Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor Browser disabled NoScript, but can't update

lists.torproject.org

Post reply on HN
Print view View original

101–110 of 125 posts

Re: Tor Browser disabled NoScript, but can't update

#101

Post by dontbenebby »

super_mario wrote: post #25
Svperstar wrote: post #8

I don't buy for 5 minutes that Tor Browser is secure regardless of configuration. TAILS maybe but Tor Browser you may as well let an FBI agent into your house. A few years back the government starts busting all these dark web sites/users and will pull out of court cases rather then explain how. Gee I wonder.

Tor project is US government op, true. It's good at hiding government employees using untrusted networks from hostile third parties. It is also good for foreign whistleblowers releasing data to US government. Tor is NOT good at keeping you private from government. It is good at keeping you private from your ISP or employer however. Don't do anything illegal using tor and thinking you are safe.

How could Tor both be "good at hiding government employees using untrusted networks from hostile third parties" and "NOT good at keeping you private from government"?

Re: Tor Browser disabled NoScript, but can't update

#102

Post by overgard »

Jonnax wrote: post #24
Causality1 wrote: post #6

I can't improve upon this comment: "Hey Mozilla - this is why people said that forcing addons to be signed with no way to disable was a bad idea. You didn't even make it a year without screwing it up. Who could have seen this coming? Oh wait, pretty much everyone who argued against this policy."

It's a dumb comment. There was a ton of malware being distributed as add-ons that came packaged with other installers. This solved that issue.

The cost of their “solution” seems pretty high in retrospect.

This isnt a binary proposition, they could have solved that issue while respecting user choices, if it had been a priority. The solution they chose inherently was flawed. Hopefully this gives other providers pause before they build similar things.

Re: Tor Browser disabled NoScript, but can't update

#103

Post by EvilTerran »

the8472 wrote: post #89
EvilTerran wrote: post #84

Earlier quoted context omitted.

Who argued that, where? I don't see it in this subthread. Regardless, as I said in my comment, I only mentioned the Unix model "for example" - not to "shift the goalposts", just because I'm more familiar with it than with whatever anti-binary-tampering measures Windows may have.

https://blog.mozilla.org/addons/2015/04/15/the-case-for-exte...

That very page acknowledges your concern & presents their counterargument - namely, they consider security software to be part of the Windows model, and expect that to intervene in the case of modified binaries:

> By baking the signing requirement into the executable these programs will either have to submit to our review process or take the blatant malware step of replacing or altering Firefox. We are sure some will take that step, but it won’t be an attractive option for a Fortune 500 plugin vendor, popular download sites, or the laptop vendor involved in distributing Superfish. For the ones who do, we hope that modifying another program’s executable code is blatant enough that security software vendors will take action and stop letting these programs hide behind terms buried in their user-hostile EULAs.

(emphasis mine)

Re: Tor Browser disabled NoScript, but can't update

#104

Post by swiley »

dontbenebby wrote: post #99
swiley wrote: post #94

I remember saying over and over again that using Firefox for the TOR browser was a horrible idea. Use curl -H "" and links --dump. Until we have something sane that's really the only safe way to browse TOR if you actually have something to hide. (There's dillo and other things like the absolutely horrifying browser I've been writing but that hardly even supports forms right now heh. but I'm worried about connecting s…

OTOH the more people who use Tor, the more anonymous everyone on the network is, so having a usable version is important. https://www.freehaven.net/anonbib/cache/usability:weis2006.p... People with heightened privacy concerns can always use Whonix or Tails instead.

curl is good enough for fetching RSS, leaving that running would probably help quite a lot.

Re: Tor Browser disabled NoScript, but can't update

#105

Post by cjbprime »

Faark wrote: post #49

> Turns out an unrelated 3rd party can suddenly remotely disable Tor anonymity protections at their whim Am I the only one annoyed by people pushing this "they flicked a switch" narrative? No. They provided shitty software that didn't work under certain conditions (in this case date related) and thus broke your shitty software. A third party having remote control capability is something entirely different.

The extension disabled itself due to expiry in this case, but it sounds like OP is upset that Mozilla can remotely disable extensions used by Tor users at will with a kill switch (which they didn't use here, but surely exists to combat malicious extensions).

Some other people are also upset that the Normandy system has the capability of pushing extensions that it does and that it is apparently on by default.

These both seem like reasonable concerns that are unrelated to the expiry but highlighted by it.

Re: Tor Browser disabled NoScript, but can't update

#106

Post by overgard »

Faark wrote: post #49

> Turns out an unrelated 3rd party can suddenly remotely disable Tor anonymity protections at their whim Am I the only one annoyed by people pushing this "they flicked a switch" narrative? No. They provided shitty software that didn't work under certain conditions (in this case date related) and thus broke your shitty software. A third party having remote control capability is something entirely different.

> Am I the only one annoyed by people pushing this "they flicked a switch" narrative?

What they set was essentially a dead mans switch, though.

> A third party having remote control capability is something entirely different.

They’re pushing fixes through a telemetry channel which can also be used to change your preferences soo..

Re: Tor Browser disabled NoScript, but can't update

#107

Post by cjbprime »

AnaniasAnanas wrote: post #83
cjbprime wrote: post #56

Earlier quoted context omitted.

I wouldn't agree with the claim, but it might be referring to Tor's weaknesses against country or global passive adversaries -- timing attacks correlating your requests with the site's responses. If you can log everyone's bandwidth and can get ISPs to tell you which human is using Tor, metadata anonymity goes away.

Isn't this true for pretty much every privacy tool (i2p, freenode, gnunet, etc) though? I don't think that any of them can protect you if an adversary can monitor the whole internet.

Yes. There are some research networks like Vuvuzela that add noise to resist timing attacks but they aren't common.

The reason it's still a valid criticism is that people suggest that Tor has this resistance in threads like this one. :)

(Of course, you don't need to monitor the whole Internet if it's intra-country traffic that you're interested in.)

Re: Tor Browser disabled NoScript, but can't update

#108

Post by the8472 »

EvilTerran wrote: post #103
the8472 wrote: post #89

Earlier quoted context omitted.

https://blog.mozilla.org/addons/2015/04/15/the-case-for-exte...

That very page acknowledges your concern & presents their counterargument - namely, they consider security software to be part of the Windows model, and expect that to intervene in the case of modified binaries: > By baking the signing requirement into the executable these programs will either have to submit to our review process or take the blatant malware step of replacing or altering Firefox. We are sure some will…

Replacing FF stable with FF dev edition would not constitute modifying the program, it's installing a new browser. A lot of installers shipped chrome, this was even encouraged by google. So I do not think this addresses the issue.

Re: Tor Browser disabled NoScript, but can't update

#109

Post by marcinzm »

crehn wrote: post #96
tknkx wrote: post #86

Earlier quoted context omitted.

The way I understand it is: certificate revocation is handled by checking OCSP servers, and OCSP servers can be programmed so they give different answers depending on the IP address of whomever is asking. In other words, it should be possible to disable all addons for a selected user by targeting him by IP address.

Seems that Firefox skips revocation checks for CA certs [1]. [1] https://wiki.mozilla.org/CA/Revocation_Checking_in_Firefox

Where does it say that? The link says they centrally manage revocations using OneCRL and then push a single revocation list to browsers (independent of browser updates). Which means they can revoke any certificate they want using that mechanism.

Re: Tor Browser disabled NoScript, but can't update

#110

Post by bennofs »

ben_jones wrote: post #66
tgtweak wrote: post #23

Earlier quoted context omitted.

It's one of my favorite interview questions. I only know the answer because it happened to us once with 5M users on the affected version before it was discovered. It's a very good question to see how people react in a mostly hopeless situation. The only candidate out of 100s to logically get to the solution (or essentially it) was one of the best engineesr I've hired and worked with. "So you and your team just releas…

To play around with a non-technical solution I would consider rushing out a "Version 2.0" of the application that accomplishes the following (if possible within a 1) Has a functioning update service that fixes the original problem 2) A quick re-skin/theme-change to i.e. a more "modern" version of its original design 3) Whatever performance/security improvements you can cobble together quickly or were in the pipe alre…

I might not be your target user base, but that's exactly the opposite of what I would like as an user. I am already forced to update because the current version does not work correctly. Forcing UI/design/any major change (especially ones that are "quickly cobbled together" and thus might be buggy) on me in that situation is not nice. I am then left with the choice between a) non working software or b) a major update I might not like.

Perhaps it's good from the company POV because that's how you make sure your users migrate to the new version even if it is still inferior/buggier.

Post reply on HN