Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Javascript exploit actively used against TorBrowser

lists.torproject.org

Post reply on HN
Print view View original

51–60 of 138 posts

Re: Javascript exploit actively used against TorBrowser

#51

Post by trome »

secfirstmd wrote: post #12
micaksica wrote: post #11

Earlier quoted context omitted.

What's their biggest struggle with it? PS, if you're ever on the US West Coast or in Singapore, drop me a DM. I'll buy you a drink someplace.

Honestly? Many things: -It's tricky for a non-technical user to setup -It disrupts their regular workflow -People get frustrated with speeds of Tor etc -People get frustrated with Captcha (Dam Cloudflare!) and other things caused by using Tor in a safe manner. -People get annoyed as it doesn't solve their problems and exposure on mobile -You have to restart to run it -They can't run their regular programs on it - MS…

Perhaps a solution all on an OrangePi 2E or something similar would be better, since then you have a libre platform with no blobs, and then you can theme it to be close to Windows.

Ideally Tails would move in the direction of Signal Private Messenger, Anonymity tools need to be as user friendly as possible, otherwise the user has to develop specialized skills and expectations to deal with them, which creates user rejection & user apathy.

Or, we could swap i2p in there, it'd likely be more consistent than TBB, but user friendliness was worse last I checked.

Re: Javascript exploit actively used against TorBrowser

#52

Post by trome »

micaksica wrote: post #23
easychewie wrote: post #18

Earlier quoted context omitted.

> fullscreen Tor browser Tor recommends not going full-screen, since window size can be used as one of several identifiers.

The VM can go "full screen" and lock the height/width in X, then.

We could do stretching then when the user tries to enbiggen it, that way they don't get deanonymized!

Re: Javascript exploit actively used against TorBrowser

#53

Post by MikeHolman »

ryuuchin wrote: post #31
micaksica wrote: post #7

If TBB leads want to run Firefox with JavaScript "default on", then Tor Browser Bundle needs to be messaged as insecure. Either that or turn on NoScript and inform people what bad shit can happen when their browser is interpreting arbitrary code in a not-so-sandboxed manner. TBB is not a solution against targeted deanonymization attacks. This is neither the first nor is the last 0day in Firefox that will affect TBB.…

> A 30 second glance at the source code makes it looks like this exploit pivots to attacker-controlled memory on the heap, and spawns a thread using kernel32.dll. As EMET has hardening against attacks like this, I am curious if this exploit works at all on EMET-enabled Windows systems. EMET can be bypassed so it's no guarantee that it would stop the exploit (but it would probably stop THIS exploit). I don't know if s…

I don't know much about EMET. How would they mitigate this? After all, it's obviously valid for a VM to call CreateThread.

Re: Javascript exploit actively used against TorBrowser

#54

Post by secfirstmd »

wheelerwj wrote: post #50
secfirstmd wrote: post #46

Earlier quoted context omitted.

Hey no worries....a few things. -Umbrella on iOS is coming in 2nd quarter of next year! Whoohoo (We get asked about this all the time). -The main reason that we and a number of other open-source projects built on Android first is that because is by far the dominant smartphone platform. Especially in developing areas with significant human rights problems like China, Russia, parts of Africa and Asia. Mainly because th…

Thanks! That's mostly what I suspected. Android does have massive market share outside of North America, but here it is much closer to 50/50. Obviously our security/privacy concerns are drastically different than those in other parts of the world so it makes sense to secure android first. It's hard to recommend alternative distributions of android to most people. I feel like it's similar to linux 15 years ago, it CAN…

Yes. Though in some countries and threat models (where Google/NSA is not your problem) we are seeing many activists/journalists switching entirely to a Google Platform...Google Apps, Docs, Android, Google Chromebooks etc. If implemented properly (two factor etc) in some threat models it actually makes more sense compared to a mishmash of systems without anyone capable of monitoring and protecting them - and it helps to reduce the overall attack surface...It's not ideal but often the best that can be offered in certain circumstances.

Re: Javascript exploit actively used against TorBrowser

#55

Post by secfirstmd »

trome wrote: post #51
secfirstmd wrote: post #12

Earlier quoted context omitted.

Honestly? Many things: -It's tricky for a non-technical user to setup -It disrupts their regular workflow -People get frustrated with speeds of Tor etc -People get frustrated with Captcha (Dam Cloudflare!) and other things caused by using Tor in a safe manner. -People get annoyed as it doesn't solve their problems and exposure on mobile -You have to restart to run it -They can't run their regular programs on it - MS…

Perhaps a solution all on an OrangePi 2E or something similar would be better, since then you have a libre platform with no blobs, and then you can theme it to be close to Windows. Ideally Tails would move in the direction of Signal Private Messenger, Anonymity tools need to be as user friendly as possible, otherwise the user has to develop specialized skills and expectations to deal with them, which creates user rej…

Having tried and failed many times, I haven't really found specific hardware deployments (e.g locked down Raspberry Pi) to work for most people. Again it's too disruptive.

Re: Javascript exploit actively used against TorBrowser

#56

Post by micaksica »

vilhelm_s wrote: post #48
micaksica wrote: post #7

If TBB leads want to run Firefox with JavaScript "default on", then Tor Browser Bundle needs to be messaged as insecure. Either that or turn on NoScript and inform people what bad shit can happen when their browser is interpreting arbitrary code in a not-so-sandboxed manner. TBB is not a solution against targeted deanonymization attacks. This is neither the first nor is the last 0day in Firefox that will affect TBB.…

I've never understood the Tails threat model, and this comment does not really help. You say that it will prevent the attackers from learning any information, except the real IP address of the user. But hiding the IP address of the user is the whole point of Tor. If you give that up, then what's even the point? The state can simply drive a black van to your house and get the rest of your information at their leisure.

Fine. Replace Tails with Whonix-Workstation and Whonix-Gateway, if you need to worry about leaking the IP address.

Re: Javascript exploit actively used against TorBrowser

#57

Post by wheelerwj »

secfirstmd wrote: post #54
wheelerwj wrote: post #50

Earlier quoted context omitted.

Thanks! That's mostly what I suspected. Android does have massive market share outside of North America, but here it is much closer to 50/50. Obviously our security/privacy concerns are drastically different than those in other parts of the world so it makes sense to secure android first. It's hard to recommend alternative distributions of android to most people. I feel like it's similar to linux 15 years ago, it CAN…

Yes. Though in some countries and threat models (where Google/NSA is not your problem) we are seeing many activists/journalists switching entirely to a Google Platform...Google Apps, Docs, Android, Google Chromebooks etc. If implemented properly (two factor etc) in some threat models it actually makes more sense compared to a mishmash of systems without anyone capable of monitoring and protecting them - and it helps…

> it actually makes more sense compared to a mishmash of systems

100% agreed! It's like using new, super secret, awesome encryption (telegram/zcash) vs something more established that's been reviewed, tested, and has support.

Re: Javascript exploit actively used against TorBrowser

#58

Post by SparkyMcUnicorn »

cyphar wrote: post #40
ryuuchin wrote: post #29

This may be an unpopular opinion here but if the TorBrowser folks cared about security they should switch to a Chromium based browser. The sandbox provided by it would be robust and well tested as it's used in Chrome. I don't see why the two objectives of having a secure browser and the privacy/anonymity provided by Tor have to be diametrically opposed. You can have both.

Because removing all of the Google-related features from Chromium would be a very large task indeed. Quite a few people have discussed it within Tor (and IIRC some people started working on it) but it might not be as good of an idea as you might initially think.

Like this?

https://github.com/Eloston/ungoogled-chromium

Re: Javascript exploit actively used against TorBrowser

#59

Post by vilhelm_s »

micaksica wrote: post #56
vilhelm_s wrote: post #48

Earlier quoted context omitted.

I've never understood the Tails threat model, and this comment does not really help. You say that it will prevent the attackers from learning any information, except the real IP address of the user. But hiding the IP address of the user is the whole point of Tor. If you give that up, then what's even the point? The state can simply drive a black van to your house and get the rest of your information at their leisure.

Fine. Replace Tails with Whonix-Workstation and Whonix-Gateway, if you need to worry about leaking the IP address.

"If"? Are there any Tor users who don't need to worry about leaking their IP address? Then why do they use Tor in the first place?

The Tor project itself seems to promote Tails much more than Whonix, which seems very odd to me.

Re: Javascript exploit actively used against TorBrowser

#60

Post by cyphar »

SparkyMcUnicorn wrote: post #58
cyphar wrote: post #40

Earlier quoted context omitted.

Because removing all of the Google-related features from Chromium would be a very large task indeed. Quite a few people have discussed it within Tor (and IIRC some people started working on it) but it might not be as good of an idea as you might initially think.

Like this? https://github.com/Eloston/ungoogled-chromium

There is currently only one maintainer of that code, and there is this disclaimer in the readme:

> DISCLAIMER: Although it is the top priority to eliminate bugs and privacy-invading code, there will be those that slip by due to the fast-paced growth and evolution of the Chromium project.

Post reply on HN