Update Tor Browser design documentation for 6.5

We considerably changed Tor Browser behavior when moving from FQDN isolation to binding identifiers and circuits to the base domain. We should update the design document and include a motivation for this move.

added GeorgKoppen201703 TorBrowserTeam201703R component::applications/tor browser owner::gk priority::medium resolution::fixed severity::normal status::closed tbb-spec type::task labels

Trac:
Keywords: TorBrowserTeam201505 deleted, TorBrowserTeam201506 added

I will do a round of updates for 5.0 in August.

Trac:
Summary: Update Tor Browser design documentation for 4.5.1 to Update Tor Browser design documentation for 5.0
Keywords: TorBrowserTeam201506 deleted, TorBrowserTeam201508 added

While reading some recent and older papers about tracking on the internet and defenses against it it occurred to me we should update our No filters section pointing to these papers and explaining our point in more detail. We should somewhere mention as well that it is hard to make the difference between non-tracking and tracking third parties and only trying to take care of the latter as some approaches try to do. But I think this road is a dead-end as well which we should not go.

Some things to consider: http://ieee-security.org/TC/SPW2015/W2SP/papers/W2SP_2015_submission_24.pdf http://ieee-security.org/TC/SPW2015/W2SP/papers/W2SP_2015_submission_32.pdf https://jonathanmayer.org/papers_data/bau13.pdf https://www.usenix.org/system/files/conference/nsdi12/nsdi12-final17.pdf

Move remaining August tickets to September.

Trac:
Keywords: TorBrowserTeam201508 deleted, TorBrowserTeam201509 added

Another paper we could point to is

http://w2spconf.com/2009/papers/s2p1.pdf

for the idea to bind client side identifiers to the URL bar domain. Our solution is a bit more strict than their "No Spatial Tracking across Domain and Limited Temporal Tracking"-one but the underlying idea is the same.

Moving Tor Browser tickets to October 2015.

Trac:
Keywords: TorBrowserTeam201509 deleted, TorBrowserTeam201510 added

Trac:
Keywords: TorBrowserTeam201510 deleted, TorBrowserTeam201511 added

Trac:
Severity: N/A to Normal
Status: new to assigned
Sponsor: N/A to N/A
Keywords: N/A deleted, GeorgKoppen201511 added
Owner: tbb-team to gk

We should update section 6 of our specific fingerprinting defenses (fonts) as we actually don't ship our broken patch anymore (Gábor Gulyás pointed me to that, thanks).

Trac:
Keywords: TorBrowserTeam201511 deleted, TorBrowserTeam201512 added

Trac:
Keywords: GeorgKoppen201511 deleted, GeorgKoppen201512 added

Tickets for Jan 2016.

Trac:
Keywords: TorBrowserTeam201512 deleted, TorBrowserTeam201601 added

Trac:
Keywords: GeorgKoppen201512 deleted, GeorgKoppen201601 added

Putting stuff on the radar for February.

Trac:
Keywords: TorBrowserTeam201601 deleted, TorBrowserTeam201602 added

Updating my tickets.

Trac:
Keywords: GeorgKoppen201601 deleted, GeorgKoppen201602 added

Trac:
Keywords: GeorgKoppen201602 deleted, GeorgKoppen201603 added

Trac:
Keywords: TorBrowserTeam201602 deleted, TorBrowserTeam201603 added

Trac:
Keywords: GeorgKoppen201603 deleted, GeorgKoppen201604 added

Trac:
Keywords: TorBrowserTeam201603 deleted, TorBrowserTeam201604 added

Moving tickets

Trac:
Keywords: TorBrowserTeam201604 deleted, TorBrowserTeam201605 added

Moving things for me to May.

Trac:
Keywords: GeorgKoppen201604 deleted, GeorgKoppen201605 added

Trac:
Keywords: GeorgKoppen201605 deleted, GeorgKoppen201606 added

Trac:
Keywords: TorBrowserTeam201605 deleted, TorBrowserTeam201606 added

Moving my tickets

Trac:
Keywords: GeorgKoppen201606 deleted, GeorgKoppen201607 added

Trac:
Keywords: TorBrowserTeam201606 deleted, TorBrowserTeam201607 added

Moving items to August 2016.

Trac:
Keywords: TorBrowserTeam201607 deleted, TorBrowserTeam201608 added

Moving my tickets as well.

Trac:
Keywords: GeorgKoppen201607 deleted, GeorgKoppen201608 added

Moving my tickets

Trac:
Keywords: GeorgKoppen201608 deleted, GeorgKoppen201609 added

Tickets for September.

Trac:
Keywords: TorBrowserTeam201608 deleted, TorBrowserTeam201609 added

Moving my tickets

Trac:
Keywords: GeorgKoppen201609 deleted, GeorgKoppen201610 added

Moving tickets to October.

Trac:
Keywords: TorBrowserTeam201609 deleted, TorBrowserTeam201610 added

Trac:
Summary: Update Tor Browser design documentation for 5.0 to Update Tor Browser design documentation for 6.0
Reviewer: N/A to N/A

What is the reason to hide current development of the design documentation from TBB community? Maybe, it's better to start with the Working Draft v0.1 rather than trying to produce the Release in the dark?

Moving my tickets to November.

Trac:
Keywords: GeorgKoppen201610 deleted, GeorgKoppen201611 added

Moving tickets over to November.

Trac:
Keywords: TorBrowserTeam201610 deleted, TorBrowserTeam201611 added

Moving my tickets

Trac:
Keywords: GeorgKoppen201611 deleted, GeorgKoppen201612 added

Moving tickets to December.

Trac:
Keywords: TorBrowserTeam201611 deleted, TorBrowserTeam201612 added

Resolved #21070 (moved) as duplicate.

Trac:
Cc: mikeperry to mikeperry, i139

Trac:
Cc: mikeperry, i139 to mikeperry, i139, brade, mcs

Moving our tickets to January 2017

Trac:
Keywords: TorBrowserTeam201612 deleted, TorBrowserTeam201701 added

Trac:
Keywords: GeorgKoppen201612 deleted, GeorgKoppen201701 added

Take 6.5 into account as well. The changes are not that many and considerably fresh in memory...

Trac:
Summary: Update Tor Browser design documentation for 6.0 to Update Tor Browser design documentation for 6.5

Moving our tickets to Feb 2017.

Trac:
Keywords: TorBrowserTeam201701 deleted, TorBrowserTeam201702 added

Long overdue, but here is a branch for review in my public tor-browser-spec repo: bug_15988_v3 (https://gitweb.torproject.org/user/gk/tor-browser-spec.git/commit/?h=bug_15988_v3&id=761ae60c2f2880a3c17dba4f08e1e207fec8bc1a). It is squashed and rebased onto master. For an unsquashed branch see bug_15988.

Mike: I guess the website traffic fingerprinting parts could need an update as well. Those are the only ones I left untouched as I am not up-to-date wrt the current state of the art of available defenses/attacks.

Trac:
Keywords: GeorgKoppen201701, TorBrowserTeam201702 deleted, TorBrowserTeam201702R, GeorgKoppen201702 added
Status: assigned to needs_review

Resolved #20447 (moved) as a duplicate.

Trac:
Cc: mikeperry, i139, brade, mcs to mikeperry, i139, brade, mcs, tom

Is community feedback needed?

Also Arthur Edelstein suggests to update tor-browser-spec for esr52 in #21256 (moved).

Replying to cypherpunks:

Is community feedback needed?

"needed" seems to be the wrong word here. "appreciated" would be a good replacement. And, yes, if there is constructive feedback, please go ahead.

Trac:
Keywords: N/A deleted, tbb-spec added

Trac:
Cc: mikeperry, i139, brade, mcs, tom to arthuredelstein, mikeperry, i139, brade, mcs, tom