[ux] Fwd: Mobile Tor Browser branding discussion

[Nathan of Guardian]

On Mon, May 23, 2016, at 06:01 AM, Georg Koppen wrote:
> > The only caveat is that this Tor Browser on mobile, is never going to
> > have the security features of the Tor Browser on desktop. At least not
> > anytime soon.
> 
> I don't think this is true. All Tor Browser promises is to behave
> according to its design specification, not more and not less. If you
> take a look at https://www.torproject.org/projects/torbrowser/design/
> and read section 2 and 3 carefully then I think it gets obvious that
> there should be no *technical* reason for not having a Tor Browser on
> Android in general. 

It is great to hear that you think we can achieve parity. I had started
giving up on that goal, to be honest, partly due to limited resources
and need to get some better solution out there than Orweb offered. 

One of the main issues I have concern with still is around browser
fingerprinting vectors for things like window size, that we can't
control at all on mobile. Perhaps that will turn out to be a small
enough set, that we all are comfortable with it being on the short list
of caveats.

> security if we maintain that they are safer with Tor Browser on those
> platforms given an adversary that is able to exploit the underlying
> processes and OSes: there are OS update checks bypassing Tor Browser by
> phoning home. There are at least closed-source OSes like Windows and OS
> X which could serve you any update that subverts your environment etc...

I agree with this, as well, that I don't see how desktop OSes,
especially these days with their move towards app store-like, always
connected/auto-upgrade situations, are any better than the challenges
that Android poses.

> What currently prevents OrFox from being relabled and rebranded as "Tor
> Browser" has non-technical reasons: OrFox is not being developed/has not
> been fully reviewed and fully endorsed by the Tor Project. But that

I think by this you mean "paid staff and contractors working on Tor
Browser", because as has been stated in the past, I am as much member of
the Tor Project as anyone. Additionally Tor has provided two GSoC slots
for Orfox in the last three years, and through that process and work in
between, we have aimed for as much technical excellence as possible. 
The use of the Orfox name should not imply any less endorsement or
technical merit, but instead, it was our practical acceptance that we
hadn't yet earned the name Tor Browser, in terms of capabilities offered
and living up to the design document spec.

> could be worked out, I guess, and would allow the big win of having a
> unified and easily recognizable brand across desktop and mobile
> platforms.

Sounds great to me. Look forward to sorting out the remaining details to
make this happen.

+n



-- 
  Nathan of Guardian
  nathan at guardianproject.info