Tor Browser 6.0a3-hardened is released

by boklm | March 8, 2016

A new hardened Tor Browser release is available. It can be found in the 6.0a3-hardened distribution directory and on the download page for hardened builds.

This release features important security updates to Firefox.

This release bumps the versions of several of our components, e.g.: Firefox to 38.7.0esr, Tor to 0.2.8.1-alpha, OpenSSL to 1.0.1s, NoScript to 2.9.0.4 and HTTPS-Everywhere to 5.1.4.

Additionally, we fixed long-standing bugs in our Tor circuit display and window resizing code, and improved the usability of our font fingerprinting defense further.

Note: There is no incremental update from 6.0a2-hardened available due to bug 17858. The internal updater should work, though, doing a complete update.

Here is the complete changelog since 6.0a2-hardened:

Tor Browser 6.0a3-hardened -- March 8

  • All Platforms
    • Update Firefox to 38.7.0esr
    • Update Tor to 0.2.8.1-alpha
    • Update OpenSSL to 1.0.1s
    • Update NoScript to 2.9.0.4
    • Update HTTPS Everywhere to 5.1.4
    • Update Torbutton to 1.9.5.1
      • Bug 16990: Don't mishandle multiline commands
      • Bug 18144: about:tor update arrow position is wrong
      • Bug 16725: Allow resizing with non-default homepage
      • Bug 16917: Allow users to more easily set a non-tor SSH proxy
      • Translation updates
    • Bug 18030: Isolate favicon requests on Page Info dialog
    • Bug 18297: Use separate Noto JP,KR,SC,TC fonts
    • Bug 18170: Make sure the homepage is shown after an update as well
    • Bug 16728: Add test cases for favicon isolation
  • Windows
    • Bug 18292: Disable staged updates on Windows

Comments

Please note that the comment area below has been archived.

Anonymous (not verified) said:

March 09, 2016

Permalink

hii i know many time this ask when will harden tbb for stable ? security vry important for me and what danger am i when alpha tbb i use? thank!! much love Qatar

There are no plans to have the current hardened features used in the stable series as well. There are performance issues and general issues of using ASan builds in production (i.e. stable series).

Anonymous (not verified) said:

March 09, 2016

Permalink

Just fired up tor 6.03a and it said an update was available. I have not downloaded the latest version but suddenly my onion button has disappeared. Is someone hacking? Strange coincidence that today in the UK there is a military security fair with a company that claims to be able to get files from encrypted trucrypt folders.

Anonymous (not verified) said:

March 11, 2016

Permalink

I cannot reproduce this event because it only happened with the update notification. The browser kind of 'jumped' then when it settled the onion button had gone. So did an update with the latest version and all works fine. In view of the other comment about anti virus causing a problem it indicates a glitch in the update notification link.

Anonymous (not verified) said:

March 09, 2016

Permalink

Hi, My question is this. Could you describe some of the differences between the standard stable torbrowser package, and the "hardened" version? Thank you.

Yes. The main differences are that Tor and Firefox the hardened series are compiled with Address Sanitizer and in Tor's case with Undefined Behavior Sanitizer additionally. Moreover, both Firefox and Tor are compiled with -fwrapv.

Anonymous (not verified) said:

March 10, 2016

Permalink

Can we get some practical examples of how these measures help? Helps protect against certain 0day bugs in Firefox?

This is a good question. We don't have those numbers (yet). However, we might learn something later this year when we'll look closer at Firefox's vulnerability history which is one of the ToDo things for our sponsor.

Anonymous (not verified) said:

March 12, 2016

Permalink

Please add a feature that allows drag and drop from the URL bar to the computer desktop to create an internet shortcut. This can be done in regular Firefox.

Anonymous (not verified) said:

March 14, 2016

Permalink

We need a feature that warns when a link leads to a site with capcha garbage so we can avoid those capcha using sites.

Anonymous (not verified) said:

March 15, 2016

Permalink

How i can solve this - > To view this page ensure that Adobe Flash Player version 11.1.0 or greater is installed.

Anonymous (not verified) said:

March 18, 2016

Permalink

Tor users HATE you Clownfare! Do you UNDERSTAND? We want you to GO OUT OF BUSINESS.

Anonymous (not verified) said:

March 24, 2016

Permalink

this browser is now necome very slow now.i have checked at on differnt pcs and laptops but working very slow

Anonymous (not verified) said:

April 24, 2016

Permalink

New to Tor. Is hardened Tor better? What is best version? Where
do I get step by step instructions how to use Tor instead of Safari or any other or do I use one special platform with Tor as main platform? if so, how? Which one?

Better not to put Tor on my Mac itself?

I will do anything to increase privacy.

suzannedk@gmail.com