HTTP proxy bug in Orbot 16.0.2-RC-1
I am the developer of Privacy Browser, a privacy focused Android browser. Privacy Browser has the option to proxy through Orbot. A user recently brought to my attention that there is a bug in the HTTP proxy of Orbot 16.0.2-RC-1 (downloaded from F-Droid) which causes all HTTP requests to fail. HTTPS requests work fine. Using Orbot in VPN mode works fine as long as Privacy Browser is not trying to proxy HTTP requests through port 8118, otherwise they still fail.
Downgrading Orbot to 16.0.0-RC-2-multi-SDK23 causes HTTP proxying to work correctly.
Testing was performed using Privacy Browser 2.11 on a Pixel 2 XL running Android 8.1.0 (API 27). Privacy Browser can be downloaded from F-Droid, but the current version, 2.11, is not yet available there. It can be downloaded directly from:
https://www.stoutner.com/privacy-browser/changelog/
Versions prior to 2.11 used the old WebView proxying code and do not work with the changes Google recently made to WebView. As such, they are not useful for testing this bug if the device has recently updated WebView.
Trac:
Username: soren@stoutner.com