tor-browser-spec issueshttps://gitlab.torproject.org/tpo/applications/tor-browser-spec/-/issues2023-01-09T17:43:32Zhttps://gitlab.torproject.org/tpo/applications/tor-browser-spec/-/issues/40047Make human summary of Tor Browser design doc2023-01-09T17:43:32ZMike PerryMake human summary of Tor Browser design docWe should create a brief human-readable summary of the privacy properties of TBB, based on the Design Requirements.
We should probably include this in the short user manual, or on the download page, or both.
See also https://lists.torp...We should create a brief human-readable summary of the privacy properties of TBB, based on the Design Requirements.
We should probably include this in the short user manual, or on the download page, or both.
See also https://lists.torproject.org/pipermail/tor-talk/2012-January/022899.html.https://gitlab.torproject.org/tpo/applications/tor-browser-spec/-/issues/18820Integrate code signing into the release process2022-12-09T13:20:14ZGeorg KoppenIntegrate code signing into the release processWe should integrate the OS X code signing as good as we can into our release process. We have the following pieces at the moment
1) We create a .dmg file as the result of our build process
2) We have a signing machine where these files ...We should integrate the OS X code signing as good as we can into our release process. We have the following pieces at the moment
1) We create a .dmg file as the result of our build process
2) We have a signing machine where these files need to get transferred to
3) We need to sign the TorBrowser.app inside the .dmg file
4) We need to ship the .dmg file with the signed app
Taking these into account it seems quite cumbersome to automate this even a bit. But maybe there is something I am missing.
This ticket is not about signing/removing the signature in a reproducible fashion. Getting this going is very likely a separate fun task.https://gitlab.torproject.org/tpo/applications/tor-browser-spec/-/issues/21922Add our reasoning for dealing with the XPI signing to our design document2022-12-09T13:20:15ZGeorg KoppenAdd our reasoning for dealing with the XPI signing to our design documentWe missed to explain how we deal with the code-signing requirement for our own extensions. We should have that in our design document I think.We missed to explain how we deal with the code-signing requirement for our own extensions. We should have that in our design document I think.https://gitlab.torproject.org/tpo/applications/tor-browser-spec/-/issues/24945Tor Browser design doc says it whitelists flash and gnash as plugins2024-02-13T20:04:29ZRoger DingledineTor Browser design doc says it whitelists flash and gnash as pluginsThe Tor Browser design doc says "we also patch the Firefox source code to prevent the load of any plugins except for Flash and Gnash. Even for Flash and Gnash, we also patch Firefox to prevent loading them into the address space until th...The Tor Browser design doc says "we also patch the Firefox source code to prevent the load of any plugins except for Flash and Gnash. Even for Flash and Gnash, we also patch Firefox to prevent loading them into the address space until they are explicitly enabled."
If this is so, we should probably change Tor Browser to just prevent all plugins, including Flash and Gnash.
And if it is no longer so, we should fix the wrong statement in the design doc.
Noticed in legacy/trac#10885.https://gitlab.torproject.org/tpo/applications/tor-browser-spec/-/issues/25021Update Tor Browser spec2024-03-20T23:28:07ZGeorg KoppenUpdate Tor Browser specTor Browser 11.0 is coming out soon. We should update our design document to cover all the new issues that are showing up in it. Highlights are
1) Switch to rbm/tor-browser-build
2) The security slider copy update
...
The update should...Tor Browser 11.0 is coming out soon. We should update our design document to cover all the new issues that are showing up in it. Highlights are
1) Switch to rbm/tor-browser-build
2) The security slider copy update
...
The update should cover the current goals and state of the browser, and fold in all the 8.0, 8.5, 9.0, 9.5, 10.0, and 10.5 changes.Tor Browser: 11.0 Issues with previous releaserichardrichardhttps://gitlab.torproject.org/tpo/applications/tor-browser-spec/-/issues/25197Design document isn't precise about "Security" and "Privacy".2022-12-09T13:20:19ZArthur EdelsteinDesign document isn't precise about "Security" and "Privacy".In Tor Browser, we have a "Security" Slider and various "Privacy" features. But these words are not so easily distinguished. Maybe we could think of a better words?
In any case, we should defined the two concepts very clearly in the Des...In Tor Browser, we have a "Security" Slider and various "Privacy" features. But these words are not so easily distinguished. Maybe we could think of a better words?
In any case, we should defined the two concepts very clearly in the Design document, and we should make sure we don't mix them up. For example, section 2.1 is entitled "Security Requirements" but goes on to list what I would consider privacy properties and does not include the sort of security intended to be provided by the Slider.https://gitlab.torproject.org/tpo/applications/tor-browser-spec/-/issues/30072andlabs.org, linked from tor browser design doc, seems gone2022-12-09T13:19:35ZRoger Dingledineandlabs.org, linked from tor browser design doc, seems gonehttps://2019.www.torproject.org/projects/torbrowser/design/
in Section 3 of "Specific Fingerprinting Defenses in the Tor Browser" links to
http://www.andlabs.org/tools/jsrecon.html
which seems to have become a parked domain.https://2019.www.torproject.org/projects/torbrowser/design/
in Section 3 of "Specific Fingerprinting Defenses in the Tor Browser" links to
http://www.andlabs.org/tools/jsrecon.html
which seems to have become a parked domain.https://gitlab.torproject.org/tpo/applications/tor-browser-spec/-/issues/32715Document our downloads.json file2022-12-09T13:20:20ZGeorg KoppenDocument our downloads.json fileWe have https://aus1.torproject.org/torbrowser/update_3/release/downloads.json (and a similar URL for alpha (s/release/alpha)) for users/devs that want to keep a reliable way for grabbing the latest updates or pull the latest version inf...We have https://aus1.torproject.org/torbrowser/update_3/release/downloads.json (and a similar URL for alpha (s/release/alpha)) for users/devs that want to keep a reliable way for grabbing the latest updates or pull the latest version information so that they can see when new updates are available.
The JSON file got specifically created to be easily parsable in legacy/trac#16651. This seems to work pretty well from all we know but we never documented that feature nor specified it.
We think this should finally be mentioned on our dev portal and we should write kind of a retroactive proposal and put it into our proposal folder in `tor-browser-spec` so that we have something official we can link to.https://gitlab.torproject.org/tpo/applications/tor-browser-spec/-/issues/33070Update website traffic fingerprinting section in tor browser design doc2023-11-08T20:48:06ZGeorg KoppenUpdate website traffic fingerprinting section in tor browser design docThe website traffic fingerprinting section needs to get updated as there have been a bunch of more or less recent developments that are not accounted for in it. In particular our [recent blog post](https://blog.torproject.org/new-low-cos...The website traffic fingerprinting section needs to get updated as there have been a bunch of more or less recent developments that are not accounted for in it. In particular our [recent blog post](https://blog.torproject.org/new-low-cost-traffic-analysis-attacks-mitigations) about low cost attacks in this space could be a good starting point for getting the update going.https://gitlab.torproject.org/tpo/applications/tor-browser-spec/-/issues/33971Document Authenticode code signing certificate renewal process2022-12-09T13:19:27ZGeorg KoppenDocument Authenticode code signing certificate renewal processWhile it is still fresh we should document the process of renewing our Windows code signing certificate.While it is still fresh we should document the process of renewing our Windows code signing certificate.Tor Browser: 11.0 Issues with previous releasehttps://gitlab.torproject.org/tpo/applications/tor-browser-spec/-/issues/40014Mention the downloads.json file in processes/RollingBackUpdate2022-12-09T13:19:30ZboklmMention the downloads.json file in processes/RollingBackUpdateIn `processes/RollingBackUpdate` in the section about _Rolling back an update only for users of a specific platform_, we should mention the options to deal with the `downloads.json` file:
* redirecting it to the old version
* manually me...In `processes/RollingBackUpdate` in the section about _Rolling back an update only for users of a specific platform_, we should mention the options to deal with the `downloads.json` file:
* redirecting it to the old version
* manually merging the the two `downloads.json` fileshttps://gitlab.torproject.org/tpo/applications/tor-browser-spec/-/issues/40048Tracking related preferences mentioned in Tor Browser Design Document not set...2023-01-11T17:19:21ZAnonymousResearcherTracking related preferences mentioned in Tor Browser Design Document not set in Tor Browser<!--
* Use this issue template for reporting a new bug.
-->
### Summary
I apologize if this is already discussed in another place. I tried looking for some explanation of this topic, but the closest I found was tpo/applications/tor-brow...<!--
* Use this issue template for reporting a new bug.
-->
### Summary
I apologize if this is already discussed in another place. I tried looking for some explanation of this topic, but the closest I found was tpo/applications/tor-browser#40783 which discusses other preferences that are currently included. If this should be a comment of that issue, please let me know.
The 2019 version of the [Tor Browser Design Document](https://2019.www.torproject.org/projects/torbrowser/design/) mentions many Firefox preference changes that were implemented to avoid tracking on the web. Though this document never left the draft stage and is not reflective of the current Tor Browser, it lays out multiple reasons for the FF preferences that it mentions, and the ways in which they attempt to prevent tracking on the web. However, in the process of performing some research on the Tor Browser I found that many of the FF preferences have changed. Though most of these changes are reasonable and either explained or explainable (such as these preferences no longer being used in FF), a few preferences that appear to be related to tracking disappeared from TB. These include setting the following browser preferences:
1. javascript.options.asmjs to false (mentioned here: tpo/applications/tor-browser#19400, tpo/applications/tor-browser#21298, but none relating to tracking)
2. browser.cache.offline.enable to false
3. security.ssl.disable_session_identifiers to false
4. network.http.altsvc.enabled to false
5. dom.gamepad.enabled to false (mentioned here: tpo/applications/tor-browser#13023, tpo/applications/tor-browser#10750)
6. ui.use_standins_for_native_colors to true
7. webgl.min_capability_mode to true
8. media.webspeech.synth.enabled to false
9. dom.battery.enabled to false
10. dom.enable_performance to false
11. media.video_stats.enabled to false
12. dom.maxHardwareConcurrency to 1
13. reader.parse-on-load.enabled to false
14. browser.uitour.enabled to false
15. dom.sensors.enabled to false
Is this a bug, or are there reasons to believe that these no longer cause a tracking issue?
### Steps to reproduce:
**How one can reproduce the issue - this is very important.**
1. Open Tor Browser
2. Go to about:config
3. Accept the warning.
4. Search for the above listed preferences
### What is the current bug behavior?
The above preferences do not show the expected vales from the Tor Browser Design Document.
### What is the expected behavior?
The above preferences should show the expected values from the Tor Browser Design Document to avoid tracking.
### Environment
Ubuntu 22.10
From distribution tarball.
### Relevant logs and/or screenshots
N/A