New Release: Tor Browser 8.5

by boklm | May 21, 2019

[Update 5/22/2019 8:18 UTC: Added issue with saved passwords and logins that vanished to Known Issues section.]

Tor Browser 8.5 is now available from the Tor Browser download page and also from our distribution directory. The Android version is also available from Google Play and should be available from F-Droid within the next day.

This release features important security updates to Firefox.

After months of work and including feedback from our users, Tor Browser 8.5 includes our first stable release for Android plus many new features across platforms.

It's Official: Tor Browser is Stable on Android

Tor Browser 8.5 is the first stable release for Android. Since we released the first alpha version in September, we've been hard at work making sure we can provide the protections users are already enjoying on desktop to the Android platform. Mobile browsing is increasing around the world, and in some parts, it is commonly the only way people access the internet. In these same areas, there is often heavy surveillance and censorship online, so we made it a priority to reach these users.

Tor Browser for Android

We made sure there are no proxy bypasses, that first-party isolation is enabled to protect you from cross-site tracking, and that most of the fingerprinting defenses are working. While there are still feature gaps between the desktop and Android Tor Browser, we are confident that Tor Browser for Android provides essentially the same protections that can be found on desktop platforms.

Thanks to everyone working on getting our mobile experience into shape, in particular to Antonela, Matt, Igor, and Shane.

Note: Though we cannot bring an official Tor Browser to iOS due to restrictions by Apple, the only app we recommend is Onion Browser, developed by Mike Tigas with help from the Guardian Project.

Improved Security Slider Accessibility

Our security slider is an important tool for Tor Browser users, especially for those with sensitive security needs. However, its location behind the Torbutton menu made it hard to access.

Tor Browser Security

During the Tor Browser 8.5 development period, we revamped the experience so now the chosen security level appears on the toolbar. You can interact with the slider more easily now. For the fully planned changes check out proposal 101.

A Fresh Look

We made Tor Browser 8.5 compatible with Firefox's Photon UI and redesigned our logos and about:tor page across all the platforms we support to provide the same look and feel and improve accessibility.

Tor Browser icons

The new Tor Browser icon was chosen through a round of voting in our community.

We'd like to give a big thanks to everyone who helped make this release possible, including our users, who gave valuable feedback to our alpha versions.

Known Issues

Tor Browser 8.5 comes with a number of known issues. The most important ones are:

  1. While we improved accessibility support for Windows users during our 8.5 stabilization, it's still not perfect. We are in the process of finishing patches for inclusion in an 8.5 point release. We are close here.
  2. There are bug reports about WebGL related fingerprinting which we are investigating. We are currently testing a fix for the most problematic issue and will ship that in the next point release.
  3. The upgrade to Tor Browser 8.5 broke saved logins and passwords. We are investigating this bug and hope to provide a fix in an upcoming point release.

We already collected a number of unresolved bugs since releasing Tor Browser 8 and tagged them with our tbb-8.0-issues keyword to keep them on our radar. Check them out before reporting if you find a bug.

Give Feedback

In addition to the known issues, we are always looking for feedback about ways we can make our software better for you. If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full Changelog

The full changelog since Tor Browser 8.0.9 is:

  • All platforms
    • Update Firefox to 60.7.0esr
    • Update Torbutton to 2.1.8
      • Bug 25013: Integrate Torbutton into tor-browser for Android
      • Bug 27111: Update about:tor desktop version to work on mobile
      • Bug 22538+22513: Fix new circuit button for error pages
      • Bug 25145: Update circuit display when back button is pressed
      • Bug 27749: Opening about:config shows circuit from previous website
      • Bug 30115: Map browser+domain to credentials to fix circuit display
      • Bug 25702: Update Tor Browser icon to follow design guidelines
      • Bug 21805: Add click-to-play button for WebGL
      • Bug 28836: Links on about:tor are not clickable
      • Bug 30171: Don't sync cookie.cookieBehavior and firstparty.isolate
      • Bug 29825: Intelligently add new Security Level button to taskbar
      • Bug 29903: No WebGL click-to-play on the standard security level
      • Bug 27290: Remove WebGL pref for min capability mode
      • Bug 25658: Replace security slider with security level UI
      • Bug 28628: Change onboarding Security panel to open new Security Level panel
      • Bug 29440: Update about:tor when Tor Browser is updated
      • Bug 27478: Improved Torbutton icons for dark theme
      • Bug 29239: Don't ship the Torbutton .xpi on mobile
      • Bug 27484: Improve navigation within onboarding (strings)
      • Bug 29768: Introduce new features to users (strings)
      • Bug 28093: Update donation banner style to make it fit in small screens
      • Bug 28543: about:tor has scroll bar between widths 900px and 1000px
      • Bug 28039: Enable dump() if log method is 0
      • Bug 27701: Don't show App Blocker dialog on Android
      • Bug 28187: Change tor circuit icon to torbutton.svg
      • Bug 29943: Use locales in AB-CD scheme to match Mozilla
      • Bug 26498: Add locale: es-AR
      • Bug 28082: Add locales cs, el, hu, ka
      • Bug 29973: Remove remaining stopOpenSecuritySettingsObserver() pieces
      • Bug 28075: Tone down missing SOCKS credential warning
      • Bug 30425: Revert armagadd-on-2.0 changes
      • Bug 30497: Add Donate link to about:tor
      • Bug 30069: Use slider and about:tor localizations on mobile
      • Bug 21263: Remove outdated information from the README
      • Bug 28747: Remove NoScript (XPCOM) related unused code
      • Translations update
      • Code clean-up
    • Update HTTPS Everywhere to 2019.5.6.1
    • Bug 27290: Remove WebGL pref for min capability mode
    • Bug 29120: Enable media cache in memory
    • Bug 24622: Proper first-party isolation of s3.amazonaws.com
    • Bug 29082: Backport patches for bug 1469916
    • Bug 28711: Backport patches for bug 1474659
    • Bug 27828: "Check for Tor Browser update" doesn't seem to do anything
    • Bug 29028: Auto-decline most canvas warning prompts again
    • Bug 27919: Backport SSL status API
    • Bug 27597: Fix our debug builds
    • Bug 28082: Add locales cs, el, hu, ka
    • Bug 26498: Add locale: es-AR
    • Bug 29916: Make sure enterprise policies are disabled
    • Bug 29349: Remove network.http.spdy.* overrides from meek helper user.js
    • Bug 29327: TypeError: hostName is null on about:tor page
    • Bug 30425: Revert armagadd-on-2.0 changes
  • Windows + OS X + Linux
    • Update OpenSSL to 1.0.2r
    • Update Tor Launcher to 0.2.18.3
      • Bug 27994+25151: Use the new Tor Browser logo
      • Bug 29328: Account for Tor 0.4.0.x's revised bootstrap status reporting
      • Bug 22402: Improve "For assistance" link
      • Bug 27994: Use the new Tor Browser logo
      • Bug 25405: Cannot use Moat if a meek bridge is configured
      • Bug 27392: Update Moat URLs
      • Bug 28082: Add locales cs, el, hu, ka
      • Bug 26498: Add locale es-AR
      • Bug 28039: Enable dump() if log method is 0
      • Translations update
    • Bug 25702: Activity 1.1 Update Tor Browser icon to follow design guidelines
    • Bug 28111: Use Tor Browser icon in identity box
    • Bug 22343: Make 'Save Page As' obey first-party isolation
    • Bug 29768: Introduce new features to users
    • Bug 27484: Improve navigation within onboarding
    • Bug 25658+29554: Replace security slider with security level UI
    • Bug 25405: Cannot use Moat if a meek bridge is configured
    • Bug 28885: notify users that update is downloading
    • Bug 29180: MAR download stalls when about dialog is opened
    • Bug 27485: Users are not taught how to open security-slider dialog
    • Bug 27486: Avoid about:blank tabs when opening onboarding pages
    • Bug 29440: Update about:tor when Tor Browser is updated
    • Bug 23359: WebExtensions icons are not shown on first start
    • Bug 28628: Change onboarding Security panel to open new Security Level panel
    • Bug 27905: Fix many occurrences of "Firefox" in about:preferences
    • Bug 28369: Stop shipping pingsender executable
    • Bug 30457: Remove defunct default bridges
  • Windows
    • Bug 27503: Improve screen reader accessibility
    • Bug 27865: Tor Browser 8.5a2 is crashing on Windows
    • Bug 22654: Firefox icon is shown for Tor Browser on Windows 10 start menu
    • Bug 28874: Bump mingw-w64 commit to fix WebGL crash
    • Bug 12885: Windows Jump Lists fail for Tor Browser
    • Bug 28618: Set MOZILLA_OFFICIAL for Windows build
    • Bug 21704: Abort install if CPU is missing SSE2 support
  • OS X
    • Bug 27623: Use MOZILLA_OFFICIAL for our builds
  • Linux
    • Bug 28022: Use `/usr/bin/env bash` for bash invocation
    • Bug 27623: Use MOZILLA_OFFICIAL for our builds
  • Android
    • Bug 5709: Ship Tor Browser for Android
  • Build System
    • All platforms
      • Bug 25623: Disable network during build
      • Bug 25876: Generate source tarballs during build
      • Bug 28685: Set Build ID based on Tor Browser version
      • Bug 29194: Set DEBIAN_FRONTEND=noninteractive
      • Bug 29167: Upgrade go to 1.11.5
      • Bug 29158: Install updated apt packages (CVE-2019-3462)
      • Bug 29097: Don't try to install python3.6-lxml for HTTPS Everywhere
      • Bug 27061: Enable verification of langpacks checksums
    • Windows
    • OS X
    • Linux
      • Bug 26323+29812: Build 32bit Linux bundles on 64bit Debian Wheezy
      • Bug 26148: Update binutils to 2.31.1
      • Bug 29758: Build firefox debug symbols for linux-i686
      • Bug 29966: Use archive.debian.org for Wheezy images
      • Bug 29183: Use linux-x86_64 langpacks on linux-x86_64
    • Android
      • Bug 29981: Add option to build without using containers

Comments

Please note that the comment area below has been archived.

Mike (not verified) said:

May 21, 2019

Permalink

Thank you very much Tor for your work. But how is Orbot going to go on from now on? The development has been slow even so far and now, is it in any way going to be replaced with Tor Browser? For me, living in Iran, Orbot and it's features have been essential as more of a filtering circumvention tool than a privacy tool.

There is no plan to replace Orbot with Tor Browser as they provide different features. Orbot will continue to be developed by the Guardian Project. Orfox however will no longer be developed, and Orfox users should migrate to Tor Browser.

Anonymous (not verified) said:

May 22, 2019

Permalink

It's insane to try to have multiple instances of Tor running on a phone (assuming it works correctly at all). It will result in nobody having the slightest idea of what's configured for what or what's using which instance for what. It will also make traffic analysis easier by putting some traffic over one ingress connection and other traffic over a different ingress connection. The fact that it's a waste of both local and network resources, while true, is perhaps less important.

The whole business of bundling Tor with a browser has caused UNTOLD user confusion about what does what. Judging by the sorts of questions it generates on Reddit and similar, has probably led to people shooting themselves in the foot. Removing any distinction even in the name has made things far worse.

Anonymous (not verified) said:

June 09, 2019

Permalink

How do you use the orbot app if you have tor browser for android installed? It seems orbot is integrated into the tor browser but i don't see a way to route all traffic to from other apps through the tor network using the orbot built into tor browser for android.

Hi ,where I live lately tor is having issues. Normally access was not closed, simply launchig orbot and a circuit were fixed in a bit.Now just clicking on orbot bridge a premade you can choose which and anything it may be able to run .
Moreover behind a vpn a good one.
Nice to met you.

Anonymous (not verified) said:

May 21, 2019

Permalink

I still can watch real OS from javascript. Try navigator. Why you can't fix this? This is serious security problem.
Cool new logo.

Your OS can be detected in various ways. It's pointless to try and hide it. Your OS reacts differently to many things than another OS would, and they're trivial to detect using Javascript for example.

I have been using Tor since the days of privoxy, or even earlier, and I can confirm that the long standing and apparently intractable issue with OS detection despite using TB has often been discussed over the years and is (or should be) well known to every long time user.

Some technical issues are very hard to solve, and I think that TP is wise to spend its intellectual capital on devising ameliorations of more serious deanonymization and cybersecurity vulnerabilities.

Speaking of which, a million thanks to the hard working Tails team for promptly patching against the latest round of attacks leveraging speculative execution and other hard wired CPU flaws. The most dangerous has even been specifically confirmed to be usable in real world attacks on Tor Browser users, so the rapid fix was terribly important.

(People who use TB under Debian and who have just updated their Debian should be fine too I think; not sure about other popular OS's.)

Anonymous (not verified) said:

May 21, 2019

Permalink

'The new Tor Browser icon was chosen through a round of voting in our community'
where, what and who is this community? where did you call for voting?

Anonymous (not verified) said:

May 21, 2019

Permalink

So the design team at Tor Project posted an anonymous survey, interpreted it as a community vote, dropped the colors in favor of monochrome, dropped the the onion outer shape in favor of a circle, made half circles for the inner pattern so to be even farther from an onion's anatomy, checked how many companies/apps have the same logo with sightly different color, and then picked this one.

Anonymous (not verified) said:

May 22, 2019

Permalink

Antonela, whoever voted for Leveled, voted for Leveled with leaves: the 2018 version, which is inside the tb-icon-survey.zip attachment. Little did they know you will chop that poor plant.

I confess that I initially misunderstood the icons and panicked, so for five minutes earlier today I somewhat agreed with you, but by now I've been using 8.5 all day and I have decided that I like the new icons and the new security slider. And I am overjoyed (overjoyed!) that TP now has an offical and apparently working version for one of the major brands of smart phones (Android).

Anonymous survey: how else can TP get feedback from the user community? Because we are anons not registered voters.*

Sometimes I get the impression that some posters do everything they can to think of something anything negative to say about anything Tor Project does, but maybe you just panicked like I did because if you weren't ready for it one could have thought someone had fooled us into installing a malicious modification of TB.

[Edit: slightly cut the post to stay on topic, -GK]

the titlebar icon is ok, but I would have subtracted one of the concentric half-rings.
IMO, it is more distinguishable than tbb's recent faded green FF icon.
I don't notice any other change, though I see the bland b&w "new tor circuit for his site" icon in the "hamburger" menu.

The UI defects are FF/mozilla's - though because Moz has contracted Googlechrome Disease.
(Has any moz designer wondered why FF's urlbar/addressbar possess both overflow *and* a 'hamburger' expander/dropdown menus *adjacent to each other* ?)

Considering usability of most gui apps, icon and toolbar design has declined since macos 8/9 and xp/ie6/food.

Anonymous (not verified) said:

May 22, 2019

Permalink

I missed the election (after GCHQ attacked my email I have good reason to avoid mailing lists which means I am excluded from many things, so a small win for the bad guys there) and like most users I initially thought the new TB look suggested someone messing with the supply chain.

FWIW I have been using 8.5 all day and decided I like the new icons just fine :-)

Jack Thornhill (not verified) said:

May 21, 2019

Permalink

Awesome news, love the fresh look. Noticed there's a Nightly icon, are the nightly builds public and if so where can i grab em?

The nightly builds are public, and you can find the link to download them on:
https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser/Hacking#Ni…

Currently the nightly builds don't have automatic updates available, so you will have to manually download and install new versions. However we are planning to fix this in the future: https://trac.torproject.org/projects/tor/ticket/18867

Onion sites are thought to be safer than clearnet sites, in the sense of being less susceptible to various ways in which bad guys can mess with DNS. So being sent to an onion means someone did you a favor.

To avoid possible confusion: the exit node does the DNS lookup if you surf to a clearnet site using Tor Browser, but the exit node can fall victim to the same attacks which might misdirect your browser if you were using FF on your own computer. Onions bypass many of these serious DNS issues.

I am an ordinary Tor user not a dev, so if I said anything wrong above I welcome correction.

(I hope to someday soon see a post in this blog explaining the virtues of onions for cybersecurity. There are no magic bullets but onions can blunt many threats, it seems to me, suggesting that the web would be safer for everyone if every website were an onion site. Of course, we'll have to gracefully grow the volunteer Tor network by several orders of magnitude before that becomes practical. But it seems like a good goal to keep in mind.)

Anonymous (not verified) said:

May 21, 2019

Permalink

Cool, thank you. It works like a charm.

I have a couple of questions.

1 - Do you plan to implement letterboxing into TBB? If yes, when?

2- Why the new Tor release has not been implemented into TBB? Or did I miss something in the changelog (if so, apologies)

3 - Why you have not yet uploaded the deb packages of the last Tor release (4.0.x) on your repos?

Cheers

1 - Do you plan to implement letterboxing into TBB? If yes, when?

Yes. It will be included in the next alpha (9.0a1) which we will be releasing tomorrow.

2- Why the new Tor release has not been implemented into TBB? Or did I miss something in the changelog (if so, apologies)

We first need to test the 0.4.x series in an alpha release before including in the stable Tor Browser.

3 - Why you have not yet uploaded the deb packages of the last Tor release (4.0.x) on your repos?

I see that https://deb.torproject.org/torproject.org/pool/main/t/tor/ has version 0.4.0.5.

Anonymous (not verified) said:

May 21, 2019

Permalink

Thanks for your reply. Yes, I have already seen that package as well, but if I "apt update && apt upgrade" no upgrade is showed. Tried this on several machines with different architectures.

Cheers.

Exactly. Linux kernel updates also remain on the branch you first installed until you view all packages and select a different one. Thank you.

OK, but then the question does not change (OK, it changes a little): why hasn't the Tor repository file been updated yet? I am not saying this is necessarily wrong. Not at all. I just do not understand the reason (I do not recall any other situation where this happened) nor I can find any "statement" about this.

Cheers.

0.4.0.5 stable was released on May 3, but all of the distro suite names only offer 0.3.5.x. To make your package manager list 0.4.0.x, edit your package manager's software sources configuration (repositories, sources.list) to download from one of the distributions (suites) named "tor-experimental-0.4.0.x-*" as seen here:
https://deb.torproject.org/torproject.org/dists/

Anonymous (not verified) said:

May 21, 2019

Permalink

The security level indicator is a huge improvement, thank you very much for implementing this!
However I was quite surprised to see that the slider (radio buttons now) has been still hidden away in the settings tab. I was expecting to see the option to change the security level right in the toolbar icon's menu itself, instead of merely a further explanation. Any plans to implement this as well?
Again, thank you for all the improvements!

OCSP stapling is set as enabled and required in about:config, so if a cert uses OCSP, the browser must only contact the cert owner's website, not CAs or issuers. So it has that going for it.

Yes, OCSP is enabled (and this is good, would you prefer trusting a revoked certificate?). OCSP stapling helps a little here, but it certainly is not enough and I see many OCSP queries during my normal usage every day. There is some information leakage because the browser queries whatever URL is provided in the certificate, but these queries are first-party isolated, so querying the same CA for different sites (first parties) should not be linkable. As the Tor Browser Design Document says:

OCSP requests go to Certificate Authorities (CAs) to check for revoked certificates. They are sent once the browser is visiting a website via HTTPS and no cached results are available. Thus, to avoid information leaks, e.g. to exit relays, OCSP requests MUST go over the same circuit as the HTTPS request causing them and MUST therefore be isolated to the URL bar domain. The resulting cache entries MUST be bound to the URL bar domain as well. This functionality is provided by setting privacy.firstparty.isolate to true.

Anonymous (not verified) said:

May 26, 2019

Permalink

What about HTTPS *.onion? Does OCSP on onions leak metadata to the normal Internet? Don't show my comment if it's a zero-day.

It took 2 clicks when it was in TorButton. I takes 2 clicks now. I wouldn't say placement makes it harder to find. On the contrary, the new shield icon for security level visually changes shading, indicating the level without having to click anything. Nevertheless, there is always room for improvement.

No, we don't have plans. The reason for the current design is that the button on the toolbar is not meant to easily toggle the slider state. It's meant to show you your current state and to offer the option to (re-)set the level if you really need to. It's a global feature affecting the whole browser session and could lead to surprises if used to just change the level for site X.

Anonymous (not verified) said:

May 23, 2019

Permalink

> It's a global feature affecting the whole browser session and could lead to surprises if used to just change the level for site X.

So are NoScript and its options, and people want those easily accessible too.

A. Nony Mouse (not verified) said:

June 28, 2019

Permalink

I'm on Android Q Beta 4 and both the alpha and stable branches fail at various points. If I use bridges, it fails at the 10% consensus stage. If I don't use bridges, it gets 100% consensus, but no webpages ever load.

Anonymous (not verified) said:

May 21, 2019

Permalink

What happened to Saved Logins? It is now empty although the file logins.json still is there

Anonymous (not verified) said:

May 21, 2019

Permalink

Awesome update for Android.
I have been having all kinds of trouble with it on my phone but everything I looked up was already known and being worked on.
Glad to finally have a stable version for my mobile devices thank you very much for all that you do.

I myself do not use Android but find it very encouraging that 8.5 is working well on Android phones.

One question: does the Huawei-USG catfight impact Tor users in CN who own Huawei branded phones? I suspect the answer is likely "Yes", and that underscores the importance of finding a donor eager to fund a Tor version for a brand of phone popular in CN. Or am I being unrealistic about Tor Project's chances of helping people in CN?

Anonymous (not verified) said:

May 21, 2019

Permalink

As a matter of preference I prefer to have all my icons on the left side of the search bar like it used to be. Is it safe to manually move them back on the left or does that affect the browser fingerprint?

Thanks

I think simply moving them does not affect the fingerprint. To a similar question about flexible space that is horizontal, gk replied, "Yes, that should be fine."

However, I don't know about removing or adding the title bar, menu bar, or bookmarks toolbar. I don't know about changing the icon size "density" or themes. Those things possibly affect vertical height.

My own question:
Does keeping open the Find bar (Ctrl+F) along the bottom of the window affect my fingerprint? Because I keep it open most of the time.

Anonymous (not verified) said:

May 22, 2019

Permalink

@gk so do you confirm it is OK to move plugins icons from right to the left or wherever we prefer, but it's better to avoid showing the bookmarks bar for example?

certifiable (not verified) said:

May 23, 2019

Permalink

so to use bookmarks much, keep the bookmarks manager window squeezed to the side of the screen?

Anonymous (not verified) said:

May 21, 2019

Permalink

I'm still getting NoScript popups constantly, and it seems any settings to "always block such and such request" are reset after closing down the browser.

Are there any plans to block all XSS requests by default or otherwise improve this?

Anonymous (not verified) said:

May 22, 2019

Permalink

@ gk:

Many thanks for all your work but PUH-LEEZ explain to me (no doubt I am an idiot but I truly do not find it easy to guess how to get this done) how to check that NoScript is even working in my TB 8.,5 (currently running in Tails 3.14 but I also use Debian). I cannot see a NoScript icon and as far as I can tell from checking add-ons, NoScript should be present but has not been updated since 1 Jan 2019. That sounds bad. Has NoScript been disabled in my TB and if so how can I get it back?

What NoScript version is shown? If it is not 10.6.2 what happens if you click on the gear icon on about:addons and do a manual check? If you did not mess with Tor Browser but just set the slider to a non-default level you can easily check whether NoScript is working by trying to watch a video on Youtube. That should not be possible out-of-the-box then. Otherwise, if you feel cautious and feel you need a NoScript icon somewhere then it's perfectly fine to customize your toolbar by dragging that icon onto it.

Anonymous (not verified) said:

May 24, 2019

Permalink

Oh no, I see 10.6.1. Maybe that is because I am using Tor Browser 8.5 shipped with Tails 3.14?

What worries me is that I do not see a NoScript icon in the bar at upper right near the UBlock and Tor icons. However, I tired what you suggested and with "Safer" setting it seems my attempt to watch a Youtube video failed, so NoScript probably IS installed and working.

In the past NoScript showed a fearsome monster icon announcing it was blocking 3 out of 5 scripts or something like that. Which people I know hate but I liked to see it. So the vanishing of this is a feature not a bug?

By the way:

Apologies for panicking when I first tried 8.5. I was in a rush and completely misunderstood that the new icons were supposed to be there and that the security slider had moved. I think the new way is better than the old way.

Also, while the onion mirrors appear to be working for Buster can you try to liase with Debian Project to make sure nothing breaks when Buster becomes new stable? Also, can you ask them to look into possibly making popcon torified via Whisperback or something like that. Some things I use all the time vanished from Buster, possibly because privacy minded Debian users fear what an attacker with near global access could learn about our system from an unencrypted popcon report.

The vanishing of the NoScript icon is a feature. You should not need to mess with NoScript's settings at all. That's been part of our security slider redesign, see: https://gitweb.torproject.org/tor-browser-spec.git/tree/proposals/101-s….

Of course, if you want to see the status output NoScript gives you (or want to deal with per-site permissions which is not implemented at the moment), just customize your toolbar and put the icon back.

certifiable (not verified) said:

May 23, 2019

Permalink

perhaps 1/3 of those xss alerts ask about the exact domain of the link I had deliberately clicked to open... unless there is a difference - http vs https?

Anonymous (not verified) said:

May 21, 2019

Permalink

The security levels are listed in reverse order from before on the slider. I almost started browsing in Standard mode when I meant to be in Safest (now on bottom). Users have been trained for many years to expect Safest on top/highest. Sudden reverse order is somewhat disorienting.

Anonymous (not verified) said:

May 21, 2019

Permalink

I am unable to install this update the usual way and Tor Browser is asking me to download a fresh copy. Is this going to be fixed?

On what operating system are you on? If you set app.update.log to true and then open the browser console with Ctrl + Shift + J and then perform the update check by clicking on the hamburger menu -> Help -> About Tor Browser do you get some error messages that could explain what is going on?

Anonymous (not verified) said:

May 21, 2019

Permalink

You say "Though we cannot bring an official Tor Browser to iOS due to restrictions by Apple, the only app we recommend is Onion Browser, developed by Mike Tigas with help from the Guardian Project."

What restrictions prevent you from bringing an official Tor Browser to iOS? I imagine there would be differences between your ideal iOS Tor Browser and what Onion Browser does. Can you talk about that?

Bean (not verified) said:

May 21, 2019

Permalink

Android package don't work - never installs. Latest LineageOS on angler:

$ adb install -r tor-browser-8.5-android-x86-multi.apk
Performing Streamed Install
[waited > 5 minutes]
^C

Thank you

tormac (not verified) said:

May 21, 2019

Permalink

there is still a problem in getting a new "request a bridge from torproject.org" when i request it using my Mac OS running high sierra. the same brige is continually provided.
XX.XX.XX.XX:PPPPP etc..

nemo (not verified) said:

May 21, 2019

Permalink

Здравствуйте! Я из России. Есть такие программы, называемые "песочницами", они после перезагрузки сбрасывают состояние операционной системы к изначальному - я тут подумал - может быть в Тор сделать нечто подобное? Это будет получше чем механизм "Не сохранять историю" так как всё что делал пользователь в сети будет стёрто после выхода из Тор

"Hello! I'm from Russia. There are such programs called "sandboxes", after reset they reset the state of the operating system to the original one - I thought here - maybe in Tor to do something like that? This will be better than the “Do not save history” mechanism since everything that a user has done on the network will be erased after exiting Tor"

(Google translate. I wish there was a good alternative.)

Tails and virtual machines (VM) are sort of like sandboxes....

Thank you for the translation! The OP's report turns out to be a useful question, I think.

I endorse the suggestion to try Tails, which incorporates AppArmor so it has some valuable sandboxing. I was recently told that people in Russia *are* still able to use Tails and hope that information is not out of date.

Tails is a complex Debian-based "amnesiac" and torified operating system which works out of the box on any 64 bit PC or laptop.

You boot it either from a DVD you have burned from the latest ISO image or from a USB. You can enhance a Tails USB by creating an encrypted data partition (by pressing a few buttons which calls their very cool script) and you can install additional software using Synaptic in the usual way (but you should try to limit this to minimize the risk of installing something which has not been vetted for use in Tails).

Tails USBs are supposed to be easier to update because you do not need the full ISO image for the next release, but I find that the best way to update a Tails USB is to obtain the ISO image, verify the detached signature, burn to DVD, boot from that while disconnected from the Internet, and then use the handy script to "clone running Tails" onto the USB as an "update" not "reinstall". This preserves the data and always works.

"Amnesiac" means Tails tries not to leave traces on hardware of your activities. Very important if you are whistleblower or human rights worker or a reporter. The idea is that you boot Tails from a DVD and store any data on a seperate encrypted USB data stick, or boot Tails from a USB with an encrypted volume holding your data. You can use Tails both for websurfing and chatting, or in "off-line mode" for the most dangerous stuff like preparing a leak or writing a news report.

(As we see from the charges the USG has dumped on Assange under the 1917 Espionage Act, one of the worst of all the many horrid laws the US Congress passed during some wartime panic and never repealed, writing the news is now very dangerous "even in the USA".)

Anyone can obtain the current tails ISO image for free at tails.boum.org.

Tails Project is a sister project of both Debian Project and Tor Project and all three projects correlate their releases. All of them have responded quickly to such emergencies as the latest speculative execution attacks and other horror shows.

Anonymous (not verified) said:

May 21, 2019

Permalink

I'm concerned about the new security level button. When you click it, it goes to the settings page and right under that is a bunch of options that look really tempting to enable (who wouldn't want to click a check box that says it "blocks deceptive sites"?). This is exposing millions of users to options that make them easier to track by making them easier to fingerprint.

I think having the slider available directly when you click the icon is better because it doesn't make people think that the slider is just one of many different customizations that you are encouraged to make to the browser.

Also I don't really like the new icon but I guess I'll get used to it. That's just aesthetics.

Thanks for the feedback. We have been thinking a lot about your idea but ultimately decided against it because the risk we saw is that the slider could easily be used for just quickly toggling the slider level as needed for the current site neglecting that it is a browser-wide feature affecting all the other tabs open, too. So, foremost the icon on the toolbar is meant to inform you about your current settings. If you need to change the level (which is meant to not be done very often) then you can do so on the advanced settings.

Anonymous (not verified) said:

May 22, 2019

Permalink

(Not OP)

> the risk we saw is that the slider could easily be used for just quickly toggling the slider level as needed for the current site

I can kind of understand that. However experienced users know full well that it's a browser-wide setting. You could argue it's a good change because it makes it harder to change the slider mid-session, which isn't really recommended. However this change also makes it harder to change the slider level even after a new-identity restart, too. ('click onion, move slider' vs. 'click shield, click more settings, click security level, close preferences tab')

Personally I think I would have opted to keep the existing slider button and popover dialog, and just made it so the button icon changes with the active security level. However it's not a big deal for me, only because I don't mind using multiple TBB instances/installations at different security levels.

I'm all for making TB easier for new users. But remember that, I'm quite sure, the majority of your userbase is existing users. It's important to think about them too.

Didn't know this, but, as long as it works and nothing breaks, is there still any risk? It works fine for me. Anonymity-wise, I think it would be a good thing, because it encourages more isolation and more frequent new identity clicks. If you use the same instance and keep it open a long time, you're dirtying up its fingerprint/cookies/etc. It also because they're separate processes it might reduce damage of certain attacks. The only downside I see, other than something breaking, is extra resource usage. Am I missing something?

Even better is to use qubes and open each TB instance in its own whonix VM. (I use qubes but my PC doesn't have enough RAM for a lot of VMs at the moment, so I run several TBs in one VM)

Anonymous (not verified) said:

May 22, 2019

Permalink

What about using a dedicated page for that, or a pop-up? My main concern isn't so much that users won't find it as easy to change, but that they're being exposed to settings they should never touch.

I don't know. I think we accommodated your concern by making the toolbar icon mainly an icon to *show* the current state. Having "Adavanced Security Settings" is IMO already an implicit warning for users who do not know what they are doing.

I would support a dedicated page and a floating warning on the other pages because the other pages are accessible from that page in the sidebar for navigation. A pop-up would make it like the old icon that developers seem to want to move away from. They want to publicize its current status and integrate the buttons into the browser but don't favor making the security level easier to change. But learning how to properly use "Safest" should not be hidden but encouraged. There is a link in the shield button to Learn More, but it should be prefaced by informing the user there are levels of higher security than the one in play out of the box, "Standard", and three levels in all. Encourage them to Learn More; don't frighten them by saying "Advanced Settings".

Anonymous (not verified) said:

May 22, 2019

Permalink

"because the risk we saw is that the slider could easily be used for just quickly toggling the slider level as needed for the current site neglecting that it is a browser-wide feature"

May you are right with "could easily be used",in general i don't think so, but the trend from the (Big)Soft business to hide settings deep in menus or mostly cut control is really annoying.
Please make this hide and cut game with this wonderfull soft(TBB), too.

Not sure what you mean, but: we made the slider more accessible for *both* advanced users and less advanced ones and got it out from being buried somewhere in Torbutton's settings to make it easier to use. So, no, we did not bury it anywhere in the browser, quite to the contrary. Seems to me like a win-win actually. :)

Anonymous (not verified) said:

May 21, 2019

Permalink

What I absolutely miss in TBB is the ability to lock the browser with a password when minimized. Do you plan to implement such a function?

poorenglish (not verified) said:

May 21, 2019

Permalink

I think the new icon and layout is great.
But after the update, my saved password was lost.
I'm in big trouble now.
And when can the settings of the noscript be saved?

Anonymous (not verified) said:

May 22, 2019

Permalink

Hello!
Thanks for your efforts!

Tor browser is now showing up on the Google Play Store.

But, I have seeing something unusual or questionable.

It is showing that Released on May 21, 2019.
Updated on May 19, 2019.

How about it!?

How can an app get updated before it is released???

Is there something went wrong?

It's not clear to me what Google is tracking here. We probably have uploaded the .apk on May 19th already and made some last tests and pressed the "Release" button on May 21st. Not sure whether there is anything we can do to improve the situation.

So, to sum up, I don't think there is anything wrong here in the sense of someone tampering with Tor Browser.

Ha. Yes, indeed. It's a little funny Google is leaking this information. For this release, we used Google Play's "Internal Testing" channel before we released it publicly, so first we uploaded it on May 19 and after testing it we released it for everyone (coordinated with the desktop release) on May 21.

Anonymous (not verified) said:

May 22, 2019

Permalink

1. What happened with fonts in TB for Android? Latin characters are ugly and cyrillic characters are extremely ugly.
2. I use Orbot for some other applications and don't want to delete it. However I don't want to keep multiple tor instances in my phone memory. This forces me to use this workflow: When I need TB, I run it, it connects to the network (while Orbot is running to serve another apps) and after I done something with it I should explicitly quit and disconnect.
3. Part 2 leads to another thing that I liked in separate Orbot/Orfox: Orfox is instantly ready to go due to Orbot is running as a service for all apps. With TB for Android I forced to wait while it connects to network.

Regarding to 1. is that new in the stable version or does that show up in alpha versions as well? It's not exactly clear to me whether you tried the alphas before and are now suddenly seeing issues with the stable release.

Regarding 2. and 3.: Yes, there are trade-offs here. It's a very awkward user experience to download an app and then when starting it you got told "Oh, by the way you need another app installed in the first place to run your app". That's pretty confusing to new users while old Orfox users would be totally fine with that. We opted for following the desktop approach to provide a unified experience across all the platforms we support and making sure you have a running Tor before you start browsing. What happened in the Orfox case when Orbot was installed but currently not connected to the Tor network was that you would get weird proxy connection errors with no further explanation about what is going on which is very confusing as well.

Anonymous (not verified) said:

May 22, 2019

Permalink

1. That was in alpha versions too. I haven't used it too much, I've installed some builds. So when the stable release came out I installed it, but the fonts issue remains.
2 and 3. Generally I agree with you that it is better for newcomers. I just described my experience with that.

Anyway, thanks for all that, good work!

Anonymous (not verified) said:

May 22, 2019

Permalink

Didn't you guys agree the bundled Tor use will be made optional so power users can toggle it off if they've got Orbot? Can you please reconsider? I've been waiting for the stable version for that to materialize. The bundled Tor isn't working for me so I need this urgently to upgrade.

We agreed that we remove Orbot, which we did. I don't think we want to go back to a browser that needs an additional app to be usable at all. Imagine the situation for someone who just learned about Tor Browser. It sounds exciting, right? But suddenly when run you get told "Hey, in order to run this awesome up you actually need to install first another awesome app". That's an awful user experience we don't want to have. Rather, we want to provide the same flow across all platforms we have.

Why is the bundled Tor not working for you?

Anonymous (not verified) said:

May 23, 2019

Permalink

It did after I removed and reinstalled the app.

I am not saying make Orbot a dependency for everyone again, but just have an option even buried in the prefs that allows it.

Anonymous (not verified) said:

May 22, 2019

Permalink

what happended to the idea of a user months ago to make securityslider icon colorful? red-yellow-green like a traffic light.

I have no slider. regular mouse click on the new black shield icon shows the current setting "safest" with a little text information and 'advanced settings at bottom. advanced setting goes to options/preferences. There are only radio dots for each of the three "slider" settings.

using tbb 8.5 (based on 60.7.0esr)

Anonymous (not verified) said:

May 22, 2019

Permalink

tbb 8.0.9: browser.safebrowsing.id ; Firefox
tbb 8.5: browser.safebrowsing.id ; navclient-auto-ffox
if somebody enables safebrowsing navclient might be no good choice.

Anonymous (not verified) said:

May 24, 2019

Permalink

Any site that shows their content based on the system's language. Twitter, Youtube, and so on. The language is also shown on panopticlick.eff.org, for example. System language is Russian.

User (not verified) said:

May 22, 2019

Permalink

Thank you for the new stable version. However, I expected to control which kind of JavaScript I could block, XSS attacks and so on with No Script and, because of the new layers of security, I only have two options: blocking all JavaScript, which doesn't seem me very useful in some pages, or blocking JavaScript in only pages which aren't HTTPS. Is there any kind of solution?

You can customize NoScript blocks in the NoScript icon as before. NoScript is reset when you click New Identity, change the Security Level shield, or close Tor Browser. When you begin a New Identity session, set your Security Level. As you browse, allow what you need temporarily in NoScript. Reset NoScript when you don't need it. The longer you browse with NoScript customized, the more your activity can be identified as the same person.

Anonymous (not verified) said:

May 22, 2019

Permalink

Russian version on Android: Browser uses Yandex Search (Duckduckgo not selectable) and pages are in Russian instead of English.

Anonymous (not verified) said:

May 22, 2019

Permalink

I think the Tor Project should discourage downloading the Android app from F-Droid unless it is through an official repository, and should also request F-Droid to take down the versions of the app from their main repository. As you know, the main F-Droid repository apps are signed with an F-Droid key not from the Tor Project (as is all other apps in the repository). This should make the app not considered an official release and should be considered a security risk. What makes it worse, as far as I know, these apps are signed with a private key that resides on the F-Droid server. And on top of all that, you then have people with Tor Browser for Android apps signed with different keys making them incompatible for updates depending on what source they originally downloaded from.

I haven't tried checking yet, but I assumed the app on the official Guardian Project repository is signed with the same keys as the app on Play or the one that can be downloaded from the Tor Project site. If so, this should be become the Tor Project's official repository to obtain the app and all apps signed with unofficial keys be removed. (And of course, the Tor Project can have their own official repository, which should be the only means anyone obtains the app on F-Droid.)

The Tor Project (as on the Tails site) promote and have well-documented pages rightly telling people they should verify their downloads and showing them the steps to take to do so. So there should be no encouragement for people to download apps from a repository signed with keys that are not official from the Tor Project developers. I would also bet many people don't even know the apps on the main F-Droid repository are not officially signed by the apps' developers. Many probably think the apps are uploaded by developers like they are on Play, and F-Droid has no indication the app they are installing are not officially signed by the app's developers. All of this this is very misleading and heightens security risks.

The Tor Project should either make their own official F-Droid repository or make the Guardian Project's repository official, and then have instructions on torproject.org on how to add the repository to F-Droid, and then request that all other apps not officially signed by Tor developers be taken down.

Indeed, currently we provide Tor Browser on F-Droid through our partners at the Guardian Project. They run their own F-Droid repository and they upload the apk we build (the same one available on our website and on Google Play). Hopefully, in the near future, we'll upload the apk we build directly to F-Droid (we're making progress on this, see https://trac.torproject.org/projects/tor/ticket/27539) and F-Droid will distribute our signed apk after it reproducibly builds it.

Anonymous (not verified) said:

May 22, 2019

Permalink

CVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS

Of course, you can say that you cannot do anything with it, but it is your responsibility to warn users that they should disable HT/SMT on Intel CPUs to use Tor Browser safely.

"Systems affected: Mozilla Firefox versions prior to 67, Mozilla Firefox ESR versions prior to 60.7" (source)
"Fixed in Firefox ESR 60.7" (source)

Tor Browser 8.5 --> hamburger menu --> Help --> About Tor Browser
"8.5 (based on Mozilla Firefox 60.7.0esr)"

Penny (not verified) said:

May 22, 2019

Permalink

I'm using what is allegedly the "most secure operating system" - OpenBSD and don't understand this:

"Sometimes the most recent version of Tor Browser on OpenBSD is behind the current release. The available version of TB on OpenBSD should be checked with:

pkg_info -Q tor-browser
"

That command returns tor-browser-8.0.9 for me on OpenBSD 6.5 -current.

But https://2019.www.torproject.org/download/download-easy.html.en shows only versions "8.0.8" is available for release on other platforms. Then there's https://www.torproject.org/download/ which offers versions "8.5". What version I'm supposed to be using remains a mystery. I have a flashing exclamation mark over the onion icon in Tor Browser, but when I select it, the only options are New Identity or Settings. You need to make this a lot less ambiguous and confusing, please.

2019.www.* is the old site. Don't expect it to be up to date.

pkg_info queries an OpenBSD repository mirror. Mirror servers take time to synchronize with each other. Maintainers of OpenBSD, not Tor Project, prepare packages for those repositories. Tor Project does not manage official OpenBSD OS repositories just like it does not manage official Linux OS repositories. Tor Project manages a Tor Project DEB repository. The most recent release of Tor Browser is 8.5, but the most recent snapshot of tor-browser on OpenBSD mirrors is version 8.0.9. Fortunately, BSDs ship an ABI that can run binary executables that are built for Linux. Download Tor Browser 8.5 from torproject.org, and search for how to run a Linux binary/program on OpenBSD or FreeBSD. Otherwise, install 8.0.9 from OpenBSD, and wait for their maintainers to update their mirrors to 8.5, the version immediately after 8.0.9.

Sam (not verified) said:

May 22, 2019

Permalink

This blog post page is so screwed up in Tor without Javascript enabled. It goes into an insane page reload loop that makes it impossible to scroll/view content. I wonder if any Tor developers actually use Tor browser without Javascript or have done basic QA on this site. Dissapointed.

I've never experienced what you describe.

For a while beginning with when blog.torproject.com 'installed' its current commenting system, the "Reply" link on each comment disappeared after I had posted *one* comment on a blog post. That strange defect went away one or more years ago.

This may be useful for comparison to your TBB circumstances: I'm using release TBB in Windows 7 with TBB Security Level set at "safest" and NoScript set to rarely allow any domains - and those only temporarily. (I'd like a NoScript timer feature, BTW)

Also, though NoScript's WebExtension rewrite lacks as much control as the pre-Quantum NoScript had, I try to set NoScript "universal" ("permanent") settings to their strictest.
Exception: I had checkboxed allow bookmarklets in pre-Quantum NoScript.

Further off-topic...
Quantum's crippled NoScript forces me to create additional keyword searches ('searchmarks'? 'keymarks'?) as workaround substitutes for *some* bookmarklets. The pragmatic quantity of keyword 'searchmarks' is limited by my memory of the "unusual" keyword that each keyword 'searchmark' requires.

> I've never experienced what you describe.

I can confirm both that this behavior does occur with slider on "Safest" and that it has been discussed in the blog before.

@ the OP:

I have found that setting the slider to "Safer" fixes the problem. If you forget to reset the slider before coming here, just hit "new identity", change the slider, and reenter the URL.

Anonymous (not verified) said:

May 22, 2019

Permalink

I have just downloaded and installed Tor Browser 8.5 and NoScript extension is missing. So I cannot quickly check (by hovering the mouse over the icon) what is the 'script situation' with the current site. Should I install it?
Plus on the about:preferences#privacy page
Cookies are also enabled by default
Tracking protection: 'never'.
Prevent accessibilitiy services: unckecked ...
All the base settings seem to be risky...

How did you decide the extension is missing? We just don't show it on the toolbar anymore to not confuse user's with NoScript settings. It should show up in `about:addons`, though. And, sure, you can just customize your toolbar and drag the icon back to it if you think that's something you need.

All the settings you mentioned seem to be as they should.

Anonymous (not verified) said:

May 24, 2019

Permalink

> We just don't show it on the toolbar anymore to not confuse user's with NoScript settings.

Ah. I wish this I had known this before I panicked. I think I agree with the change but the timing (just after the ferocious NoScript disabling fiasco) was unfortunate.

Developers, note that OP's perception of "risky" base settings and wanting to customize them are because they scrolled on the about:preferences#privacy which is opened by the new security shield.

The app doesn't actually need to access these files (photos, music, documents). Unfortunately, this is how Google explains apps requesting access to the external device storage. The device storage is where files are downloaded. Therefore, this permission is not really about accessing these files but being allowed to save files. We opened a ticket for explaining why we request each permission - https://trac.torproject.org/projects/tor/ticket/30604

Anonymous (not verified) said:

May 22, 2019

Permalink

Update HTTPS Everywhere to 2019.5.6.1

It updates rulesets to 2019.5.20, and then Firefox updates it to 2019.5.13 version which overwrites rulesets to 2019.5.13. Amazing.

Mike (not verified) said:

May 22, 2019

Permalink

I like the onion logo on the left side of the url bar and I also liked the security slider. Not sure why those needed to be messed with

You can customize your toolbar again and drag the icon back to the left side or, really, wherever you want to have it. We "messed" with the slider to make it easier accessible and more usable for everyone.

Anonymous (not verified) said:

May 22, 2019

Permalink

The toolbar redesign on desktops is a big disappointment. Confusing the user by removing the noscript button (with a, well, familiar interface) is not the right thing to do, in my opinion. Noscript shouldn't be wrapped into something else. Also, the new security slider(?) button is useless, for it just indicates the current security level (one have to click on the button to just see the level) but doesn't allow to change it. That was the intention, as far as I can see, and this is really odd.

> Noscript shouldn't be wrapped into something else.

It's no more wrapped than it was before. It's just the icon was moved. NoScript is for power users and probably lowers usability for new users. You can drag the icon back to the toolbar, although I sort of agree that a new installation ought to tell users that a NoScript icon is available.

> one have to click on the button to just see the level

The shading on the icon changes. None, half, and totally filled in.

> doesn't allow to change it.

Security level icon -> Advanced Security Settings...

Anonymous (not verified) said:

May 22, 2019

Permalink

what prefs in Tor Browser for Android can I set to stop the Orbot connect screen? on desktop I can disable Tor Launcher, but I can't do it here.

Without a new identity button I have to quit and restart Tor Browser every time I want to cleanup after a session.

HelloCzechia (not verified) said:

May 22, 2019

Permalink

Did Tails fork its version of Tor Browser 8.5 from the Tor Project version?

In Tails 3.14 (current version of Tails), Tor Browser icon is purple (Tails themed) not green (Tor themed) and Noscript icon does not appear. Further, the security slider is disguised in a new icon in TB. Further checking add-ons in TB shows that the version of Noscript was last updated on 1 Jan 2000 which cannot be right. Further, Noscript appears to be disabled in all security slider settings.

Anyone know what is going on? I cannot find an explanation at tails.boum.org so I ask here.

Sorry, sorry, sorry, I was in a rush and did not even realize that the blog was not one I had read before. Reading it solved my confusion except for the missing NoScript icon in the toolbar, but in another comment above gk explained that too.

After using TB 8.5 for an hour I decided I like the new slider, the new icons, the purple, and all is right with the world again. Except for what governments are doing to reporters and dissidents and Muslims and human rights workers of course (vomit).

Anonymous (not verified) said:

May 22, 2019

Permalink

@ gk:

I am using the version of Tor Browser 8.5 included in Tails 3.14 (the current version).

Apologies for not understanding that the security slider move is intentional. I think I agree with the objections raised by two posters. Understand what you said about why you made the change but it seems education is the answer not creating new potential for goofs.

I have a more serious issue: I am not seeing the Noscript icon at all. Further, checking add-ons seems to show that NoScript has not been updated since 1 Jan 2000. That cannot be right. (Ublock origin seems sensible in comparison.) As far as I can see Noscript has been disabled in TB 8.5 as included in Tails 3.14. Surely that is not intentional? Or am I missing something?

Anon (not verified) said:

May 22, 2019

Permalink

With all the issues last month with NoScript suddenly disappearing due to an expired certificate, why on earth would this new release drop the NoScript Icon from the visible menu. Shouldn't this icon be prominently displayed in plain view, so we can at least feel comfortable that it is present and active?

That's because the NoScript UI in itself is confusing (we have even bug reports in our own bug tracker about it) and there are risks that you make changes in its settings that make you stand out of Tor Browser users. Tor Browser users should not need to mess with NoScript at all. But you are of course free to add it back to your toolbar if you feel more comfortable that way. (FWIW: you got a big yellow warning that the extension got disabled with a link to learn more (I think) that you would get even if the NoScript icon is not visible on the toolbar anymore).

Anonymous (not verified) said:

May 24, 2019

Permalink

I was one of those who panicked (embarrased) but now I think I agree with the change. The timing was unfortunate but I think we're all good now.

Anonymous (not verified) said:

May 24, 2019

Permalink

> Tor Browser users should not need to mess with NoScript at all.

Many users don't want ads or scripts that cripple responsiveness, so they have to mess with NoScript. All or nothing is not feasible all the time.

Does long-pressing on the text highlight part of it? If you select the text you want to copy, then you remove your finger the browser should show you an options menu with options for "copy". When you want to paste the text, long-pressing in a text box should show an options menu with "paste".

JESUS (not verified) said:

May 22, 2019

Permalink

Why do "improvements in UX" always mean hiding user security choices behind menus?

Some time ago, turning images/javascript on and off disappeared from the options into the about:config.

Now the security settings slider has disappeared into the options,

Could you please give an option that makes...

1. images on/off
2. javascript on/off
3. security slider

...available through some option?

In other words, please stop making security choices a pain in the ass. This is not Internet Explorer.

You needed two clicks for setting the slider deep down in the Torbutton menu and had no clue afterwards which security state you are actually in because there was no hint in the browser UI about that. Now, you need two clicks to set the slider and see your security level prominently in the UI. So, I don't see how we regressed here in the sense that we suddenly started hiding things in menus?

Regarding your other points: I am not convinced we should have an option to disable images. There might even be some obscure about:config setting supporting that already. I don't know. JavaScript is best disabled with the security settings by choosing the highest level.

Anonymous (not verified) said:

May 24, 2019

Permalink

In about:config, set permissions.default.image to 2 which allows you to manually choose to load an image from some page, but images will not be loaded by default. This behavior will be noticed by the webserver at the other end of your Tor circuit and will make you stand out way out. But sometimes there might be good reason to take the risk of deanonymization to an attacker with near global presence.

Anonymous (not verified) said:

May 22, 2019

Permalink

Hello!

Isn't there the option to view circuits in Tor browser for Android?

I can't finding that. :-(

Toruser (not verified) said:

May 22, 2019

Permalink

Hi,
When will the point release be issued that fixes the rest of the accessibility bugs on Windows?
Thanks.

Anonymous (not verified) said:

May 22, 2019

Permalink

Have you considered that exposing about:preferences every time someone changes the security level may encourage them to believe that changing other settings listed on that page is equally okay? Why are "Safer" and "Safest" now called "Advanced" settings which newbies are trained in most other contexts to interpret as to avoid changing them from their default "Standard"?

Anonymous (not verified) said:

May 24, 2019

Permalink

I've been using Tor long enough to have some appreciation of how difficult it is to design a user interface which confuses no-one given the technical threats Tor users face, the enormous linguistic diversity of Tor user base, the technical knowledge diversity of the Tor user base, all on top of the fact that TP must build TB on top of FF, NoScript, etc., which are made by others who design their own interfaces to meet their own criteria. It is inevitable that there be some back and forth as we search for the current optimum UI.

Mike (not verified) said:

May 22, 2019

Permalink

Hi there,

The app seems to have a problem with connecting to Bridges? I run a bridge (obfs4) and am trying to connect using my known good (work just fine in desktop TBB) Bridge config line. Unfortunately in the app it doesn't work at all.
Any chance bridge connections will get some love soon?

Mike

Cryptocurrent (not verified) said:

May 22, 2019

Permalink

> It's Official: Tor Browser is Stable on Android
>
> Tor Browser 8.5 is the first stable release for Android. Since we released the first alpha version in September, we've been hard at work making sure we can provide the protections users are already enjoying on desktop to the Android platform. Mobile browsing is increasing around the world, and in some parts, it is commonly the only way people access the internet. In these same areas, there is often heavy surveillance and censorship online, so we made it a priority to reach these users.

This is a huge milestone for our community! Even though I avoid using smart phones (which renders me suspicious according to the IJOP app categories just revealed at hrw.org--- US does like CN, only with great secrecy while CN wants their citizens to know they will suffer govt reprisals for "social deviance" or failure to follow the state religion (CCP), or political dissidence) I am greatly heartened.

Thanks also to the media outreach team for some all too rare positive mentions in some tech publications; see in particular

zdnet.com
First official version of Tor Browser for Android released on the Play Store
After eight months of alpha testing, Tor Browser for Android is now ready for rollout.
Catalin Cimpanu for Zero Day
21 May 2019

> Today, the Tor Project released on the Google Play Store the first stable version of the Tor Browser for Android. This new mobile browser integrates the Tor protocol stack into a standalone browser and replaces Orfox as the main way to navigate the Tor network from an Android device. Tor Project developers have been working on this browser for eight months now, since September 2018, when they first released an alpha version for public testing. "We made it a priority to reach the rising number of users who only browse the web with a mobile device," said Isabela Bagueros, Executive Director of the Tor Project. "These users often face heavy surveillance and censorship online, so it is critical for us to reach them." "We made sure there are no proxy bypasses, that first-party isolation is enabled to protect you from cross-site tracking, and that most of the fingerprinting defenses are working," the Tor team added.

And it continues in that positive vein. Wow, how nice to see a reporter saying nice things about Tor Project! :-)

Casper (not verified) said:

May 22, 2019

Permalink

Great, thanks for the Improved Security Slider Accessibility! I love it this way.

One problem is big with Tor browser for a while, Google Captcha challenge aren't working properly. You enter the right solution but Google Captcha say wrong. Is there a fix or a work around? Thanks

geeyp (not verified) said:

May 22, 2019

Permalink

I have not posted here for the last 3 or 4 releases as I appreciate what you do and didn't wish to complain. I do miss from 4 changes ago the 8? squared section allowing you to choose search engines at your fingertip even though I know it is gone for security reasons. Also, I see that the next release, if I understand correctly, will stop the NoScript flash page that overshadows the screen and is relentless as a damn captcha. I do so much miss the, literally, iconic logo icon that said TOR. I loved looking at that Tor icon. It was pure class. Thanks anyway for Tor!

> 8? squared section allowing you to choose search engines at your fingertip

Type keywords in the address bar, and search engine icons fall under it. Press Enter for the default search engine. Another way, customize the toolbar and drag "Search" box. Click the magnifying glass to see search engine icons. Another way, open hamburger menu, Preferences, Search, and pick a default, enable, disable, or reorder.

geeyp (not verified) said:

May 22, 2019

Permalink

I miss that green onion logo. My fault for not voting. Green onions are more versatile than purple onions; just riffing... Again, thank you for your constant work on Tor.

Ynm (not verified) said:

May 22, 2019

Permalink

I would like to use it as my main browser on Android. However you can not download images and downloads can not be canceled and sometimes the tabs that I have open are blank or reload.

Thanks (not verified) said:

May 22, 2019

Permalink

For the hard work of the Tor team and delivering.

  • Multiple issues; Android:
  1. Cannot transfer bookmarks (I have moved from OrFox to TorBrowser ALPHA to TorBrowser 8.5 final)
    1. Maybe an extension/plug-in to import and export bookmarks can resolve this problem
  • Windows:
  1. Without mouse gesture support (doesn't work in TorBrowser), it's a pain using several windows with many tabs open in each of those windows (doing research requires many tabs/windows).
    1. Maybe another browser for Tor could be the solution; Vivaldi for an example has a lot of the functionality of Firefox extensions built right in (although it's 'invert color' filter is not as nice as DarkMode extensions, at least it's built in).
  2. Recommending that we do not update extensions that are shipped with TB (like Torbutton, TorLauncher, HTTPS Everywhere and NoScript) and yet leave Auto-update on by default!
    1. If possible, maybe disable Auto-update just for just the extensions that are shipped with TB.

Anyway, thank you again for this great update.

Regarding the issue with transferring bookmarks, that is a problem. We're still considering the best solution here because Firefox Sync is not available on Android. We were more concerned with stabilizing Tor Browser on Android, so that was our priority. Now we'll concentrate on solving bugs and making the browser more usable (including migrating bookmarks from the Alpha version to Stable). We still have a lot of work in front of us.

I was initially taken aback also, but after using 8.5 for an hour or so I decided I like the new icons, the new security slider, and can live with the absence of the ferocious NoScript symbol in the tool bar.

By the way, some Tor Browser newbies found it very offputting that when they tried to watch a youtube video they saw the NoScript icon which they misinterpreted I think as some nasty hacker messing with them, not as a the good guys preventing their browser from doing something dangerous. I think it would be very useful if Tor Project posts in this blog an explanation of how to watch youtube videos as safely as possible using Tor Browser. If this is in fact possible to do, of course--- some people tell me it is. The post should explain why watching youtube videos without protections can be dangerous, in particular why NoScript is likely to object.

when they tried to watch a youtube video they saw the NoScript icon which they misinterpreted I think as some nasty hacker

Indeed. The icon of NoScript on click-to-play yellow sheets does not look like any icons of Mozilla or Tor Project. As Tor Project hid the icon from the toolbar, it is not introduced anymore as a bundled component, but jarringly introduced when browsing casually.

There is an alpha version ("Alpha" in the name) and a stable one. If you feel like trying to find bugs and test out the latest features use the alpha one, otherwise sticking to the stable one sounds like a good idea.

33323 (not verified) said:

May 23, 2019

Permalink

So it will only be on the guardianproject repo? Not regular F-droid?

I noticed some small issues with the current F-droid listing, the license link is 404 and the "Alpha" still says it requires Orbot.

A changelog link would be nice also.

Anonymous (not verified) said:

May 23, 2019

Permalink

Is it known that this and the previous versions of TOR does not work while within a sandbox?

"DLL Initialization Failed.

C:\program files\sandbox\SbieDll.dll failed. The process is terminating abnormally."

I have tried opening a bug report, but something is broken about it and it refuses to let me log into it. Sorry.

sandboxie worked properly until TBB 7.5.x
i searched the (old) forum, could read 'sandboxie does not support TorBrowser' and nothing about this dll-error.
finally i moved to Linux to be able to use a sandbox.

Anonymous (not verified) said:

May 23, 2019

Permalink

I am excited about the first Android Tor Browser release! When are you going to update the TBB manual? It is not for mobile but only for desktop.

I would like to introduce my mum to TBB - she attended a conference, discovered the Internet is a weird place and now feels the need of some protection - but I hesitate to do that until there will be a proper Tor Browser Manual for Android. Why?

Simply because she is close to 70, she loves her tablet (the only technological devices she uses in order to surf the Internet) but her mind is not exactly elastic with technology (an example: she has a bunch of post-it where she wrote the whole procedure in order... to print a document :-D ). So, she needs a kind of support for when I am not there (and I do not want she feel mortified or not smart enough when something goes wrong: for her this would mean giving up immediately with TBB and going back to something else).

Thanks.

Usability feedback from your mum would be valuable. Read:
https://blog.torproject.org/strength-numbers-usable-tools-dont-need-be-…
https://blog.torproject.org/tors-open-research-topics-2018-edition (under Application Research: Usability)
https://blog.torproject.org/tor-tails-ux-identifying-user-needs-cryptor…
https://en.wikipedia.org/wiki/Contextual_inquiry

Antonela or Pili might like to establish contact with you.

Anonymous (not verified) said:

May 23, 2019

Permalink

Popup-GUI from HTTPSEverywhere2019.5.6.1 more blurry, than versions before.
If this is intentional, why not asking Facebook&Co, masters of practical gui for users... .

Anonymous (not verified) said:

May 23, 2019

Permalink

For the first - New icon is not bad and nice, thanks, BUT

1) I do not understand - WHAT DOWS ITS IMAGE ACTUALLY MEAN??? Onions??? O-O-O-O-O.... ?? )))
2) so - PLEASE BACK OLD GOOD GREEN ALL-WORLD ICON - as it is clear and already usual for Tor-users!

and Really, -
* new icon - does not brings any EXTRA value to users
* new icon - brings disharmony to stable users' perception of TBB
* new icon - is aligined with new logos\colors of site only (users do not care about)

* old icon - is usual
* old icon - is good for VISUAL observation as it was GREEN (green is known good color for sedation - it is about Human Psychology!)
* old icon - shows the World map - not some strange circles (regualar users know nothing about onion-circles, they need stability and protection - Green World is normal symbol of such things)

My vote is for OLD ICON! (purpule colors of site and browser you may keep - they are traditional for now already)

No no, Tor users are not being targeted for mind control by TP, which would be bad; rather, the world is about to be torified, which will be good. Let me explain.

The purple icon indicates that Tor Project is plotting to take over University of Washington. And ComicCon. Then Microsoft Research. Then Microsoft itself. Then the Amazon globe. Which means taking over the entire freakin' world! Yeah!

(I confess I initially panicked over the purple, which is probably why I now find purple-hating angst funny. Maybe laughing at our own tendency to over-react is part of trying to maintain our sanity. On another level we know that looking out for minor visual discrepancies really can be a clue that Something Has Gone Seriously Wrong, so we should forgive ourselves for sometimes panicking when suddenly things look a little different from what we are used to.)

If given only those two options, I would go with the green globe as well. A target doesn't give the right impression, nor represents "internet", but a simple globe for "internet" is maybe too generic.

Mike (not verified) said:

May 23, 2019

Permalink

Hi
I am new to Tor , and not that tech savvy . My issue is that after installing Tor on Linux , thur the pen drive , Tor will get connected once on the linux system but the moment I close the window the Tor disappears and there is no Icon can be seen on the main page. Yes of course there is file which I some how extracted by watching few you tube videos. Now how can I install on the pen drive ?
Kindly advise
Regards

Could you elaborate? What do you mean by the main page? Do you mean the desktop area? Are you running Linux from the USB pen drive or just Tor Browser from the pen drive?

I downloaded and installed Tor Browser for Windows, but now I can't find it.

You can install Tor Browser on the pen drive by extracting or moving the tor-browser folder to the pen drive before you first open Tor Browser. The browser won't work if you move the folder after you first open the browser. Open the tor-browser folder, and open the file named start-tor-browser.

The Tor Browser tar.xz on Linux might not install a desktop icon because there are many varieties of Linux desktop environments that configure icons differently. Search the web for help to configure your desktop environment (GNOME, Cinnamon, KDE, Xfce, ...) main menu icons.

Anonymous (not verified) said:

May 23, 2019

Permalink

Bug 25013: Integrate Torbutton into tor-browser for Android

Why for Android only?

Anonymous (not verified) said:

May 23, 2019

Permalink

Bug 29903: No WebGL click-to-play on the standard security level

Hey, we don't want that fingerprinter active by default!

I kinda hate the security levels altogether. Id like to be able to manually control permissions by tracker like I always have without having to go into my addon settings, go to noscript and make an exception manually for each domain or page or override the security settings of all pages. Noscript is allowed to override, but at safest, scripts are greyed out on the trusted setting. Sometimes a site just won't work without scripts, but I always stay at safest by default. So a temp trust would be useless if it needs scripts. Can I please get noscript back on the toolbar? This feels like tor browser with training wheels.

Anonymous (not verified) said:

May 23, 2019

Permalink

Bug 28002: Fix the precomplete file in the en-US installer
Bug 29868: Fix installation of python-future package

and, probably, many others have already been backported to 8.0.9, so the changelog is not correct.

Anonymous (not verified) said:

May 24, 2019

Permalink

I don't know if you should outright delete it. Sometimes people comment that they are on old systems that can't support updated builds. Archiving may be better.

Anonymous (not verified) said:

May 23, 2019

Permalink

Hello I'm kind of confused with this stable alpha version of tor browser out do I still need orbot and orfox it seems to run fine when i dont have either installed ?

Orfox is the older version of Tor Browser. In the near future, Orfox users will receive an update pointing them to Tor Browser.

Regarding Orbot, it app is not needed if you only use Tor Browser (because Tor Browser includes its own tor, and it doesn't need an additional app). If you use other apps that need Orbot or if you use other features of Orbot (like the VPN mode), then you still need Orbot for this (Tor Browser does not replace Orbot).

Anonymous (not verified) said:

May 24, 2019

Permalink

Hello - recently Microsoft published WSL2-subsystem - https://en.wikipedia.org/wiki/Windows_Subsystem_for_Linux

Is it possible to create special TBB-version-or-what for WSL2? It brings many advantages - for instance -
1) hiding UserAgent (till now this issue is not solved)
2) using Linux-TBB in Windows, as Linux version probably better (with no need of extra Virtual machine)

Is it possible? How much time will cost this effort, is it really expansive?

Anonymous (not verified) said:

May 24, 2019

Permalink

Please look into the wiki - "Firefox for Linux running on WSL" :-)
So there should be good chances for TBB.

Meanwhile have no access to win10 for experiments unfortunately but windows users - are the most sufficient group of TBB users (AFAIR from tor-IRC), thus if WSL brings the value for them it is reasonable for tor-core-people to verify.

Anonymous (not verified) said:

May 24, 2019

Permalink

This is probably unrealistic but I'd love to see a version of Tor which works on Raspberry Pi. Or else a similar device available in most countries for a similar small cost which works with one of the existing Tor versions.

Why? Not sure really but I suspect that having the ability to torify a small cheap device (which you can put on a good hobby drone for example) might be useful to endangered people.

Making Tor for Raspberry Pi would probably require that project to show enthusiasm and some kind of special grant from somewhere to run a Summer of Pi type thing.

"Tor Messenger NG" is probably more urgent.

Pi need a bulky keyboard, monitor/TV, mouse for starters, and they are harder to set up. A burner phone or used old phone supporting LineageOS costs a little more but contains everything in a small, lightweight, enclosed case. It would be great to see Pi support, but there are better alternatives for endangered or transient people imo.

That would be dangerous because so many serious bugs have been published for versions earlier than 8.5.

I suppose you want to do that because something you are accustomed to doing appears to have broken with 8.5? If you explain the problem here, maybe someone can help you solve it.

Yes, if you accept the risk of not receiving security updates. You have to install the old version to a separate folder and immediately prevent it from checking for updates.
https://dist.torproject.org/torbrowser/
https://archive.torproject.org/tor-package-archive/torbrowser/
Hamburger menu -> Preferences -> Tor Browser Updates

Run only one instance at a time. Or so you don't accidentally do something unsafe, backup any personal files and delete the other tor-browser folders except for the version you want.

K H (not verified) said:

May 24, 2019

Permalink

Tor Browser 8.5
Tor exits on startup (seen twice)

  1. <br />
  2. Unable to update the static FcBlanks: 0x0600<br />
  3. Unable to update the static FcBlanks: 0x0601<br />
  4. Unable to update the static FcBlanks: 0x0602<br />
  5. Unable to update the static FcBlanks: 0x0603<br />
  6. Unable to update the static FcBlanks: 0x06dd<br />
  7. Unable to update the static FcBlanks: 0x070f<br />
  8. Unable to update the static FcBlanks: 0x2028<br />
  9. Unable to update the static FcBlanks: 0x2029<br />
  10. Unable to update the static FcBlanks: 0xfff9<br />
  11. Unable to update the static FcBlanks: 0xfffa<br />
  12. Unable to update the static FcBlanks: 0xfffb</p>
  13. <p>(firefox:2071): Gtk-WARNING **: Theme parsing error: <data>:1:34: Expected ')' in color definition</p>
  14. <p>(firefox:2071): Gtk-WARNING **: Theme parsing error: <data>:1:77: Expected ')' in color definition<br />
  15. alloc factor 0,900000 0,900000<br />
  16. alloc factor 0,900000 0,900000<br />
  17. May 24 09:27:28.421 [notice] Tor 0.3.5.8 (git-5030edfb534245ed) running on Linux with Libevent 2.1.8-stable, OpenSSL 1.0.2r, Zlib 1.2.8, Liblzma N/A, and Libzstd N/A.<br />
  18. May 24 09:27:28.455 [notice] Tor can't help you if you use it wrong! Learn how to be safe at <a href="https://www.torproject.org/download/download#warning
  19. May" rel="nofollow">https://www.torproject.org/download/download#warning<br />
  20. May</a> 24 09:27:28.486 [notice] Read configuration file "/home/hurtta/.tor-browser/tor-browser_en-US/Browser/TorBrowser/Data/Tor/torrc-defaults".<br />
  21. May 24 09:27:28.526 [notice] Read configuration file "/home/hurtta/.tor-browser/tor-browser_en-US/Browser/TorBrowser/Data/Tor/torrc".<br />
  22. May 24 09:27:28.856 [notice] Opening Socks listener on 127.0.0.1:9150<br />
  23. May 24 09:27:28.857 [notice] Opened Socks listener on 127.0.0.1:9150<br />
  24. May 24 09:27:28.857 [notice] Opening Control listener on 127.0.0.1:9151<br />
  25. May 24 09:27:28.858 [notice] Opened Control listener on 127.0.0.1:9151<br />
  26. May 24 09:27:28.000 [notice] Parsing GEOIP IPv4 file /home/hurtta/.tor-browser/tor-browser_en-US/Browser/TorBrowser/Data/Tor/geoip.<br />
  27. May 24 09:27:31.000 [notice] Parsing GEOIP IPv6 file /home/hurtta/.tor-browser/tor-browser_en-US/Browser/TorBrowser/Data/Tor/geoip6.<br />
  28. May 24 09:27:33.000 [notice] Bootstrapped 0%: Starting<br />
  29. May 24 09:27:44.000 [notice] Starting with guard context "default"<br />
  30. May 24 09:27:44.000 [notice] New control connection opened from 127.0.0.1.<br />
  31. May 24 09:27:44.000 [notice] Bootstrapped 5%: Connecting to directory server<br />
  32. May 24 09:27:44.000 [notice] New control connection opened from 127.0.0.1.<br />
  33. May 24 09:27:45.000 [notice] Bootstrapped 10%: Finishing handshake with directory server<br />
  34. May 24 09:27:45.000 [notice] Bootstrapped 80%: Connecting to the Tor network<br />
  35. May 24 09:27:45.000 [notice] Bootstrapped 85%: Finishing handshake with first hop<br />
  36. May 24 09:27:45.000 [notice] New control connection opened from 127.0.0.1.<br />
  37. May 24 09:27:45.000 [notice] Bootstrapped 90%: Establishing a Tor circuit<br />
  38. May 24 09:27:46.000 [notice] Bootstrapped 100%: Done<br />
  39. May 24 09:28:12.000 [notice] New control connection opened from 127.0.0.1.<br />
  40. May 24 09:28:12.000 [notice] Owning controller connection has closed -- exiting now.<br />
  41. May 24 09:28:12.000 [notice] Catching signal TERM, exiting cleanly.<br />

Tor Browser then complain that "Tor unexpectly exited".
Then need presess Restart tor
(This starts tor with disabled network set. So it does not directly work then. So then cancel and then connect.)

K H (not verified) said:

May 24, 2019

Permalink

Is this running on Linux?

I think that quoted log said that it is linux ...

There was: -------

May 24 09:27:28.421 [notice] Tor 0.3.5.8 (git-5030edfb534245ed) running on Linux with Libevent 2.1.8-stable, OpenSSL 1.0.2r, Zlib 1.2.8, Liblzma N/A, and Libzstd N/A.

------

This is

Ubuntu 16.04.6 LTS

Linux 4.4.0-148-generic i686
(or 4.4.0-145-generic )

MemTotal: 1013224 kB

K H (not verified) said:

May 25, 2019

Permalink

Happened third time.

This time I pressed quit after "Tor unexpectly exited" message
and started again.

Yes, is Linux as it is very cleary visible on log:

May 25 12:09:53.889 [notice] Tor 0.3.5.8 (git-5030edfb534245ed) running on Linux with Libevent 2.1.8-stable, OpenSSL 1.0.2r, Zlib 1.2.8, Liblzma N/A, and Libzstd N/A.

Probably happens on first time after boot. Timing related?

Ubuntu 16.04.6 LTS

On previous version of Tor Browser I got sometimes "Something
went wrong" -message to Tor Browser startup screen, but
it worked however.

[Edit: cut the post a bit, GK]

K H (not verified) said:

May 27, 2019

Permalink

Tor Browser 8.5 is first which wrote "tor unexpectly exited" on startup.
Some other Tor Browsers some times on browser Windows wrote "Something went wrong" or similar but when I wrote address to URL bar it worked so there was tor running.

Tor Browser 8.5 does not come with a new Tor version, so I suspect this happened already with previous Tor Browser versions. Could you figure out when this started (see the above link to older Tor Browser versions)?

> Some other Tor Browsers some times on browser Windows wrote
> "Something went wrong" or similar but when I wrote address to URL bar it
> worked so there was tor running.

OK. Now this (Tor Browser 8.5) said

----
Something Went Wrong!

Tor is not working in this browser.
-----

I type https://blog.torproject.org/ to url bar. This works normally. Tor is not exited or crashed.

Yes. This is not new behaviour. I have seen this earlier (with other Tor Browsers, not this).

----

And https://check.torproject.org/ says

Congratulations. This browser is configured to use Tor.

Your IP address appears to be: 51.15.117.50

K H (not verified) said:

May 31, 2019

Permalink

> first version is where Tor is crashing for you?
Are you absolutely sure that its tor which is cashing here?

After all (as you seen) tor was telling that control connection is closed.

May 25 12:10:06.000 [notice] Bootstrapped 90%: Establishing a Tor circuit
May 25 12:10:07.000 [notice] Bootstrapped 100%: Done
May 25 12:10:28.000 [notice] New control connection opened from 127.0.0.1.
May 25 12:10:29.000 [notice] Owning controller connection has closed -- exiting now.
May 25 12:10:29.000 [notice] Catching signal TERM, exiting cleanly.

What is causing

May 25 12:10:29.000 [notice] Owning controller connection has closed -- exiting now.
May 25 12:10:29.000 [notice] Catching signal TERM, exiting cleanly.

?

That said, yes, if you get the notice that Tor unexpectedly exited I'd assume it is crashing. But I am still not sure I understand what is happening on your side. Thus, I might have this wrong.

This closing of control connection seems happen just before something (launcer?) prepares open tor Browsers initial window (about:tor).
At least one time there was some other error message on (launcer?) screen before it was replaced with message that tor is exited unexpectly. Message was visible so short time that I didn't read it.

( I answered once, but it is not visible. )

Window shows some message

Unable ....

which is replaced with

Tor unexpectedly exited.

Verbose logging shows

Jun 01 16:02:40.000 [notice] Bootstrapped 5%: Connecting to directory server
Jun 01 16:02:40.000 [notice] Bootstrapped 10%: Finishing handshake with directory server
Jun 01 16:02:40.000 [notice] Bootstrapped 80%: Connecting to the Tor network
Jun 01 16:02:40.000 [notice] Bootstrapped 85%: Finishing handshake with first hop
Jun 01 16:02:40.000 [notice] New control connection opened from 127.0.0.1.
Jun 01 16:02:40.000 [notice] Bootstrapped 90%: Establishing a Tor circuit
Jun 01 16:02:41.000 [notice] Bootstrapped 100%: Done
Jun 01 16:03:03.000 [notice] New control connection opened from 127.0.0.1.
Jun 01 16:03:03.000 [notice] Owning controller connection has closed -- exiting now.
Jun 01 16:03:03.000 [notice] Catching signal TERM, exiting cleanly.

So tor was exited because controller connection was closed.

There was some other message on window before tor was exited.
I guess that was related to that why controller connection was closed.

K H (not verified) said:

July 07, 2019

Permalink

. I wonder if you could get us the problematic message as that would help us diagnose the issue further.

On https://blog.torproject.org/new-release-tor-browser-853 I wrote

Tor launcer(?) probably told

Unable to retrieve settings.

And then it was replaced with

Tor unexpectedly exited. ...

Control connection was closed:

Jul 04 05:31:17.000 [notice] Bootstrapped 100%: Done
Jul 04 05:31:35.000 [notice] New control connection opened from 127.0.0.1.
Jul 04 05:31:35.000 [notice] Owning controller connection has closed -- exiting now.
Jul 04 05:31:35.000 [notice] Catching signal TERM, exiting cleanly.

This is

Tor Browser 8.5.3

and

Tor browser 8.5.

Tor launcer: (Window title: Connect to Tor)

Unable to retrieve tor settings.

Immediately replaced with

Tor unexpectedly exited....

Restarting Tor will not close your browser tabs.

There is now yet browser window or tabs opened.

Console tells:

Jul 06 16:07:59.000 [notice] Bootstrapped 100%: Done
Jul 06 16:07:59.000 [notice] New control connection opened from 127.0.0.1.
Jul 06 16:07:59.000 [notice] Owning controller connection has closed -- exiting now.
Jul 06 16:07:59.000 [notice] Catching signal TERM, exiting cleanly.

K H (not verified) said:

June 23, 2019

Permalink

Okay, can you test which of the 8.5aX alpha versions is the first where you see it?

Happens with tor-browser-linux32-8.5a10_en-US.tar.xz

XXXXXXXXXX:~$ torbrowser-8.5a10 --verbose
...
Jun 23 09:54:47.814 [notice] Tor 0.4.0.2-alpha (git-feb744f0d488a0e5) running on Linux with Libevent 2.1.8-stable, OpenSSL 1.0.2r, Zlib 1.2.8, Liblzma N/A, and Libzstd N/A.
...
Jun 23 09:54:58.000 [notice] Bootstrapped 95% (circuit_create): Establishing a Tor circuit
Jun 23 09:55:17.000 [notice] Bootstrapped 100% (done): Done
Jun 23 09:55:17.000 [notice] New control connection opened from 127.0.0.1.
Jun 23 09:55:17.000 [notice] Owning controller connection has closed -- exiting now.
Jun 23 09:55:17.000 [notice] Catching signal TERM, exiting cleanly.

I try figure which is best to catch this. It is slow to test that this happens and much more slow to test that this does not happen.

binary search perhaps is not best

K H (not verified) said:

June 30, 2019

Permalink

I'm still testing tor browser 8.5a7

so far I have not seen "Owning controller connection has closed -- exiting now."

when starting tor browser 8.5a7

but that is slow test that something does NOT happen.

That have happened several times with tor browser 8.5.3 on same time period.

K H (not verified) said:

July 02, 2019

Permalink

Okay, can you test which of the 8.5aX alpha versions is the first where you see it?

"Owning controller connection has closed" on startup is not seen on tor browser 8.5a7 so far.

K H (not verified) said:

July 03, 2019

Permalink

Okay, can you test which of the 8.5aX alpha versions is the first where you see it?

Update:

"Owning controller connection has closed" on startup seen now with tor-browser-linux32-8.5a9_en-US.tar.xz

Jul 03 10:30:03.000 [notice] Bootstrapped 95% (circuit_create): Establishing a Tor circuit
Jul 03 10:30:04.000 [notice] Bootstrapped 100% (done): Done
Jul 03 10:30:21.000 [notice] New control connection opened from 127.0.0.1.
Jul 03 10:30:21.000 [notice] Owning controller connection has closed -- exiting now.
Jul 03 10:30:21.000 [notice] Catching signal TERM, exiting cleanly.

I tried tor-browser-linux32-8.5a7_en-US.tar.xz before that and have not seen
"Owning controller connection has closed" on startup with that version.

K H (not verified) said:

July 08, 2019

Permalink

can you test which of the 8.5aX alpha versions is the first where you see it?

"Owning controller connection has closed" on startup NOT seen so far with Tor Browser 8.5a8.

Anonymous (not verified) said:

May 24, 2019

Permalink

It took me all week to find time just to READ the list of bug fixes incorporated into 8.5. Everyone should try to do this once in a while just to get some impression of how much hard work goes into each release. And wow, oh my gosh, web browsers certainly are complex things! As such inherently they tend to collect bugs, all of which need to be found and fixed. Which involves a lot of work. And you guys are absolutely the finest most hard working people EVER!

Thanks so much for everything you do! 8> 8>

I have been thinking about the big picture and despite the shock of the recent Mozilla NoScript fiasco things are just at this moment actually moving our way, I think. Imagine that!

Considering how tiny Tor Project and Tails Project are, and how powerful and well-funded and monomaniacally aggressive our many political and technical adversaries are, it is easy for the FUD-sayers to create the impression that "Tor is hopelessly broken" [sic] or that "Tails cannot possibly protect whistle-blowers" [sic].

But look at all the huge positive developments just in the past few months:

o Tor Android is here and appears to be working in the real world,

o Mozilla is seriously interested in helping Tor to make it feasible to incorporate Tor into FF by default, which would grow our user base by two or more orders of magnitude,

o Tails has quickly incorporated changes addressing the latest attacks exploiting speculative execution,

o Tails (based on Debian) has already successfully incorporated Buster (Debian newstable); contrast the painful transition to Squeeze a few years ago,

o Tor Project and Mozilla have been successfully coordinating FF ESR and TB releases,

o the general population is suddenly waking up to the dangers posed by entities like Cambridge Analytica, Facebook, Amazon, Google (yes, I just bit a hand which sometimes feed us),

o most human rights workers now appreciate (I think) the danger posed by companies such as NSO Group to their personal safety, and are eager to adopt tools like Tails to keep themselves and their associates safer,

o the workforce at Google and Amazon and even Microsoft are in serious revolt against some of the worst abuses by these predatory monopolistic juggernauts (is it too much to hope for a revolt among NSA contractors? or at least a boycott of NSA by US universities?),

o Tor Project has new leadership but has shown excellent continuity in its stated goals and in geographical diversification and working toward a grassroots support funding model.

The one really big thing which is still missing, I think, is starting over with "Tor Messenger NG". The first attempt got written into a corner, as I understand, but that's how we learn to do it right, and I think that if TP can offer a chat which is fairly device independent and fairly secure and anonymous, that would be just about the biggest positive development since Tor Browser itself.

And that is good! BTW Did you checked UserAgent (from JS and from browser)? I hope information about OS now is not leaked.

In any case this WSL can be valuable and thus - interesting for TBB users. So information about should be published!

The only serious concern probably is about Win10 telemetry and screenshots (Win10 doing such) that Microsoft may send to itself :-)

anonymous, not… (not verified) said:

May 28, 2019

Permalink

I have been enjoying the security settings redesign quite a lot. Its so handy to just glance at the upper right hand corner of the browser and immediately check the security level without dropping open the menu. Depending on the site I will connect with, I frequently change the security level. Its easy to forget to reset it to safest. I liked the former slider, but I like your new design best. Thank you.

> Depending on the site I will connect with, I frequently change the security level. Its easy to forget to reset it to safest. I liked the former slider, but I like your new design best.

Me too. One important thing to remember when you do this is that security level changes affect all open tabs, so it is a good idea to get in the habit of choosing new identity just before you change the security level (especially if downgrading it).

ville36 (not verified) said:

May 26, 2019

Permalink

Since upgrading to TBB 8.5, I've experienced crashes. Specifically, in less than a week of using it:
* on 4 or 5 occasions: tab has crashed
* on 2 occasions: entire browser has suddenly terminated/closed without warning

On all of these occasions, I was browsing twitter threads at the time. Javascript was disabled. I was not using the mobile version of twitter, but instead hiding the annoying 'javascript is disabled' overlay that twitter uses.

This did not happen to me at all in previous TBB.

ville36 (not verified) said:

May 27, 2019

Permalink

Javascript disabled just by setting security to 'safest'.

Haven't managed to pin down a set of steps that always reproduces it.

However, I have noticed that when I run TBB inside a VM, it happens a *lot* more often, and not only on twitter threads, but also on basic, lightweight sites. In that case it happens so often (every few minutes) that TBB becomes virtually unusable - on one occasion, after the whole browser had crashed and I launched it again, it started up with the start tab itself (about:tor) crashed!

As with the non-VM case, it's a mixture of individual tabs crashing (sometimes) and whole browser crashing (slightly more often).

I will check if various factors/variations make a difference, and see if I can come up with a way to reproduce it.

In the meantime, is anyone else experiencing more crashes? I'm surprised if not. I mean, it could be something wrong with my individual machine (bad RAM?) but the way it coincides with the upgrade to a new version, and the lack of any problems with this machine, makes that seem unlikely that's the whole story. (Am also trying not to jump to the conclusion that these are attempts to run an exploit of some sort being run on my machine!)

ville36 (not verified) said:

May 28, 2019

Permalink

When using the (32-bit debian) VM, whole browser segfaulted:
1st session: after 7m20 use
2nd session: after 7m25 (just being open while I worked on a text document, no pages browsed)
3rd session: after 40m30 use
4th session: after 8m05 use
5th session: after 2m20 use
6th session: after 40s (didn't have time to browse any pages)
7th session: after 1m20 (didn't have time to browse any pages)

I then decided to restart the VM, since the crashes were getting more frequent. Then:

1st session: tab crashed immediately, but not whole browser - have since been browsing for over an hour with no crashes

I ran a basic command to log CPU usage/free memory, and there does *not* seem to be a pattern of the crashes being preceded by either low memory or high CPU usage.

Will continue to investigate.

ville36 (not verified) said:

May 28, 2019

Permalink

OK, I did a RAM test on the affected machine, and found errors. I imagine that's causing the problem - sorry for not trying this sooner!

Not sure why the problems only started with this new version of TBB - either it's a coincidence or the new version happens to be more likely to use the bad areas of RAM due to some change.

I guess the reason I haven't seen issues with any other programs is that I mainly use this machine for TBB, and it simply uses much more memory than anything else I'm running, so more likely to trigger a problem.

Thanks again and sorry for wasting your time - if the problem persists even with good RAM, I'll file a bug.

ville36 (not verified) said:

May 26, 2019

Permalink

PS Your blog still has that horrible annoying bug where, after posting a comment, the page reloads endlessly. Opening the page in a new tab doesn't fix it. Only 'New Identity' seems to fix it, so maybe due to some cookie or something that is set after commenting?

Again, this is with js disabled.

It has been mentioned in previous comment threads, so if you dig those up, probably someone has already worked out the cause. Thanks :)

ville36 (not verified) said:

May 26, 2019

Permalink

Some kernel log entries that show the crashes, in case that helps:

Chrome_~dThread[12127]: segfault at 0 ip af39dbe8 sp adaf8c50 error 4 in libxul.so[aef12000+6bc2000]
Web Content[13544]: segfault at 0 ip af00b301 sp bf8b23a0 error 4 in libxul.so[aef97000+6bc2000]
Web Content[11806]: segfault at dea7fff0 ip b100165c sp bfb91790 error 5 in libxul.so[aef82000+6bc2000]
Chrome_~dThread[10430]: segfault at 0 ip af3fd387 sp aebb9080 error 6 in libxul.so[aef51000+6bc2000]
Chrome_~dThread[10407]: segfault at 0 ip af3d0387 sp aeb8c080 error 6 in libxul.so[aef24000+6bc2000]
Chrome_~dThread[10092]: segfault at 0 ip af3dd387 sp aeb9c080 error 6 in libxul.so[aef31000+6bc2000]
Chrome_~dThread[10130]: segfault at 0 ip af450387 sp aec0c080 error 6 in libxul.so[aefa4000+6bc2000]
Web Content[3587]: segfault at 0 ip 004565ee sp bfae4ed0 error 6 in firefox.real[448000+3b000]
Web Content[6860]: segfault at 0 ip 0045c5ee sp bfc0f230 error 6 in firefox.real[44e000+3b000]
Chrome_~dThread[7985]: segfault at 0 ip af48c387 sp aec48080 error 6 in libxul.so[aefe0000+6bc2000]
Chrome_~dThread[2989]: segfault at 0 ip af456387 sp aec12080 error 6 in libxul.so[aefaa000+6bc2000]
Chrome_~dThread[2942]: segfault at 0 ip af3f4387 sp aebb0080 error 6 in libxul.so[aef48000+6bc2000]
Chrome_~dThread[7963]: segfault at 0 ip af414387 sp aebd0080 error 6 in libxul.so[aef68000+6bc2000]
Chrome_~dThread[16856]: segfault at 0 ip af48f387 sp aec4b080 error 6 in libxul.so[aefe3000+6bc2000]
Chrome_~dThread[16651]: segfault at 0 ip af3c7387 sp aeb83080 error 6 in libxul.so[aef1b000+6bc2000]
Chrome_~dThread[16612]: segfault at 0 ip af4ad387 sp aec69080 error 6 in libxul.so[af001000+6bc2000]

The Questioner (not verified) said:

May 27, 2019

Permalink

Sandboxing: I am a bit confused and I am sure that I am not the only one.

On the subject of this release there are some comments that sandboxing does not work. Is that true? If it is, what is the sandboxing shown under about:config with a value of 5?

Expanation please.

Thank you

There are different kinds of sandboxing. The one you see in about:configis a browser-internal one where the process(es) all the content is running in is/are sandboxed to prevent potential issues affecting the whole Firefox or your host system.

The sandboxing that is supposed to not work anymore is one that is done by an external tool which is running the whole Firefox inside a sandbox (where the content processes are additionally sandboxed as explained above).

anonymous (not verified) said:

May 27, 2019

Permalink

> Backport SSL status API

This is brilliant!

Thanks for doing this - since mozilla phased out legacy extensions without bothering to ensure WebExtensions had the same functionality, I've been waiting ages for a tor browser that would allow access to certificate info again.

I assumed I would have to wait until much later this summer when the first alpha tor browser would be based on the next firefox ESR - it never occurred to me to ask for that API to be backported - never thought that was an option.

Now it's happened without me even needing to request it - or having to use an alpha version. This is great :)

Anonymous (not verified) said:

May 28, 2019

Permalink

Contrary to what's said in the blog post, I find that changing the security setting is now slightly harder, not easier. It's the same number of clicks, but the interface isn't as nice. Also, when the browser switches to the about:preferences tab, memory of which tab was newest opened is lost, adversely affecting tab navigation experience when the user opens multiple links in new tabs.

I understand there's been a design decision to put the security slider in about:preferences to prevent accidental changes to the security setting, and to make it clear that the setting takes effect on all tabs (https://gitweb.torproject.org/tor-browser-spec.git/tree/proposals/101-s…).

I personally would like to see the security slider immediately after clicking on the shield icon, rather than additionally needing to click on the "Advanced Security Settings..." button that brings up a new about:preferences tab that shows 3 small radio buttons.

I really like that the security setting is visible simply by looking at the shield icon though! :-)

Thanks for the feedback. I am not sure I understand the "memory of which tab was newest opened is lost". Let's say I have three tabs open and the second one has focus. Then I click on the shield and change the security level and then I close that about:preferences tab again. I get back to the second tab that had focus, which seems expected to me. Do you see something differently?

I can see why you'd like to save one click and get the directly to about:preferences when clicking on the icon. However, the shield icon serves different purposes: One is to immediately show the security level. Then it should give the option to change the level. But, thirdly, it should inform users what the level means and provide access to further information. Fourthly, it should caution the user to use the slider to just change the setting for a particular site because changing it affects the whole browser session (meaning all the other open tabs as well). All that is hard to achieve if one directly goes to about:preferences by just clicking on the icon.

Anonymous (not verified) said:

May 29, 2019

Permalink

Thank you for the reply.

Actually, I personally would like to see the security slider (like the compact one that existed prior to version 8.5) immediately when I click on the security shield button. The about:preferences interface is less friendly.

I'm not sure how best to make it clear to users that the security setting affects all tabs without putting those settings into about:preferences. Placing some kind of warning message near the security slider would be all I could think of.

Sorry for not being clear about the last opened tab memory matter. Also, it's not a major problem, just something I observe before/after the change to version 8.5.

When I open multiple links in new tabs, those tabs appear to the right of the current tab, in the order (left-right) that I click on the links. If I then wish to change the security setting, I need to open a tab for about:preferences. After changing the security setting and closing about:preferences, as you explained I do appear back at the tab I was focused on. However, when I open more links in new tabs, those links now appear immediately after the current tab, not after the tab of the last link I clicked before opening about:preferences, so the order (left-right) of the new tabs is no longer the order that I opened them.

Your tab issue is the normal behavior of Firefox. Tor Browser is based on Firefox ESR. In about:config, three boolean settings affect it:

  • browser.tabs.insertRelatedAfterCurrent, for links you open
  • browser.tabs.selectOwnerOnClose jumps back to the original tab
  • browser.tabs.insertAfterCurrent, for blank New Tabs. Not yet in Tor Browser standard releases.

Current Firefox versions forget the owner (parent/stem) tab when another tab is given focus, including if that other tab is a related (child/leaf) tab. Your issue is based on insertRelatedAfterCurrent. The behavior that gk described is based on selectOwnerOnClose. If you want Firefox to remember the state of all tab relation trees as you move between tabs, create a ticket on Mozilla's bug tracker.

Could you explain what you mean by "isn't as nice" and "less friendly"? I agree in some sense, but I think it was one of their intentions. Aesthetics aside, a slider communicates the levels more quickly but is physically easier for mouse and touch users to manipulate. Radio buttons slow down interpretation and interaction. Slowing, discouraging, or worst of all, confusing a user's interpretation is bad, but slowing a user's manipulation of this option is good. Radio buttons also improve accessibility compared to the way they set up the slider because the text descriptions for each level are always on screen.

anonymous (not verified) said:

May 29, 2019

Permalink

Since no-script is hidden by default(can get appeared by customize), the default security level should be safest but not standard.

I also feel that Tor Browser shouldn't be shipped with the security setting set to "Standard" mode.

I did the following:

  • Add the following line to &lt;tor-browser-path&gt;/Browser/TorBrowser/Data/Browser/profile.default/user.js:
    user_pref(&quot;extensions.torbutton.security_slider&quot;, 1);
    (a value of 1 is for "Safest", and I believe 2 is for "Safer" and 4 is for "Standard")
  • Put NoScript back onto the toolbar. I want to clearly see whether or not Javascript is running and from what domains.

Does doing any of the above harm the browser's anonymity??

I think that should be okay, because we assume you are not the only one using the Safest settings. I agree with you that we might want to get to a default security settings of level "Safer" for Tor Browser. But we are not there yet as the usability penalty due to site breakage is still too high right now.

tormac (not verified) said:

May 29, 2019

Permalink

When using transport meek-azure on a Mac OS, 2 process names open called "tor browser" instead of just 1. Is this normal or a fault?

Anonymous (not verified) said:

May 30, 2019

Permalink

Why is the listed IP for the ExitNode in Tor Circuit informations not the same as shown in ip-check.info test results for 'your ip' ?

There could be different reasons for this, so this is hard to say without looking at what is actually going on. What often happens for this kind of tests is that they first try to determine your IP address and then bounce you off to different domains testing various tracking mechanisms and you finally land on the results page showing the IP they saved first together with the other results. However, that bouncing off to other domains causes different circuits to be used and thus, your circuit display gets updated which causes the effects you see.

Anonymous (not verified) said:

June 06, 2019

Permalink

thx
whoer.net is identical to ip-check.info, another (my) IP than listed in Tor Circuit, but other myip info sites are identical with the listed ExitNode, so far so good. How could it be, to find some IPs in protocol using Tor, with 0 zero bytes send, but 3 bytes received. Is this ok and has technical reasons, because should never happended at all using firewall, e.g. found 212.51.156.89 with that and 37.191.193.148 too and this one with destination port 38443, both 0 zero bytes send from own system, 3 bytes received by own system. Why received without started connection?

Anonymous (not verified) said:

June 09, 2019

Permalink

Sry, there was a fault in my post, 0 zero packets send and 3 packets received wasn't from system view, the data log shows the outside IPs view, so my system had send 3 packets to Tor IP x.x.x.x, but received none, so that's how it should work and hadsdone, sry.

Anonymous (not verified) said:

June 10, 2019

Permalink

Next question. Actually, I always used to see all Tor connected IPs with minimum some packets send and some packets received (e.g. 3 send, 3 received). So this behaviour, see my last posts, the Tor Node gets 3 packets from own system and didn't done handshake, means Tor Node didn't answer, I didn't mentioned before. Is there an explanation for this?

sysrqb

sysrqb said:

May 31, 2019

Permalink

In addition to this ticket (thanks GeKo), do you know how to obtain system logs from this device (using adb logcat, or similar) and, if yes, can you provide the crash log stack trace for it? Either providing it here or on the ticket are good.

Also, did you try the new alpha version? There isn't much difference between the stable and alpha version, but confirming the alpha version crashes would be good, too.

Anonymous (not verified) said:

June 03, 2019

Permalink

read the tcket which includes replicant's

they are suggesting using a dev version, do you know where to download this?

Mr (not verified) said:

May 31, 2019

Permalink

despite being on tor browser whenever i try to use any onion links. it tells me that i need to download tor browser to access the link BUT im on tor browser when it says that??? can anyone help im so confused XD

Heloise (not verified) said:

June 03, 2019

Permalink

Idea: there should be an official TP list, easy to find in TP website, describing some things to mention in any TBB bug report. For example:

o what operating system are you using?

o where did you get Tor Browser and how did you install it? did you verify the detached signature before installing? [How does one replace "detached signature" with concise ordinary language? I have no idea.]

o are you running multiple instances of Tor or Tor Browser? [How does one replace the technical term "instance" with concicse ordinary language? Nothing comes to mind.]

o what exactly did you type into the Tor Browser location pane and exactly what happened next? [How does one replace "location pane" with concise ordinary language? How to handle fact most users will be too stressed to write down exactly what happened for a bug report? I have no idea.]

I have no idea if this is helpful in answering the OP but it might start some wheels turning about improving Tor Browser support.

None (not verified) said:

May 31, 2019

Permalink

I can not run my Obfs4 bridge which works normorally on PC in TBB for Android. Can you check it? Please!
In addition, there are only 2 kinds of bridge(Obfs4 and Meek azure) can be used in China. We need more new kinds of bridge!

None (not verified) said:

June 04, 2019

Permalink

I make the Obfs4 bridge by myself. I copy it which work normally on desktop to TBB on Android, TBB stop at 10% and report error

None (not verified) said:

June 05, 2019

Permalink

Update:
The same bug appear in TBB 8.5.1 for Ubuntu, but work nomorally in TBB 8.5.1 for Windows. I am sure that the version of Obfs4proxy and Tor is the lastest in My vps

Anonymous (not verified) said:

June 02, 2019

Permalink

Now that the NoScript button has been removed, how am I supposed to whitelist JavaScript on one website? (I use Safest mode.) For example, youtube.com.

You can't change about:tor, but you can type search words in the address bar and click one of the engine icons that appear under it. Press Enter to use the default search engine. You can change the default engine in about:preferences -> side column: Search. Or you can add a search box to the toolbar at the top of that preferences Search page.

dum dum person (not verified) said:

June 02, 2019

Permalink

I could swear that when I last used Tor quite a while ago, there was a link to a list of trusted and legitimate onion websites (such as email websites) and I cannot find anything. I'm nervous to do anything on Tor at the moment because I'm not sure what is legitimate or secure.

> I could swear that when I last used Tor quite a while ago, there was a link to a list of trusted and legitimate onion websites (such as email websites) and I cannot find anything

Are you using Tor Browser installed in your Microsoft/Apple/Linux system? Or in Tails? The version in Tails offers a few bookmarks (to clearnet webmail sites such as Riseup).

> I'm nervous to do anything on Tor at the moment because I'm not sure what is legitimate or secure.

Did you install Tor Browser 8.5 after verifying the detached signature of the tarball obtained from torproject.org? Or burn a Tails DVD after verifying the detached signature of the ISO image obtained from tails.boum.org? If so your Tor Browser should be *legitimate*.

*Secure* is a much more difficult quality to estimate and is also time dependent. As a practical matter, users must rely upon incomplete knowledge to make the best guesses they can based upon what they know and whom they trust.

It is probably helpful to think about security/anonymity citizen tools like Tor Browser (and Tails) as being the good guys in an arms race with a host of dangerous and well resourced but not truly omniscient or omnipotent bad guys like NSA/TAO. Our worst enemies are far better funded than Tor Project but we must bear in mind that they have problems too (drowning in information, barraged by demands for urgent "solutions" to issues which might not affect most Tor users at all, hampered by concern about their own poor OpSec and sometimes about trying to avoid attributability, confused by myriads of software and hardware which can make finding zero day exploits more of a challenge even for initial stages of compromise, etc).

There is a great deal of misinformation (some of it very possibly manufactured by our enemies) constantly being promoted in mainstream media and other sources, which tends to deter potential Tor users from trying to learn more about Tor, and tends to distract from issues which may pose the greatest risk to the most endangered people. For example, the recent Mozilla issue has highlighted one of the most difficult problems which confronts the Tor community: Tor Project software is open source and TP tries to audit it, so obvious "backdoors" are unlikely to appear in binaries produced by TP, but Tor software incorporates code from other open source projects which may not receive as much scrutiny; even worse, security critical components such as pseudorandom number generators have parameters which can be subtly altered to cripple them.

But the single biggest risk to most Tor users is probably security vulnerabilities in the system on which they are running Tor Browser (or another TP product). Tails is an excellent choice for a convenient and easy to use Linux system (based on Debian) booted from DVD or USB, which tries to implement many basic protections against unknown vulnerabilities or accidental leaks, such as modest AppArmor and a stringent Tor-friendly firewall. But Tails also has long standing issues with using persistent entry nodes (counter-intuitively, this is desirable for better anonymity) and, some users fear, with ensuring excellent entropy (for stream encryption).

(Tails can be used with a commercial entropy source but independent tests suggest these devices produce poor quality pseudorandom bitstreams.)

It would be wonderful if Tor Project kept in a visible place a few handy links to the best sites which can help ordinary people--- these days the list of endangered people includes reporters, diplomats, lawyers, telecom engineers, small business owners, election officials, social workers, medical providers, i.e. just about anyone--- such as ssd.eff.org. I particularly recommend that anyone who suspects they may become a target for corporate or state-sponsored cyberespionage or cyberwar actions start here:

https://ssd.eff.org/en/module/your-security-plan

Hope this helps!

Testing... (not verified) said:

June 03, 2019

Permalink

In tar : tor-browser-linux64-8.5_en-US.tar.xz

File : tor-browser_en-US/Browser/.config/gtk-3.0/settings.ini

Add Lines :
gtk-recent-files-max-age=0
gtk-recent-files-limit=0

To prevent file : ~/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/.local/share/recently-used.xbel

Being populated with a complete record of all files downloaded.

Thank you.

Anonymous (not verified) said:

June 03, 2019

Permalink

On previous versions of Tor, I used to notice a drop down which appeared that said, "Will you allow [website name] to use your HTML5 canvas image data? This may be used to uniquely identify your computer." With this newest version of Tor that drop down no longer appears on many of the same websites it used to. I'm not as technically literate as many of the people in this discussion, so I was wondering if someone can explain why this canvas fingerprinting drop down longer appears, and whether or not my anonymity in the way of canvas fingerprinting is as secure as it was in previous versions?

Woops sorry I asked this dumb question. Like I said I'm not very technically literate lol. I answered my question for myself after opening my eyes a bit for the new version: canvas fingerprinting management no longer drops down on its own by default... You now have to click the little canvas icon around the left side of the Tor address bar that looks like a little mountain and a sun; the one that says "manage canvas extraction permission" when you hover the cursor over it. After clicking it you can see the notice "Will you allow [website name] to use your HTML5 canvas image data? This may be used to uniquely identify your computer." to select allow data access or not.

Chrome (not verified) said:

June 03, 2019

Permalink

After the update, I can not go through the browser to "localhost". And I can not run my sites on the tor network

TorUser (not verified) said:

June 03, 2019

Permalink

Since updating the Tor Browser to version 8.5, I can no longer play videos or audio. I thought that the Tor browser had gotten corrupted when updating so I did a fresh install, but I still have the problem. I also cannot run the browser sandboxed in Sandboxie. Are these intentional changes? Such problems certainly limit the usability of this browser.

TorUser (not verified) said:

June 11, 2019

Permalink

The video issues have something to do with the webgl setting in NoScript. I prefer to disable webgl unless I absolutely need it. Up until I updated to Tor Browser v 8.5, I used to disable (uncheck) webgl in the NoScript settings for all 3 categories, "default," "trusted," and "untrusted." When I unchecked the webgl setting in v. 8.5, I could not get videos to play even if I re-checked off (enabled) webgl in all three categories. However, if I exited the Tor Browser and relaunched it, the videos would play as long as I did not disable the webgl setting in any category. I would like to be able to disable webgl, and still play videos, because I believe that webgl is a security risk.

I have not made any Tor Browser modifications. My operating system is Windows 10 Home Edition, Version 1803, OS Build 17134.765.

As for the sandboxing issues, I left a comment on the ticket you linked to.

Okay, so you took a clean, new Tor Browser 8.5 and watching Youtube videos worked? Does setting the security state to "safer" and (doing the click-to-play dance on Youtube) still get you working videos? Or does that already break? What do you set exactly in a clean Tor Browser 8.5 in NoScripts settings menu to make video playback break?

TorUser (not verified) said:

June 15, 2019

Permalink

I've been doing some testing, and this problem appears to be more complex than I first thought. I have been able to reproduce the problem by taking the following steps: I start the Tor Browser and YouTube videos will play as long as I do not touch the settings in NoScript or change the security level from "Standard." If I uncheck either "scripts" or "WebGL" in the NoScript Default tab, videos will stop playing. All I see is a circle spinning in the middle of the video player. Re-enabling "scripts," when that has been unchecked alone, does not fix the problem. In other words, there is no way to re-enable the playing of videos once anything has been unchecked in NoScript.

If I change the Tor Browser security level to "safer," the videos stop playing and there is no way to enable them. Again, all I see is the spinning circle even if I try to set NoScript to allow YouTube to play. Even disabling script blocking for the YouTube tab will not allow the videos to play. So, the problem seems to have something to do with how NoScript is allowing or blocking scripts running on the page. But, there is no way to customize this, as I used to do by preventing scripts and WebGL from running on the Default tab and then just enabling scripts on sites I trust.

Another observation I made (which may or may not be related to the video playing problem) is that the browser seems to be using more memory than it did in the previous version. Closing tabs, even down to one tab, does not release any memory. When this memory issue occurs, the pages in the tabs do not render immediately when I click on the tab. What I see is a circle of bars spinning around for a long time before the page displays. And if the problem gets bad enough, only the top half of the page will display and the bottom half is blank.

I occasionally get the warning message that a script is slowing down Tor Broswer and asking me if I want to stop it. This makes me think that both problems, the videos not playing and the high memory usage, are related to script blocking.

Thanks for the investigation: If you change the Tor Browser security level to "safer" do you mean changing it during the video playing or are you seeing the problem after setting the settings to "safer" and then trying to play the video?

Ann (not verified) said:

June 04, 2019

Permalink

Is there a way to migrate bookmarks on Tor Browser Android? I don't wont to use Sync.
On Windows you can copy the json file, or do a backup, I can't seem to find anything on Android.
THANKS

Saving Images … (not verified) said:

June 04, 2019

Permalink

Is there an issue with saving images on Android using Tor Browser - Save image.

Screenshot doesn't work as well. I guess must be a big privacy issue.

Anonymous (not verified) said:

June 27, 2019

Permalink

Nothing happens, when you Click Save Image (on Android), the prompt just disappears. and you assume the image is being downloaded but nothing shows in the download manager,
Storage permission is allowed by the way.

gk said:

What happens if you try to save images? How can we reproduce your problem? Regarding the screenshot, yes, this is currently disabled as it is a privacy issue. We want to provide a better solution here, though, see: https://trac.torproject.org/projects/tor/ticket/27904.

Anonymous (not verified) said:

June 05, 2019

Permalink

terrible. doing same as mozilla did firefox. bury functionality and options in more screens
REMOVED security slider.
REMOVED NOSCRIPT

shame

The slider did not get removed. In fact, it did not even get buried in more screens. The level of screens stayed the same. Yes, we removed NoScript from the toolbar. If you think you really need it and take the risk of navigating its user interface properly, feel free to add it back to the toolbar (while we are working on exposing the per-site security settings directly in the browser: https://trac.torproject.org/projects/tor/ticket/30570). It's still there. However, the NoScript interface is not needed for everyone else and just confusing which is why we hid it.

None (not verified) said:

June 05, 2019

Permalink

Why not use Ocserv(Openconnect) and Wireguard which work well in China to make new kinds of bridge?

I guess mainly because nobody has investigated whether it is possible to use those for pluggable transports. It's probably hard to look like Wireguard traffic on the wire but even if it was possible to blend in, it might be possible for censors to just block that kind of traffic and be done with this pluggable transport. We might need better strategies in that case.

None (not verified) said:

June 20, 2019

Permalink

China goverment has blocked Wireguard website but Wireguard still work normally in China. They know Wireguard but they have no idea for blocking it in short time. And how about Openconnect? It works normally in China (Not only Anyconnect client,but Openconnect-gui) for ten years more.

Vidi Vici (not verified) said:

June 06, 2019

Permalink

On a Linux computer, Tor warns that maximizing the browser is a security risk as it can publicize your screen size, but on mobile, Tor takes up one's entire screen. I'm just a layman, but is it possible for Tor to run on only part of a screen on a mobile device? If not, how much of a risk does this present?

Anonymous (not verified) said:

June 11, 2019

Permalink

Tor Android doesn't show a Tor button and there is no icon to check the circuit. Do I need to use the desktop version for this?
Thanks.

Yes, there are a bunch of features not implemented yet on mobile which are available on desktop. We try to get that set reduced over the coming months, but so far you can check out what we already have on our radar by following tickets with the tbb-parity keyword: https://trac.torproject.org/projects/tor/query?status=accepted&status=a….

(The missing circuit display on mobile is among them)

John, the elder (not verified) said:

June 15, 2019

Permalink

Dear developers,
I'm still experimenting but I think that Windows 10 is "spying" on the TOR browser. With Linuxes didn't see the problem. Two times I experimented with a visit to sites about 'Dating' and the other one about 'Health', with TOR browser, but NEVER with ordinary browsers.
I always deny most of the cookies in ordinary browsers.
I was looking at news on 'Microsoft Edge' and dating ads appeared, also a few days back had also health ads.
If I see my that ads about my third experiment comes up, I will post here again.

Trademark/Copyright FAQ
Option 1: In your tor-browser folder, icons are in this folder: /Browser/browser/chrome/icons/default
Option 2: Browse the git tree. Click official, alpha, or nightly folder. Click "plain" at the end of the row for one of the icon image files.

Other icons in the Tor Project style guide.
Icons that were in the round of voting for the current icon

Xy (not verified) said:

June 24, 2019

Permalink

ваш тор все хуже и хуже, вообще в говно превратили браузер, куда дели настройки, которые были под луковичкой в верхнем левом углу? зачем убрали возможность сменить IP для отдельной страницы, не перегружая весь браузер? Дерьмо. Верните все назад, как было. Этим уже нельзя пользоваться.