Tor Browser 7.0a4 is released

Read their FAQ:

There is absolutely no backdoor in Tor. We know some smart lawyers who say that it's unlikely that anybody will try to make us add one in our jurisdiction (U.S.). If they do ask us, we will fight them, and (the lawyers say) probably win.

We will never put a backdoor in Tor. We think that putting a backdoor in Tor would be tremendously irresponsible to our users, and a bad precedent for security software in general. If we ever put a deliberate backdoor in our security software, it would ruin our professional reputations. Nobody would trust our software ever again — for excellent reason!

But that said, there are still plenty of subtle attacks people might try. Somebody might impersonate us, or break into our computers, or something like that. Tor is open source, and you should always check the source (or at least the diffs since the last release) for suspicious things. If we (or the distributors) don't give you source, that's a sure sign something funny might be going on. You should also check the PGP signatures on the releases, to make sure nobody messed with the distribution sites.

Also, there might be accidental bugs in Tor that could affect your anonymity. We periodically find and fix anonymity-related bugs, so make sure you keep your Tor versions up-to-date.

https://www.torproject.org/docs/faq.html.en#Backdoor

See "Real-world Exploits against the Tor Browser" pages 9-10 where they conclude,

> The reason is that these function pointers are only accessed through an indirection layer, i.e., memory objects on the heap contain a pointer to a virtual table which is located in the code or data section of the application and contains a number of pointers to virtual functions. Since the attackers can only disclose the virtual table pointer, but not the virtual table itself, as it is not on the heap, they cannot disclose gadget addresses. Note that, when only ASLR is applied, the address of the virtual table is randomized with the same offset as the ROP gadgets. Therefore, such an attack can bypass ASLR but not selfrando.

> We therefore conclude that selfrando can thwart most real-world exploits. Attackers can only succeed in rare cases where they can disclose the complete heap and data section.

[1] : https://people.torproject.org/~gk/misc/Selfrando-Tor-Browser...

> IIRC one of the Snowden documents even mentioned GCHQ and other organisations using Tor for their own purposes.

I think you're referring to this presentation about hidden services by the GCHQ [1] where they state, 'Until then... Doesn't stop us from using them'

I wonder what they may have to say about the soon coming next-gen onion services.

[1] : https://www.eff.org/files/2015/01/26/20141228-speigel-analyt... (page 25)

I think its terrifying that Firefox has so many build in things that make it easy to track people. Yet they claim to be so much about users privacy ... I think most of the stuff tor browsers does should actually be in firefox by default. Excluding Tor itself and noscript enabled by default.

not over 40 yet BUT I do love readability-enhancements like this :D

* use Firefox 'Reader View'; OR

* use this outline.com bookmarklet

  javascript:(function()%7Bwindow.location.href%20%3D%20'https%3A%2F%2Foutline.com%2F'%20%2B%20window.location.href%7D)()