</strong></span>,
<span class="command"><strong>general.useragent.override</strong></span>,
<span class="command"><strong>general.useragent.vendor</strong></span>, and
<span class="command"><strong>general.useragent.vendorSub</strong></span>. If
the Torbutton preference <span class="command"><strong>extensions.torbutton.set_uagent</strong></span> is
true, Torbutton copies all of the other above prefs into their corresponding
-browser preferences during Tor usage.</p><p>However, this is not the whole story. Additionally, even with the above
-prefs set, the <span class="command"><strong>oscpu</strong></span>, <span class="command"><strong>buildID</strong></span>, and <span class="command"><strong>productSub</strong></span> fields of the
-<a class="ulink" href="http://developer.mozilla.org/en/docs/DOM:window.navigator" target="_top">navigator</a> object are not changed appropriately by the above prefs.
-Javascript hooks implemented in <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/chrome/content/jshooks.js" target="_top">chrome/content/jshooks.js</a> are installed as part of the
-same mechanism that hooks the date object.
-</p><p>
+browser preferences during Tor usage.</p><p>
It also turns out that it is possible to detect the original Firefox version
-by <a class="ulink" href="http://0x000000.com/index.php?i=523&bin=1000001011" target="_top">inspecting
+by <a class="ulink" href="http://ha.ckers.org/blog/20070516/read-firefox-settings-poc/" target="_top">inspecting
certain resource:// files</a>. These cases are handled by Torbutton's
<a class="link" href="#contentpolicy" title="@torproject.org/cssblocker;1 - components/cssblocker.js">content policy</a>.
</p><p>
This setting helps to satisfy the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> requirement.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3040811"></a>5.28. Spoof US English Browser</h3></div></div></div><p>Options:
+</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2539158"></a>5.28. Spoof US English Browser</h3></div></div></div><p>Options:
</p><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="command"><strong>extensions.torbutton.spoof_english</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.spoof_charset</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.spoof_language</strong></span></td></tr></table><p>
</p><p> This option causes Torbutton to set
<span class="command"><strong>general.useragent.locale</strong></span>
@@ -891,16 +940,16 @@
<span class="command"><strong>extensions.torbutton.spoof_locale</strong></span>,
<span class="command"><strong>extensions.torbutton.spoof_charset</strong></span> and
<span class="command"><strong>extensions.torbutton.spoof_language</strong></span> during Tor usage, as
-well as hooking <span class="command"><strong>navigator.language</strong></span> via its <a class="link" href="#jshooks" title="5.4. Hook Dangerous Javascript (crucial)">javascript hooks</a>.
+well as hooking <span class="command"><strong>navigator.language</strong></span> via its <a class="link" href="#jshooks" title="5.4. Hook Dangerous Javascript">javascript hooks</a>.
</p><p>
This setting helps to satisfy the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> and <a class="link" href="#location">Location Neutrality</a> requirements.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3040904"></a>5.29. Don't send referrer during Tor Usage</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.disable_referer</strong></span>
+</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2539251"></a>5.29. Don't send referrer during Tor Usage</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.disable_referer</strong></span>
</p><p>
This option causes Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Network.http.sendSecureXSiteReferrer" target="_top">network.http.sendSecureXSiteReferrer</a> and
<a class="ulink" href="http://kb.mozillazine.org/Network.http.sendRefererHeader" target="_top">network.http.sendRefererHeader</a> during Tor usage.</p><p>
This setting also does not directly satisfy any Torbutton requirement, but
some may desire to mask their referrer for general privacy concerns.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3040944"></a>5.30. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)</h3></div></div></div><p>Options:
+</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2539292"></a>5.30. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)</h3></div></div></div><p>Options:
</p><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="command"><strong>extensions.torbutton.jar_certs</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.jar_ca_certs</strong></span></td></tr></table><p>
</p><p>
@@ -909,8 +958,8 @@
implemented in <code class="function">torbutton_jar_certs()</code> in <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/chrome/content/torbutton.js" target="_top">chrome/content/torbutton.js</a>,
which calls <code class="function">torbutton_jar_cert_type()</code> and
<code class="function">torbutton_unjar_cert_type()</code> for each certificate type in
-the <a class="ulink" href="http://www.xulplanet.com/references/xpcomref/comps/c_securitynsscertcache1.html" target="_top">@mozilla.org/security/nsscertcache;1</a>.
-Certificates are deleted from and imported to the <a class="ulink" href="http://www.xulplanet.com/references/xpcomref/comps/c_securityx509certdb1.html" target="_top">@mozilla.org/security/x509certdb;1</a>.
+the <a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/security/nsscertcache;1" target="_top">@mozilla.org/security/nsscertcache;1</a>.
+Certificates are deleted from and imported to the <a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/security/x509certdb;1" target="_top">@mozilla.org/security/x509certdb;1</a>.
</p><p>
The first time this pref is used, a backup of the user's certificates is
created in their profile directory under the name
@@ -937,32 +986,22 @@
</p><div class="orderedlist"><ol type="1"><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=392274" target="_top">Bug 392274 - Timezone
config/chrome API</a><p>
+
The lack of a config or API to configure the timezone requires Torbutton to
-<a class="link" href="#jshooks" title="5.4. Hook Dangerous Javascript (crucial)">insert client content window javascript</a> to hook
+<a class="link" href="#jshooks" title="5.4. Hook Dangerous Javascript">insert client content window javascript</a> to hook
the Date object. Additionally, a way to <a class="ulink" href="http://pseudo-flaw.net/tor/torbutton/unmask-date.html" target="_top">remove the Date
hooks</a> was discovered by Greg Fleischer. Worse, on Firefox 3,
javascript sandboxing prevents most of the javascript hooks from being
installed, including the Date hooks. On Windows and Linux, you can set the TZ
environment variable to "UTC" as a workaround. Firefox will obey this
environment variable for your Timezone on those platforms, but on Windows this
-does not take effect until browser restart. The lack of an easy way to reliably
-spoof the timezone interferes with Torbutton's ability to fulfill its
-<a class="link" href="#location">Location Neutrality</a> requirement.
+does not take effect until browser restart. A fix for this has landed in
+Firefox 3.5, but still has not been backported to Firefox 3.0. The lack of an
+easy way to reliably spoof the timezone interferes with Torbutton's ability to
+fulfill its <a class="link" href="#location">Location Neutrality</a> requirement.
- </p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=436250" target="_top">Bug 436250 - Livemarks can't be
-disabled at runtime</a><p>
-
-The RSS Feed based "Livemarks"/"Live Bookmarks" update frequency is controlled
-by the pref <span class="command"><strong>browser.bookmarks.livemark_refresh_seconds</strong></span>.
-However, changing this preference does not cancel any pending timers, which
-means that at least one livemarks pref fetch will happen over Tor, and once
-this pref is set to disable livemarks for Tor, changing it back will never
-cause the service to start back up again. The
-leakage of Livemarks interferes with Torbutton's ability to fulfill
-the <a class="link" href="#isolation">Network Isolation</a> requirement.
-
- </p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=435159" target="_top">Bug 435159 -
+ </p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=435159" target="_top">Bug 435159 -
nsNSSCertificateDB::DeleteCertificate has race conditions</a><p>
In Torbutton 1.2.0rc1, code was added to attempt to isolate SSL certificates
@@ -991,34 +1030,11 @@
them, pages may still have free reign to break that requirement and reveal a
user's original IP address.
- </p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=405652" target="_top">Bug 405652 - In the
-TLS ClientHello message the gmt_unix_time is incorrect</a><p>
-
-It turns out that Firefox's SSL implementation sends the machine uptime as the
-current time. This essentially is a unique identifier that can be used for
-the duration of your machine uptime. The issue has been fixed in Firefox 3.0,
-but it has as of yet not been backported to 2.0.
-This interferes with Torbutton's ability to fulfill
-its <a class="link" href="#state">State Separation</a> requirement on Firefox 2.
-
- </p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=448747" target="_top">Bug 448747 -
-Provide Mechanism to clear TLS Session IDs</a><p>
-
-In comments on the above bug, it was mentioned that TLS Session IDs can
-persist for an indefinite duration, providing an identifier that is sent to
-TLS sites that can be used to link activity. This is particularly troublesome
-now that we have certificate verification in place in Firefox 3: The OCSP
-server can use this Session ID to build a history of TLS sites someone visits,
-and also correlate their activity as users move from network to network (such
-as home to work to coffee shop, etc), inside and outside of Tor. This
-interferes with Torbutton's ability to fulfill its <a class="link" href="#state">State
-Separation</a> requirement.
-
</p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=448743" target="_top">Bug 448743 -
Decouple general.useragent.locale from spoofing of navigator.language</a><p>
Currently, Torbutton spoofs the <span class="command"><strong>navigator.language</strong></span>
-attribute via <a class="link" href="#jshooks" title="5.4. Hook Dangerous Javascript (crucial)">Javascript hooks</a>. Unfortunately,
+attribute via <a class="link" href="#jshooks" title="5.4. Hook Dangerous Javascript">Javascript hooks</a>. Unfortunately,
these do not work on Firefox 3. It would be ideal to have
a pref to set this value (something like a
<span class="command"><strong>general.useragent.override.locale</strong></span>),
@@ -1026,35 +1042,12 @@
impedes Torbutton from fully meeting its <a class="link" href="#setpreservation">Anonymity Set Preservation</a>
requirement on Firefox 3.
- </p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=143220" target="_top">Bug 143220 - Script can get the value of a file control, including the path</a><p>
-
-Javascript can query the .value field of file input dialogs to retrieve
-username and sometimes hostname/workgroup information. This is obviously very
-dangerous for people who are attempting to submit files anonymously via
-webforms (ie whistleblowers and anonymous publishers). It is also fixed in
-Firefox 3.0, but has not yet been backported to 2.0. This interferes with
-Torbutton's ability to fulfill its <a class="link" href="#state">State
-Separation</a> and <a class="link" href="#setpreservation">Anonymity Set
-Preservation</a> requirements on Firefox 2.0.
-
- </p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=418119" target="_top">Bug 418119 - nsIContentPolicy not called for external DTDs of XML documents</a><p>
-
-XML documents can source chrome and resource URLs in their DTDs without a call
-to nsIContentPolicy::shouldLoad. Enumerating chrome URLs gives websites and
-exit nodes a lot of information. They can use it to probe for vulnerable
-versions of extensions, and can also use it to build an <a class="link" href="#fingerprinting">identifier for tracking purposes</a>. This bug
-makes it impossible for extensions such as Adblock and Torbutton to prevent
-chrome inspection and enumeration. It is also fixed in Firefox 3.0, but has not yet been backported to 2.0. This
-impedes upon Torbutton's ability to fulfill its <a class="link" href="#undiscoverability">Tor Undiscoverability</a> and
-<a class="link" href="#setpreservation">Anonymity Set Preservation</a> requirements
-on Firefox 2.0.
-
- </p></li></ol></div></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="FirefoxWishlist"></a>6.2. Bugs blocking functionality</h3></div></div></div><p>
+ </p></li></ol></div></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="FirefoxWishlist"></a>6.2. Bugs blocking functionality</h3></div></div></div><p>
The following bugs impact Torbutton and similar extensions' functionality.
</p><div class="orderedlist"><ol type="1"><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=445696" target="_top">Bug 445696 -
Extensions cannot determine if firefox is fullScreen</a><p>
-The windowState property of <a class="ulink" href="http://www.xulplanet.com/references/objref/ChromeWindow.html" target="_top">ChromeWindows</a> does not accurately reflect the true
+The windowState property of <a class="ulink" href="https://developer.mozilla.org/en/XUL/window" target="_top">ChromeWindows</a> does not accurately reflect the true
state of the window in some cases on Linux. This causes Torbutton to attempt
to resize maximized and minimized windows when it should not.
@@ -1064,8 +1057,9 @@
Today, it is possible to allow plugins if you have a transparent proxy such as
<a class="ulink" href="http://anonymityanywhere.com/incognito/" target="_top">Incognito</a> to prevent proxy bypass. However, flash cookies can still be used to
link your Tor and Non-Tor activity, and this reveal your IP to an adversary
-that does so. This can be solved by manually removing your flash cookies, but
-it would be nice if there was a standard way to do this from a Firefox API.
+that does so. This can be solved by manually removing your flash cookies (like
+<a class="ulink" href="https://addons.mozilla.org/en-US/firefox/addon/6623" target="_top">BetterPrivacy</a> does), but
+it would be nice if there was a standard way to do this from a Firefox API.
</p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=417869" target="_top">Bug 417869 -
Browser context is difficult to obtain from many XPCOM callbacks</a><p>
@@ -1084,35 +1078,6 @@
Avoidance</a> requirements. Workarounds exist, but they are <a class="link" href="#sessionstore" title="@mozilla.org/browser/sessionstore;1 - components/nsSessionStore2.js and components/nsSessionStore3.js">clunky</a>, and
some of them involve disabling functionality during Tor usage.
- </p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=448741" target="_top">Bug 448741 -
-nsISessionStore uses private methods and is not extensible</a><p>
-
-Similar to the above bug, in the specific case of the sessionstore component,
-the API is not amenable to Contract ID hooking, and this requires that
-Torbutton include modified copies of this component for Firefox 2 and 3, which
-has <a class="ulink" href="https://bugs.torproject.org/flyspray/index.php?do=details&id=722" target="_top">raised
-objections</a> from some developers.
-
- </p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=439384" target="_top">Bug 439384 -
-"profile-do-change" event does not cause cookie table reload</a><p>
-
-In Firefox 3, the change to the new SQLlite database for cookie storage has a
-bug that prevents Torbutton's cookie jaring from working properly. The
-"profile-do-change" observer event no longer properly causes either a sync or
-reload of the cookie database from disk after it is copied into place.
-Torbutton currently works around this by issuing the SQLLite queries manually
-to store and rebuild the cookie database.
-
- </p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=248970" target="_top">Bug 248970 (PrivateBrowsing) - Private Browsing mode (global toggle for
-saving/caching everything)</a><p>
-
-This bug catalogs the discussion of a 'Private Mode' in Firefox that would
-perform many, but not all, of the activities of Torbutton. It would be useful
-to leverage the resulting setting to simplify Torbutton. This bug is listed so
-we can track this progress and ensure that it doesn't end up defining
-behaviors contrary to and incompatible with Torbutton's requirements (though a
-subset of the <a class="link" href="#requirements" title="1.2. Torbutton Requirements">requirements</a> is of course fine).
-
</p></li></ol></div></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="FirefoxMiscBugs"></a>6.3. Low Priority Bugs</h3></div></div></div><p>
The following bugs have an effect upon Torbutton, but are superseded by more
practical and more easily fixable variant bugs above; or have stable, simple
@@ -1127,6 +1092,17 @@
extensions may be interested in the sandbox hooking functionality working
properly though.
+ </p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=440892" target="_top">Bug 440892 -
+network.protocol-handler.warn-external are ignored</a><p>
+
+Sometime in the Firefox 3 development cycle, the preferences that governed
+warning a user when external apps were launched got disconnected from the code
+that does the launching. Torbutton depended on these prefs to prevent websites
+from launching specially crafted documents and application arguments that
+caused Proxy Bypass. We currently work around this issue by <a class="link" href="#appblocker" title="@mozilla.org/uriloader/external-protocol-service;1 and @mozilla.org/uriloader/external-helper-app-service;1 - components/external-app-blocker.js">wrapping the app launching components</a> to present a
+popup before launching external apps while Tor is enabled. While this works,
+it would be nice if these prefs were either fixed or removed.
+
</p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=437014" target="_top">Bug 437014 -
nsIContentPolicy::shouldLoad no longer called for favicons</a><p>
@@ -1179,6 +1155,16 @@
perform this workaround has been subverted at least once already by Kyle
Williams.
+ </p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=448747" target="_top">Bug 448747 -
+Provide Mechanism to clear TLS Session IDs</a><p>
+
+As <a class="link" href="#browseroverlay" title="3.1. Browser Overlay - torbutton.xul">mentioned above</a>, Torbutton currently
+toggles <span class="command"><strong>security.enable_ssl2</strong></span> to clear the SSL
+Session ID cache via the pref observer at <a class="ulink" href="http://mxr.mozilla.org/security/source/security/manager/ssl/src/nsNSSComponent.cpp#2134" target="_top">nsNSSComponent.cpp
+line 2134</a>. This is an arcane and potentially fragile fix. It would be
+better if there were a more standard interface for accomplishing the same
+thing.
+
</p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=419598" target="_top">Bug 419598 - 'var
Date' is deletable</a><p>
@@ -1229,62 +1215,88 @@
page, and for developing novel tests and actively attacking Torbutton with the
goal of finding vulnerabilities in either it or the Mozilla components,
interfaces and settings upon which it relies.
-
+
</p><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="Categories"></a>7.1. Single state testing</h3></div></div></div><p>
-The following tests can be run from a single web page in one visit without
-toggling Tor state or requiring user interaction. Currently they exist as their
-own individual tests, but conceivably a single "Tor Safety Check"
-page can be devised that contains all of these attacks.
-All of these tests are currently known to pass, but that does not mean that
-consolidating them into an easy to run test page is pointless. Torbutton is a
-complicated piece of software. During development, changes to one component
-can affect a whole slough of unrelated features. Having easy-to-verify
-comprehensive test pages would make it much easier to fix other issues as they
-present themselves without introducing regressions.
- </p><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id3041910"></a>Java and Plugin Decloaking</h4></div></div></div><p>
-As <a class="link" href="#plugins" title="5.2. Disable plugins on Tor Usage (crucial)">mentioned above</a>, Java and plugins <a class="ulink" href="http://java.sun.com/j2se/1.5.0/docs/api/java/net/class-use/NetworkInterface.html" target="_top">can query</a> the <a class="ulink" href="http://www.rgagnon.com/javadetails/java-0095.html" target="_top">local IP
-address</a> and report it back to the
-remote site. They can also <a class="ulink" href="http://www.metasploit.com/research/projects/decloak/" target="_top">bypass proxy settings</a> and directly connect to a
-remote site without Tor. Every browser plugin we have tested with Firefox has
-some form of network capability, and every one ignores proxy settings or worse - only
-partially obeys them. This includes but is not limited to:
-QuickTime, Windows Media Player, RealPlayer, mplayerplug-in, AcroRead, and
-Flash. In addition,
-<a class="ulink" href="http://www.janusvm.com/goldy/pdf/" target="_top">issues have been
-discovered</a> with the browsers handling of
-<a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=401296" target="_top">direct links to plugin-handled
-content</a> as well as meta-refreshes to plugin content. To make matters
-worse, <a class="ulink" href="http://www.janusvm.com/goldy/side-channels/side-channels.html" target="_top">externally
-handled mime types and urls</a> can also cause direct non-Tor connections
-as well.
- </p></div><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id3041974"></a>History Disclosure attacks</h4></div></div></div><p>
-The browser's history can also be queried by a remote site to inspect for
-Google queries, visits to sites that contain usernames in the URLs, or
-other anonymity set reducing information. This can be done by either
-<a class="ulink" href="http://gemal.dk/browserspy/css.html" target="_top">Javascript</a>, or by
-<a class="ulink" href="http://ha.ckers.org/weird/CSS-history.cgi" target="_top">CSS</a> without any scripting involved.
+Torbutton is a complicated piece of software. During development, changes to
+one component can affect a whole slough of unrelated features. A number of
+aggregated test suites exist that can be used to test for regressions in
+Torbutton and to help aid in the development of Torbutton-like addons and
+other privacy modifications of other browsers. Some of these test suites exist
+as a single automated page, while others are a series of pages you must visit
+individually. They are provided here mostly for reference and future
+regression testing.
- </p></div><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id3042000"></a>User agent, extension, resolution and OS information</h4></div></div></div><p>
+ </p><div class="orderedlist"><ol type="1"><li><a class="ulink" href="http://decloak.net/" target="_top">Decloak.net</a><p>
-As mentioned above, these properties can be combined to greatly reduce
-anonymity set and even build a potentially <a class="link" href="#fingerprinting">globally unique identifier</a> for
-users. <a class="ulink" href="http://0x000000.com/index.php?i=520&bin=1000001000" target="_top">Examples of this
-in the wild</a> rely on <a class="ulink" href="http://gemal.dk/browserspy/basic.html" target="_top">user agent and OS
-information</a> as well as <a class="ulink" href="http://pseudo-flaw.net/content/tor/torbutton/" target="_top">chrome disclosure
-information</a>.
+Decloak.net is the canonical source of plugin and external-application based
+proxy-bypass exploits. It is a fully automated test suite maintained by <a class="ulink" href="http://digitaloffense.net/" target="_top">HD Moore</a> as a service for people to
+use to test their anonymity systems.
- </p></div><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id3042038"></a>Timezone and Location Information</h4></div></div></div><p>
-<a class="ulink" href="http://gemal.dk/browserspy/date.html" target="_top">Time and Timezone</a>
-should be obscured to be GMT-only, and by the browser should present itself
-with an US English locale.
- </p></div></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3042058"></a>7.2. Multi-state testing</h3></div></div></div><p>
+ </p></li><li><a class="ulink" href="http://deanonymizer.com/" target="_top">Deanonymizer.com</a><p>
+Deanonymizer.com is another automated test suite that tests for proxy bypass
+and other information disclosure vulnerabilities. It is maintained by Kyle
+Williams, the author of <a class="ulink" href="http://www.janusvm.com/" target="_top">JanusVM</a>
+and <a class="ulink" href="http://www.januspa.com/" target="_top">JanusPA</a>.
+
+ </p></li><li><a class="ulink" href="https://www.jondos.de/en/anontest" target="_top">JonDos
+AnonTest</a><p>
+
+The <a class="ulink" href="https://www.jondos.de" target="_top">JonDos people</a> also provide an
+anonymity tester. It is more focused on HTTP headers than plugin bypass, and
+points out a couple of headers Torbutton could do a better job with
+obfuscating.
+
+ </p></li><li><a class="ulink" href="http://browserspy.dk" target="_top">Browserspy.dk</a><p>
+
+Browserspy.dk provides a tremendous collection of browser fingerprinting and
+general privacy tests. Unfortunately they are only available one page at a
+time, and there is not really solid feedback on good vs bad behavior in
+the test results.
+
+ </p></li><li><a class="ulink" href="http://analyze.privacy.net/" target="_top">Privacy
+Analyzer</a><p>
+
+The Privacy Analyzer provides a dump of all sorts of browser attributes and
+settings that it detects, including some information on your origin IP
+address. Its page layout and lack of good vs bad test result feedback makes it
+not as useful as a user-facing testing tool, but it does provide some
+interesting checks in a single page.
+
+ </p></li><li><a class="ulink" href="http://ha.ckers.org/mr-t/" target="_top">Mr. T</a><p>
+
+Mr. T is a collection of browser fingerprinting and deanonymization exploits
+discovered by the <a class="ulink" href="http://ha.ckers.org" target="_top">ha.ckers.org</a> crew
+and others. It is also not as user friendly as some of the above tests, but it
+is a useful collection.
+
+ </p></li><li>Gregory Fleischer's <a class="ulink" href="http://pseudo-flaw.net/content/tor/torbutton/" target="_top">Torbutton</a> and
+<a class="ulink" href="http://pseudo-flaw.net/content/defcon/dc-17-demos/d.html" target="_top">Defcon
+17</a> Test Cases
+ <p>
+
+Gregory Fleischer has been hacking and testing Firefox and Torbutton privacy
+issues for the past 2 years. He has an excellent collection of all his test
+cases that can be used for regression testing. In his Defcon work, he
+demonstrates ways infer Firefox version based on arcane browser properties. We
+are still trying to determine the best way to address some of those test
+cases.
+
+ </p></li><li><a class="ulink" href="https://torcheck.xenobite.eu/index.php" target="_top">Xenobite's
+TorCheck Page</a><p>
+
+As of this writing, this page is currently down. However, people seem to use
+it for testing Tor usage and Torbutton, so it must be useful to some degree.
+
+ </p></li></ol></div><p>
+ </p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2540301"></a>7.2. Multi-state testing</h3></div></div></div><p>
+
The tests in this section are geared towards a page that would instruct the
user to toggle their Tor state after the fetch and perform some operations:
mouseovers, stray clicks, and potentially reloads.
- </p><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id3042070"></a>Cookies and Cache Correlation</h4></div></div></div><p>
+ </p><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id2540313"></a>Cookies and Cache Correlation</h4></div></div></div><p>
The most obvious test is to set a cookie, ask the user to toggle tor, and then
have them reload the page. The cookie should no longer be set if they are
using the default Torbutton settings. In addition, it is possible to leverage
@@ -1292,11 +1304,11 @@
identifiers</a>. The default settings of Torbutton should also protect
against these from persisting across Tor Toggle.
- </p></div><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id3042093"></a>Javascript timers and event handlers</h4></div></div></div><p>
+ </p></div><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id2540336"></a>Javascript timers and event handlers</h4></div></div></div><p>
Javascript can set timers and register event handlers in the hopes of fetching
URLs after the user has toggled Torbutton.
- </p></div><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id3042105"></a>CSS Popups and non-script Dynamic Content</h4></div></div></div><p>
+ </p></div><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id2540349"></a>CSS Popups and non-script Dynamic Content</h4></div></div></div><p>
Even if Javascript is disabled, CSS is still able to
<a class="ulink" href="http://www.tjkdesign.com/articles/css%20pop%20ups/" target="_top">create popup-like
@@ -1306,7 +1318,7 @@
possible for meta-refresh tags to set timers long enough to make it likely
that the user has toggled Tor before fetching content.
- </p></div></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3042129"></a>7.3. Active testing (aka How to Hack Torbutton)</h3></div></div></div><p>
+ </p></div></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2540372"></a>7.3. Active testing (aka How to Hack Torbutton)</h3></div></div></div><p>
The idea behind active testing is to discover vulnerabilities in Torbutton to
bypass proxy settings, run script in an opposite Tor state, store unique
@@ -1321,12 +1333,11 @@
submitting the test cases back to be run in the standard batch of Torbutton
tests.
- </p><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id3042158"></a>Some suggested vectors to investigate</h4></div></div></div><p>
+ </p><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id2540402"></a>Some suggested vectors to investigate</h4></div></div></div><p>
</p><div class="itemizedlist"><ul type="disc"><li>Strange ways to register Javascript <a class="ulink" href="http://en.wikipedia.org/wiki/DOM_Events" target="_top">events</a> and <a class="ulink" href="http://www.devshed.com/c/a/JavaScript/Using-Timers-in-JavaScript/" target="_top">timeouts</a> should
be verified to actually be ineffective after Tor has been toggled.</li><li>Other ways to cause Javascript to be executed after
<span class="command"><strong>javascript.enabled</strong></span> has been toggled off.</li><li>Odd ways to attempt to load plugins. Kyle Williams has had
-<a class="ulink" href="http://www.janusvm.com/goldy/pdf/" target="_top">some
-success</a> with direct loads/meta-refreshes of plugin-handled URLs.</li><li>The Date and Timezone hooks should be verified to work with
+some success with direct loads/meta-refreshes of plugin-handled URLs.</li><li>The Date and Timezone hooks should be verified to work with
crazy combinations of iframes, nested iframes, iframes in frames, frames in
iframes, and popups being loaded and
reloaded in rapid succession, and/or from one another. Think race conditions and deep,
More information about the tor-commits
mailing list