Tor Browser disabled NoScript, but can't update

Post by tinus_hn » Sun, May 05, 2019, 5:47 PM UTC

netsharc wrote: post #61

Faark wrote: post #49

> Turns out an unrelated 3rd party can suddenly remotely disable Tor anonymity protections at their whim Am I the only one annoyed by people pushing this "they flicked a switch" narrative? No. They provided shitty software that didn't work under certain conditions (in this case date related) and thus broke your shitty software. A third party having remote control capability is something entirely different.

Lack of understanding of the technology and excessive paranoia will lead to that, I guess. "I'm telling you people, the man's after us!", and this man gets to feel like he's the hero exposing some conspiracy.

Post by EvilTerran » Sun, May 05, 2019, 5:51 PM UTC

pdkl95 wrote: post #85

EvilTerran wrote: post #78

Earlier quoted context omitted.

The malicious code may well have the necessary permissions to write to the profile folder, but not to modify the executable. Under the Unix security model, for example, that would be pretty likely: your profile's owned by your account, the executable & its containing folder are owned by root & go-w, so code running as you can tamper with the former but not the latter.

The malicious code can simply write an executable somewhere in the profile (or /tmp, or anywhere). It is highly unlikely that the profile (usually in /home/${USER}/) is on a filesystem mounted with the "noexec" flag. Or just inject code the browser at runtime. Under the Unix security model, the UID is the permission boundary. Even if the binary is owned by root, it inherits the user's UID when they run it.

Post by javagram » Sun, May 05, 2019, 6:36 PM UTC

Fnoord wrote: post #75

javagram wrote: post #16

Earlier quoted context omitted.

FWIW, since the original intent of the change to block unsigned plugins was to prevent third party software installers from adding malicious plugins without user consent, leaving a preference to toggle it back would have been pretty pointless as the third party installers could have just toggled the preference themselves (about:config is just some sort of easily modifiable data format on disk). TBH it’s not hard for…

> For instance, I already use a master password to encrypt/decrypt the password database in Firefox. This feature uses SHA-1. [1] > Why not allow the master password to also protect the settings and store them encrypted so a third party can’t modify them? It cannot protect against such. It can protect against a household adversary such as a 4 year old, and that's about it. [1] https://palant.de/2018/03/10/master-pass…

Post by [deleted] » Sun, May 05, 2019, 8:07 PM UTC

dontbenebby wrote: post #101

super_mario wrote: post #25

Earlier quoted context omitted.

Tor project is US government op, true. It's good at hiding government employees using untrusted networks from hostile third parties. It is also good for foreign whistleblowers releasing data to US government. Tor is NOT good at keeping you private from government. It is good at keeping you private from your ISP or employer however. Don't do anything illegal using tor and thinking you are safe.

How could Tor both be " good at hiding government employees using untrusted networks from hostile third parties " and " NOT good at keeping you private from government "?

Post by tgtweak » Sun, May 05, 2019, 10:46 PM UTC

Waterluvian wrote: post #60

TheRealPomax wrote: post #58

Earlier quoted context omitted.

Yep, that's how interview questions work. If someone immediately recommends a solution, that's someone who probably needs to grow in their field a little before being given a position where this is a potentially real situation.

And as an interviewer I don't really want an answer. What I really want is to watch your brain grind away at a problem. So ask these questions, even rhetorically. Talk through all. Your angles of attack.