Skip to content

GitLab

  • Projects
  • Groups
  • Snippets
  • Help
    • Loading...
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in
Trac
Trac
  • Project overview
    • Project overview
    • Details
    • Activity
  • Issues 246
    • Issues 246
    • List
    • Boards
    • Labels
    • Service Desk
    • Milestones
  • Operations
    • Operations
    • Metrics
    • Incidents
  • Analytics
    • Analytics
    • Value Stream
  • Wiki
    • Wiki
  • Members
    • Members
  • Activity
  • Create a new issue
  • Issue Boards
Collapse sidebar

GitLab is used only for code review, issue tracking and project management. Canonical locations for source code are still https://gitweb.torproject.org/ https://git.torproject.org/ and git-rw.torproject.org.

  • Legacy
  • TracTrac
  • Issues
  • #18233

Closed (moved)
Open
Opened Feb 04, 2016 by cypherpunks@cypherpunks

Get rid of the cookie "protection" cruft from Torbutton

I wonder why Torbutton still includes the "cookie protection" stuff. Looks to me like that code is the oldest, ugliest, more useless part of the addon, am I wrong?

It seems to be a heritage from the days when one was supposed to attach Torbutton to any regular Firefox release. Does it even have a place in Tor Browser?

Last month someone in tor-talk asked what the cookie protection mechanism consisted of. There were 5 or 6 replies, including 1 from a Tor Browser guy. None of them answered the question, I suspect none of them knew (and failed to admit so).

Doesn't the whole "protection" add up to "won't be deleted when renewing identity" (if it worked, which apparently it doesn't)? If that's the case, then calling such cookies "protected" is pretty stupid. Call it "preserved" or something like that. I suspect "protected" made a bit more sense when Torbutton was supposed to handle both Tor and non-Tor sessions; those days are long gone.

Why not just remove that part of the addon? At least until it's been reworked.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
None
Milestone
None
Assign milestone
Time tracking
None
Due date
None
Reference: legacy/trac#18233