Tor Browser 5.0 is released

The Tor Browser Team is proud to announce the first stable release in the 5.0 series. This release is available from the Tor Browser Project page and also from our distribution directory.

This release features important security updates to Firefox. Note that the recent PDF.js exploit did not affect 4.5 users, but they should upgrade to this release immediately because numerous other potential security issues were fixed by Mozilla in this release. (Incidentally: Users who are using the 5.0-alpha series are vulnerable to the PDF.js exploit, but not if they were using the 'High' security level. Regardless, we are also upgrading 5.0-alpha users to 5.5a1 today to fix the issue as well).

This release also brings us up to date with Firefox 38-ESR, which should mean improved support for HTML5 video on Youtube, as well as a host of other improvements. Controversial and hard-to-audit binary components related to EME DRM were disabled, however.

The release also features new privacy enhancements. In particular, more identifier sources that appeared in Firefox 38 (or were otherwise disabled previously) are now isolated to the first party (URL bar) domain. This release also contains defenses from the 5.0-alpha series for keystroke (typing) fingerprinting and some instances of performance/timing fingerprinting.

Regrettably, our new defenses for font and keyboard layout fingerprinting did not stabilize in time for this release. Users who are interested in helping us improve them should try out 5.5a1.

This release also will reset the permanent NoScript whitelist, due to an issue where previous NoScript updates had added certain domains to the whitelist during upgrade. The whitelist is reset to the default for all users as a result, and future updates to the whitelist by NoScript have been disabled.

Starting with this release, Tor Browser will now also download and apply upgrades in the background, to ensure that users upgrade quicker and with less interaction. This behavior is governed by the about:config pref app.update.auto, but we do not recommend disabling it unless you really know what you're doing.

Here is the complete changelog since 4.5.3:

  • All Platforms
    • Update Firefox to 38.2.0esr
    • Update OpenSSL to 1.0.1p
    • Update HTTPS-Everywhere to 5.0.7
    • Update NoScript to 2.6.9.34
    • Update meek to 0.20
    • Update Tor to 0.2.6.10 with patches:
      • Bug 16674: Allow FQDNs ending with a single '.' in our SOCKS host name checks.
      • Bug 16430: Allow DNS names with _ characters in them (fixes nytimes.com)
      • Bug 15482: Don't allow circuits to change while a site is in use
    • Update Torbutton to 1.9.3.2
      • Bug 16731: TBB 5.0 a3/a4 fails to download a file on right click
      • Bug 16730: Reset NoScript whitelist on upgrade
      • Bug 16722: Prevent "Tiles" feature from being enabled after upgrade
      • Bug 16488: Remove "Sign in to Sync" from the browser menu (fixup)
      • Bug 16268: Show Tor Browser logo on About page
      • Bug 16639: Check for Updates menu item can cause update download failure
      • Bug 15781: Remove the sessionstore filter
      • Bug 15656: Sync privacy.resistFingerprinting with Torbutton pref
      • Bug 16427: Use internal update URL to block updates (instead of 127.0.0.1)
      • Bug 16200: Update Cache API usage and prefs for FF38
      • Bug 16357: Use Mozilla API to wipe permissions db
      • Bug 14429: Make sure the automatic resizing is disabled
      • Translation updates
    • Update Tor Launcher to 0.2.7.7
      • Bug 16428: Use internal update URL to block updates (instead of 127.0.0.1)
      • Bug 15145: Visually distinguish "proxy" and "bridge" screens.
      • Translation updates
    • Bug 16730: Prevent NoScript from updating the default whitelist
    • Bug 16715: Use ThreadsafeIsCallerChrome() instead of IsCallerChrome()
    • Bug 16572: Verify cache isolation for XMLHttpRequests in Web Workers
    • Bug 16884: Prefer IPv6 when supported by the current Tor exit
    • Bug 16488: Remove "Sign in to Sync" from the browser menu
    • Bug 16662: Enable network.http.spdy.* prefs in meek-http-helper
    • Bug 15703: Isolate mediasource URIs and media streams to first party
    • Bug 16429+16416: Isolate blob URIs to first party
    • Bug 16632: Turn on the background updater and restart prompting
    • Bug 16528: Prevent indexedDB Modernizr site breakage on Twitter and elsewhere
    • Bug 16523: Fix in-browser JavaScript debugger
    • Bug 16236: Windows updater: avoid writing to the registry
    • Bug 16625: Fully disable network connection prediction
    • Bug 16495: Fix SVG crash when security level is set to "High"
    • Bug 13247: Fix meek profile error after bowser restarts
    • Bug 16005: Relax WebGL minimal mode
    • Bug 16300: Isolate Broadcast Channels to first party
    • Bug 16439: Remove Roku screencasting code
    • Bug 16285: Disabling EME bits
    • Bug 16206: Enforce certificate pinning
    • Bug 15910: Disable Gecko Media Plugins for now
    • Bug 13670: Isolate OCSP requests by first party domain
    • Bug 16448: Isolate favicon requests by first party
    • Bug 7561: Disable FTP request caching
    • Bug 6503: Fix single-word URL bar searching
    • Bug 15526: ES6 page crashes Tor Browser
    • Bug 16254: Disable GeoIP-based search results.
    • Bug 16222: Disable WebIDE to prevent remote debugging and addon downloads.
    • Bug 13024: Disable DOM Resource Timing API
    • Bug 16340: Disable User Timing API
    • Bug 14952: Disable HTTP/2
    • Bug 1517: Reduce precision of time for Javascript
    • Bug 13670: Ensure OCSP & favicons respect URL bar domain isolation
    • Bug 16311: Fix navigation timing in ESR 38
  • Windows
    • Bug 16014: Staged update fails if meek is enabled
    • Bug 16269: repeated add-on compatibility check after update (meek enabled)
  • Mac OS
    • Use OSX 10.7 SDK
    • Bug 16253: Tor Browser menu on OS X is broken with ESR 38
    • Bug 15773: Enable ICU on OS X
  • Build System
    • Bug 16351: Upgrade our toolchain to use GCC 5.1
    • Bug 15772 and child tickets: Update build system for Firefox 38
    • Bugs 15921+15922: Fix build errors during Mozilla Tryserver builds
    • Bug 15864: rename sha256sums.txt to sha256sums-unsigned-build.txt

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

Real problem?

Updated with Tor updater. Restart. New Version looks good.

Tested with strongest seetings at www.ip-check.info with result:

"You are using Tor, but your browser profile differs from the recommended Tor Browser Bundle default profile."

And after the test, the website can read:

Signature, user-agent and other things.

This sounds not good. A problem with the ip-check.info, or a problem with my installation or a problem for all with last update?

Also getting the same results at ip-check.info with the security level on high.

TBB has moved to firefox 38-ESR, as you can see in the changelog. The user agent sent with each request has been updated to reflect this change (Firefox/38.0).

IMHO, the test you have used is expecting the old value (version 31), which is why you would get a negative result. Give them a few days to update their tests, it would be worth trying again then.

This is also a good opportunity to stress out why updating quickly is important: with everyone moving forward to 5.0, users that don't will stand out more and more.

thanks. now the user-agent is fine. the signature still not.

Crashes, crashes, crashes, and then it crashes a bit more.

Previous versions of tor browser has been very stable for a number of releases. But 5.0 crashes all the time. Where can I find crash log to report?

You are probably hitting https://bugs.torproject.org/16771 (bug 16773 is with high likelihood a duplicate of it). We are working on fixing it and will release it in a point release that is coming shortly.

Under "Preferences":

"General" --> "Startup", "Downloads", "Tabs"
"Content" --> "Pop-ups"
"Privacy"
"Security"
"Advanced"

the radio buttons and small rectangular check boxes are deactivated. I am unable to use my mouse to click on them.

Is this by design or cased by bugs?

I have the same problem.

Same thing here. What I did was lower the privacy and security settings so I could configure it. Just raise it back up when you're done.

Same here when I go to Tools and then Options.

Thanks for reporting. This is https://bugs.torproject.org/16775 now.

Need to say, the options still work, at least some, i.e. cookies setting, even though you can see the checkboxes changing.

*can't

Yes, and no one noticed ... until now. I've reverted to 4.5.3 until this is fixed. No more auto-upgrades for me, please!

at firstrun options menu worked
after (editing about:config and) installing apps everything is unchecked
i'm waiting for instructions or 5.0.1. returned to 4.5.3

same user again:
it's the security slider. options menu doesn't work with slider set to high.
set from high to medium-high - new identity - options menu is working.
set back to high - options menu is working only for current session of TBB 5.0.

Go to about:config and change "browser.preferences.inContent" from true to false. This will restore the old Preferences ui.

After successfully connected to Tor's network, error messages started to appear:

*******************************************
A coding exception was thrown and uncaught in a Task.

Full message: TypeError: this.Paths is null
Full stack: Agent.wipe@resource:///modules/sessionstore/SessionWorker.js:236:7
worker.dispatch@resource:///modules/sessionstore/SessionWorker.js:21:24
anonymous/AbstractWorker.prototype.handleMessage@resource://gre/modules/workers/PromiseWorker.js:122:16
@resource:///modules/sessionstore/SessionWorker.js:30:41

*************************

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed
WARNING: content window passed to PrivateBrowsingUtils.isWindowPrivate. Use isContentWindowPrivate instead (but only for frame scripts).
pbu_isWindowPrivate@resource://gre/modules/PrivateBrowsingUtils.jsm:25:14
getTopWin@chrome://browser/content/utilityOverlay.js:61:19
openLinkIn@chrome://browser/content/utilityOverlay.js:240:11
openUILinkIn@chrome://browser/content/utilityOverlay.js:203:3
openHelpLink@chrome://browser/content/utilityOverlay.js:732:3
helpButtonCommand@chrome://browser/content/preferences/in-content/preferences.js:162:3

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed
WARNING: content window passed to PrivateBrowsingUtils.isWindowPrivate. Use isContentWindowPrivate instead (but only for frame scripts).
pbu_isWindowPrivate@resource://gre/modules/PrivateBrowsingUtils.jsm:25:14
getTopWin@chrome://browser/content/utilityOverlay.js:61:19
openLinkIn@chrome://browser/content/utilityOverlay.js:240:11
openUILinkIn@chrome://browser/content/utilityOverlay.js:203:3
openHelpLink@chrome://browser/content/utilityOverlay.js:732:3
helpButtonCommand@chrome://browser/content/preferences/in-content/preferences.js:162:3

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed
1439348981000 addons.update-checker WARN Update manifest was not valid XML
1439348981000 addons.update-checker WARN Update manifest was not valid XML

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed

(firefox:3883): Gtk-CRITICAL **: IA__gtk_clipboard_set_with_data: assertion `targets != NULL' failed
*************************
A coding exception was thrown and uncaught in a Task.

Full message: TypeError: this.Paths is null
Full stack: Agent.wipe@resource:///modules/sessionstore/SessionWorker.js:236:7
worker.dispatch@resource:///modules/sessionstore/SessionWorker.js:21:24
anonymous/AbstractWorker.prototype.handleMessage@resource://gre/modules/workers/PromiseWorker.js:122:16
@resource:///modules/sessionstore/SessionWorker.js:30:41

*************************
Aug 12 11:14:49.000 [notice] New control connection opened from 127.0.0.1.
console.error:
[CustomizableUI]
Custom widget with id loop-button does not return a valid node

Here is the complete changelog since 4.5.3:

[long list follows...]

Which item in this long list corresponds to the following change?

Starting with this release, Tor Browser will now also download and apply upgrades in the background, to ensure that users upgrade quicker and with less interaction. This behavior is governed by the about:config pref app.update.auto, but we do not recommend disabling it unless you really know what you're doing.

???

I can't find it!?!

Bug 16632: Turn on the background updater and restart prompting

"""Starting with this release, Tor Browser will now also download and apply upgrades in the background, to ensure that users upgrade quicker and with less interaction. This behavior is governed by the about:config pref app.update.auto, but we do not recommend disabling it unless you really know what you're doing."""

What's the difference between app.update.auto and app.update.enabled?

And what are the possible values for app.update.mode and what do they mean?

Thanks for your patience!

http://kb.mozillazine.org/App.update.auto
http://kb.mozillazine.org/App.update.mode

If you have "app.update.enabled" set to "false" there'll be no updates happening.

Another heads up that v5.0 crashes all the time. Recent previous versions did not have that problem. Something's definitely not right there.

https://bugs.torproject.org/16771

Something's definitely not right there.

The spooks at the NSA are definitely having a field day intercepting online communications from the bugs thrown up by this latest version of TBB.

Nevertheless we ought to thank the TBB team for their effort and time.

I added "SocksListenAddress 0.0.0.0:9150" in torrc, then I started TorBrowser 5.0 ,and it crashed immediately. To use whonix, "SocksListenAddress 0.0.0.0:9150" must be added , so please fix it as soon as possible.

My OS:WIN 7

This worked with 4.5.3? And with the alphas? Which alpha broke it? (you'll find them at https://archive.torproject.org/tor-package-archive/torbrowser/)

4.5.3 works normally.Well, when I updated TBB to 5.0.a4, I found this bug.

about:preferences# and about:downloads both give the error "The address isn't valid"

Works for me. How can I reproduce that?

I can't give you instructions to reproduce the shortcut URLs not working under 5.0.

As soon as I go back to 4.5.3 they work.

Starting with this release, Tor Browser will now also download and apply upgrades in the background, to ensure that users upgrade quicker and with less interaction. This behavior is governed by the about:config pref app.update.auto, but we do not recommend disabling it unless you really know what you're doing.

If an experienced user wants to download the TBB manually and check all SHA/GPG signs, then - is it an unroundabout option? Or that user can say "NO" to autoupdate request before it started without deactivating this feature?

Returned to version 4.5.3

Simple question:

Can I manually upgrade tor browser? I don't want it to upgrade automatically.

To prevent tor browser from automatically upgrade, which thingy should I disable in about:config other then app.update.auto?

Having every body update tor browsers makes Tor network stronger for every one.

Wow...Tor Browser 5.0 STABLE RELEASE

But still got some bugs..smh.

To be fair, this is a major Firefox update and it did include a large number of new features that are problematic for privacy - quite a lot of work for the TBB developers.

In case of changing the language from English to Hungarian the Tor does not work anymore.

How are you changing the language? And what does "Tor does not work anymore" mean?

Too many odd things are happening with 5.0
I don't trust it. I'd rather not move backwards since that is also risky.
So I hope there are some fixes soon.

Like what?

Like serious spikes in Ram usage, something that has never happened in any of the 4.* versions.

Some other bugs which might just be cosmetic, too hard to explain these and too hard to reproduce. They mostly happened at times of startup and opening new tabs.

For now I've switched back to mainly using 4.5.3 because like others have stated that one felt very solid.

i doubt there will be, have to go to 5.01..

Hi,

Not able to download any attachments after latest update!

Do you have an example attachment/link which we could test?

New Firefox. New html5 "bugs" useful for deanonymization and fingerprinting, new vulnerabilities added like pdfjs.

Well, the recently documented vulnerability in PDF.js is patched in this release.

Of course, there could be undocumented vulnerabilities in this release and maybe some of the concerning new features for this branch of firefox have yet to be dealt with; then again, 4.5.3 also has documented vulnerabilities. If you're sure that no one is willing to look for vulnerabilities for a slightly outdated browser, go ahead and keep using it.

I am loading the language pack xpi. After that the browser cannot connect to Tor. I have tried it already 15 times. Without changing the language Tor works.

Could you give steps to reproduce your problem? On which operating system does his happen?

Not found single issue yet, those reporting ip check info error, its because the user agent string has been updated, but not on the ip check site yet you cn safely ignore that one

Just my 2cents:
No crash here till now. But I was a bit pessimistic from older major upgrades. 4.5.3 was rock stable for me, so I just created a new user and gave him the new 5. (running debian).
Anyways: Thanks for to the team for their work!

Once the download was finished, the torbrowser installer was removed automatically by norton antivirus.

The warning was as below:
Threat name: WS.Reputation.1
Category: Insight Network Threat

Why? Is TB Installer safe, or any virus included inside?

Why? Is TB Installer safe, or any virus included inside?

No, there's NO virus included in TBB. Both Norton and Symantec uses the same heuristics engine to flag programs such as TBB that don't have more than five users using Norton or Symantec to scan for viruses and malware.

That's why Norton and Symantec named it a "threat" based on "reputation".

So this issue will resolve with time. Right?

So this issue will resolve with time. Right?

When more than 100 people are using Norton or Symantec to scan TBB 5.0, then the warning about the so-called "reputational threat" will disappear. The question is: how many TBB users are using Norton/Symantec to scan TBB files?

Perhaps we could create an "Antivirus Reputation Team" among the Tor community to prevent that from happening.

So Norton and Symantec know who is using TorBrowser amongst their users? That is not good for privacy.

"upgrade quicker and with less interaction"

What exactly does less interaction mean here?

Do I get a say at all

And if I say no will you nag?

You don't have to click any buttons anymore. Yes, you are getting a say and yes, there will be nagging going on.

Many thanks to the Tor team for all the hard work. Hopefully the fix for crashes comes soon. I read the ticket with Google Maps causing the browser to crash - WordPress admin area does that too, though equally difficult to replicate because sometimes a task that crashed the browser before, now works, but a different task crashes it.

For the time being, I went back to 4.5.3, which is a rock solid version, like another commenter mentioned earlier. Either way, many thanks again for all the hard work.

Also wp stats don't work after wp changed their stats page (no crashing though in this case).

i like to have control over what's going on, so i would like to disable the autoupdate feature.
are there any known privacy/security risks involved when setting app.update.auto to false (except for the obvious fact that my browser won't be up to date ASAP)?

I had to uninstall the newest version due to the freezing and closing expectingly problem. Fix that particular issue and I may upgrade.

Maximizing the browser window is still not working. Unbelievable.

The problem is behind the screen. It works like charm since 1.0.

That's a feature not a bug. Maximizing the screen makes fingerprinting much easier.

Hi,
have read about that security aspect of screen size many times and never understood it. Standard seems to be 1024x768. But as I think, THIS is outstanding and unique and makes fingerprinting easy, as there should hardly be many users with such old equipment anymore. At least I think so. Why not set the standard to 1280x1024 as it is much more ergonomic and most (?) websites are designed for that and up?

Those users who have a super extravagant monitor (eg. a 5000x4000 monster) should use their brain and reduce to somewhat more common. Using Tor shouldn't replace using brain :)

BTW: I can and do raise resolution up to the last mentioned one. In 4.53 there is no nag/reminder. In 5.0 there is, but I can ignore it.

Sorry if this is a dumb question/proposal.

First of all, it's surprisingly hard to get people to "use their brain" as you put it. Since everyone has different experiences everyone has a different idea of "common sense;" what you find as trivial other people don't have the experience to understand.

I don't see why you think 1280x1024 is a good resolution. I'm using a Laptop with 1366x768 as a max, and it isn't that old. TorBrowser has a large userbase, and they can't always pick up optimum hardware for browsing. The more people using TorBrowser the better the anonymity for everyone.

As a final point: Yes, setting the resolution to 1024x768 may make it easier to figure out who is using TorBrowser versus who isn't, but that's already a trivial task. Tor itself doesn't hide the fact that you're using it to the site that you connect to, and TorBrowser already sends information in the HTTP request that makes distinguishes it from most users' normal Firefox. The goal of fingerprinting defense isn't to make it harder to determine who is using tor and TorBrowser, but to make all of the users of TorBrowser look the same.

Thanks for your response, I still have to take some time to think about the arguments. At least some points are still making me think about:

In the design page for Tor (chapter about screen size etc), which is quite a very technical one and I had to read it several times, I have seen sentences like or in the meaning of 'whatever you - the user - set up in your screen settings, we have provided faking of response values, so you are on the safe side' (Can look up and quote them precisely if necessary). But there were mentioned different sorts of ways for the counterpart to get fingerprints. So maybe, some can be blocked by that faking values (sort of a good nanny taking care of the user) and other can't, leaving a possible danger...

From that I understood, that some internal safety net is provided by the team who designed TB to let leak as little information as possible.

What concerns me most is: If I do act against the rules in this case (choosing fullscreen on 1280x1024 on a desktop PC), whom and to what amount do I jeopardize. Just myself? Other Tor users? The Tor system in whole?

Btw more important: how about using 4.5.3 instead of 5.0?

If it's just increasing my personal risk, I could live with that. If increasing the risk for others, I would be more convinced to act as the average John Smith in the swarm :)

Regarding singatures:
I've been using Tor Browser 4.5.3. A browser's own update window appeared so I clicked to update to 5.0, however I didn't notice that a signature was checked after downloading, so I'm quite worried. I use Debian and there is a "torbrowser-launcher" package which always checks signatures after downloading new release (somehow it doesn't work now, so I launch TorBrowser directly from its directory). Honestly I don't dare to launch 5.0 without a correct sig. Is this new auto-update feature going to check sigs?

Regarding pdf.js:
Was Firefox vulnerable to this exploit even when pdf.js was disabled with "pdfjs.disabled" in about:config?

Thanks

I will ask a slightly different question

Was Firefox vulnerable to this exploit even when pdf.js was disabled with javascript disabled in about:config?

No it wasn't.

The update files are signed and Tor Browser would be choking if the updates were not signed with the correct key(s).

No, setting "pdf.disabled" to "true" should have helped as well.

Will the upcoming v5.0 stable release of the Tor browser include any of the bloatware from Firefox ESR v38.2, like Hello, Pocket, Reader+, Share and other WebRTC related code? I hope so because this in my opinion will make Firefox slower and more vulnerable to attacks, which means on your part there will be more security patches for you to release.

Will the upcoming v5.0 stable release of the Tor browser include any of the bloatware from Firefox ESR v38.2, like Hello, Pocket, Reader+, Share and other WebRTC related code?

I'd like to know the answer too. Having bloatware from Firefox 38.2 ESR only increases the attack surface of TBB.

We don't compile WebRTC into Tor Browser. The other stuff should be in the browser (although disabled/hidden).

Had a few freezes after update yesterday so did a fresh install on my thumb drive, only been on it total few hours but so far so good (knocks on wood)

"Many thanks to the Tor team for all the hard work. Hopefully the fix for crashes comes soon. " My ass.
I've donated money to this project year after year because I'm a journalist in conflict zones and I'm amongst the few that doesn't use this software to jerk off to illegal porn or to tell their friends about how cool is to use anonymizing software. To me, this is a real life necessity. Today, the endless amount of crashes this STABLE FORCED UPDATE which sorts an issue that could be easily been blacklisted in an easier way than an ENTIRE PRODUCT UPDATE, got me into a REAL LIFE tight spot. A very distressing situation of which I will not relieve any detail here, though I'll say this much:
If the tor browser is a TOY, please let us know. I'll donate My money to some other project, and make use of it. If tor browser is going to be handled by teenagers without any clue of product management / lifecycle, PLEASE.. let me know. This software was based on a once serious project, understanding that the need for being anonymous comes from a very tangible threat, and not from some stupid teen paranoia.

TBB 4.5.3 was based on Firefox 31esr which is end of life and doesn't receive security updates anymore. TBB 5 is based on Firefox 38esr.

Some of the security issues fixed in the last 38esr release are likely in 31esr as well (and not fixed).

A few tabs are now opening up as windows. That never happened before.

Do you have steps to reproduce your issue?

Autoupgraded just now. Lost all bookmarks and add-ons.

Tor Browser does not touch your bookmarks or add-ons on upgrade. Is that reproducible on your machine? If so, how?

Firefox automatically makes backups of your bookmarks.
Go to your Tor Browser folder, in most cases this is: "tor-browser_en-US", then follow this path "Browser/TorBrowser/Data/Browser/profile.default/bookmarkbackups".

Hope this helps, not sure about the addons.

TBB5.0 is MISSING some things existing in old TBB.
Please bring back.

1. Page Crypto is missing... back already. Why?: Page Info -> Security -> 'Technical Details'

2. No eye cancer in 'about:config'. Different look.

3.Persistant entry status for 'Preferences'(about:preferences).

quite disappointed at new tor-browser, ver. 5
It crashes repeatedly! tens of times in just a day!!! it even doesn't let me to write this feedback! :) I'm writing it with Hotspot Shield on Firefox! never expect such a thing from tor-project! :|
BUT, thanks a lot for your efforts. I sincerely appreciate it and still believe in you and wait for your updated version.
regards
a fan from Iran

I'm writing it with Hotspot Shield on Firefox! never expect such a thing from tor-project! :

Never, ever use Hotspot Shield. As a proxy and/or VPN service, it's NOT safe to use unless you want to be a target of the NSA.

But I suppose being a target of the NSA is far better than being a target of the Iranian authorities who work directly for the Ayatollah. The NSA won't throw you into prison but the Ayatollah's henchmen will.

Why do you believe that Hotspot Shield users are targets of the NSA?

i have not enough technical knowledge for the first part but about the second, you're absolutely right.

why is tor output http://198.52.160.144/

just download 5.0
when i try laod from shortcut i have firefox message "Couldnt load XPCOM"

I want to enable browsing history without enabling anything else like Local storage so it won't fingerprint me online.

What is the correct way to do this?

If I check the "Don't record browsing history or website data" TB enables the cookie storage after restart. What else "website data" TB stores and how to disable it?

This version crashes on numerous common websites. Even browsing youtube caused this version to crash twice.

I don't think this is your fault since only Google owned websites seem to be crashing, so they're probably doing something non-standard or unique.

What websites are you talking about? Any error messages?

You are probably hitting some kind of https://bugs.torproject.org/16771 which sould get fixed rather soon.

Only issue for me was having tabs open into windows instead. I encountered this when trying to view picture attachments in emails.

As someone had suggested earlier, I went to "Privacy and Security Settings." I lowered "Security Level" to the lowest.

I went to Tools > Options > General. Under Tabs, I clicked "Open new windows in a new tab instead."

I went back to "Privacy and Security Settings" and raised "Security Level" back up to High.

So it seems if we want anything changed in Tools > Options, just follow the steps I described above.

Have I been unmasked?

Please see below for the errors:

console.error:
[CustomizableUI]
Custom widget with id loop-button does not return a valid node
Aug 14 10:30:30.000 [notice] New control connection opened from 127.0.0.1.
Aug 14 10:30:30.000 [notice] New control connection opened from 127.0.0.1.
Aug 14 10:37:09.000 [notice] New control connection opened from 127.0.0.1.
console.error:
[CustomizableUI]
Custom widget with id loop-button does not return a valid node
*************************
A coding exception was thrown and uncaught in a Task.

Full message: TypeError: this.Paths is null
Full stack: Agent.wipe@resource:///modules/sessionstore/SessionWorker.js:236:7
worker.dispatch@resource:///modules/sessionstore/SessionWorker.js:21:24
anonymous/AbstractWorker.prototype.handleMessage@resource://gre/modules/workers/PromiseWorker.js:122:16
@resource:///modules/sessionstore/SessionWorker.js:30:41

*************************
*************************
A coding exception was thrown and uncaught in a Task.

Full message: TypeError: this.Paths is null
Full stack: Agent.wipe@resource:///modules/sessionstore/SessionWorker.js:236:7
worker.dispatch@resource:///modules/sessionstore/SessionWorker.js:21:24
anonymous/AbstractWorker.prototype.handleMessage@resource://gre/modules/workers/PromiseWorker.js:122:16
@resource:///modules/sessionstore/SessionWorker.js:30:41

*************************
Aug 14 11:02:16.000 [notice] New control connection opened from 127.0.0.1.
console.error:
[CustomizableUI]
Custom widget with id loop-button does not return a valid node
Aug 14 11:02:20.000 [notice] Owning controller connection has closed -- exiting now.

No, these are bugs but not harmful ones.

Windows 10 is a data leecher! How will Tor Browser work in Windows 10?

It's best to avoid using Windows 10 :)

I upgraded to Windows 10 from 8.1. I have portable Tor Browser on a 2.0 flash drive. My Tor Browser refuses to run on Win 10. Went back to Win 8.1 and Tor Browser runs as it always did.

Do you get error messages? If so which?

Font fingerprinting bug/regression:
The same list of fonts are detected on the new stable TorBrowser (5.0) and a default firefox profile when tested with http://ip-check.info/
I've tested this on Debian GNU/Linux Wheezy and Jessie.

Relevant tickets:
Limit the fonts available in TorBrowser - https://trac.torproject.org/projects/tor/ticket/2872
Limit fonts to a whitelist? - https://trac.torproject.org/projects/tor/ticket/16312
Enable bundled fonts in Tor Browser - https://trac.torproject.org/projects/tor/ticket/13313

Specification (see point 6)
https://www.torproject.org/projects/torbrowser/design/#fingerprinting-defenses

Yes, we are working on it and have a defense for testing in our alpha bundles which hopefully will make it sooner than later into the stable one. See: https://bugs.torproject.org/13313 and https://bugs.torproject.org/16672 for background information.

Perhaps for now we should set "browser.display.use_document_fonts" to 0. To prevent easy fingerprinting between sessions.

Perhaps for now we should set "browser.display.use_document_fonts" to 0. To prevent easy fingerprinting between sessions.

Do Tor developers approve of your suggestion?

Am I right to assume they have taken care of it? Below is the quote from "The Design and Implementation of the Tor Browser [DRAFT]" (point 6: Fonts) [URL: https://www.torproject.org/projects/torbrowser/design/#fingerprinting-defenses]

"In the meantime while we investigate shipping our own fonts, we disable plugins, which prevents font name enumeration. Additionally, we limit both the number of font queries from CSS, as well as the total number of fonts that can be used in a document with a Firefox patch. We create two prefs, browser.display.max_font_attempts and browser.display.max_font_count for this purpose. Once these limits are reached, the browser behaves as if browser.display.use_document_fonts was set.

To improve rendering, we exempt remote @font-face fonts from these counts, and if a font-family CSS rule lists a remote font (in any order), we use that font instead of any of the named local fonts. "

Is it possible that the https://bugs.torproject.org/16771 bug could be exploited for remote code execution?

My computer time got reset 20 hours backwards once I started update!!! Had to change it again in order to start tbb

On ip-check.info there are some inconsistencies, like accepted languages (intl.accept_languages = en-us, en), but it identifies as en-US, en no matter what you do.

Also on the first visit of the page, it'll ask you for name and password (have to click cancel, it's for test) and showing that dialog was sign of good security settings in browser.
Said dialog used to appear every visit, with new version it's just the very first visit and then you need to restart browser to see it again.

"Said dialog used to appear every visit, with new version it's just the very first visit and then you need to restart browser to see it again."

I tested it about one year ago, it only appeared on first visit to me. I had to restart too.

Why is that?

That's strange, it happened with 4.5 for me too, but with newer version it got fixed (appearing every visit).
Before 4.5 it was just every visit, never seen it happening differently.

http://ip-check.info is a third-party and it's data could well be out of date. About the dialog, do you have Javascript enabled?

JS disabled.

Then I don't know, sorry.

Unlike in the previous versions, there seems to be no SSL connection between my computer and the entry node according to Wireshark. Why is that? Is it certain that the traffic is still encrypted? Thank you

https everywhere : block all http request and
https section on noscript : recommended with tor

could help to be safe.

On hidden onion , it is certain because the address is self decrypting

what is the answer?

It probably is TLS (or SSL) but not detected by Wireshark as such.

Thank you
In the previous version of TBB, Wireshark certainly detected that the traffic between the entry node and my computer is encrypted. Is there any way to single this out?
Regarding https everywhere, I can't find this option. In fact, the icon is gone and it is also not listed in about:config
Can somebody of the developers please look into this? Probably it is fine, but if not that would be a serious issue.

Do you Tor Project guys still enable javascript by default and allow FBI to bust hidden service users using javascript exploits?

Firefox Zero-Day Exploit used by FBI to shutdown Child porn on Tor Network hosting; Tor Mail Compromised

http://thehackernews.com/2013/08/Firefox-Exploit-Tor-Network-child-pornography-Freedom-Hosting.html

"Do you Tor Project guys still enable javascript by default ?"
tor 5.0 is embedded with noscript ready to use : you choose the options like it suits you.

"Firefox Zero-Day Exploit used by FBI to shutdown a site on Tor Network hosting"
does it exist a test page , a tor test , showing that it is not possible anymore (2015) ?

Be sure you're running a recent enough Tor Browser Bundle. That should keep you safe from this attack. Windows users are advised to Update Tor Browser Bundle, version 2.3.25-10 (released June 26 2013), 2.4.15-alpha-1 (released June 26 2013), 2.4.15-beta-1 (released July 8 2013), 3.0alpha2 (released June 30 2013) includes the fix. Consider disabling JavaScript (click the blue"S" beside the green onion, and select "Forbid Scripts Globally"). Disabling JavaScript will reduce your vulnerability to other attacks like this one, but disabling JavaScript will make some websites not work like you expect.

Update: According to Baneki Privacy Labs research, the IP address 65.222.202.53 hardcoded into the exploit belongs to Virginia is actually owned by Science Applications International Corporation (SAIC), a major intelligence, military, aerospace, engineering and systems contractor involved with the Federal Bureau of Investigation (FBI), Defense Advanced Research Projects Agency (DARPA) , Central Intelligence Agency (CIA) and National Security Agency (NSA).

They believe that the hardcoded IP address is directly allocated to the NSA's Autonomous Systems (AS), so its probably not the FBI, its NSA who used Firefox Zero-Day exploit to compromise Freedom Hosting and TOR network.

troll

Keeps hanging in and crashing. No need a reply. Posting just so you know. Thanks

**Very serious bug**

I am a reporter working in the Middle East.

To be able to send emails from within SIGaint and Mail2Tor, I need to enter captchas. Both these services are unable to accept my inputs. I had no problems with them when I was using Tor Browser Bundle version 4.5.3.

For those interested, the URLs for these two services are http://sigaintevyh2rzvw.onion/ and http://mail2tor2zyjdctd.onion/

New version constantly crashes. Not usable. Prior version was stables and good.

Why Tor Project stopped shipping static-linked portable tor.exe? Will it ever return?

Do you hardcode absolute file paths into the Tor browser configuration files? Is there any way you could change this in the future so that we can move the Tor Browser folder around on the file system and still have Tor work at the new location?

What OS are you using? I have no problem moving Tor Browser to an arbitrary directory and it still works.

after being on youtube for few mins the new browser crashes and I keep getting this message from google when trying to sign in my own acct... Sorry, we can't process your request right now

For security reasons, Google may sometimes deny logins in cases where we believe the account's password could have been stolen. To regain access to your account, try other computers. If that doesn't work you can reset your password, or learn more

ps

I did reset my password twice so its not its the new browser.

+1 -- I have the same problem trying to log in to gmail

google dont like Tor
want to know who you are,where,location,browser etc
if they do accept Tor connections make nsa very upset

dont use gmail over Tor
get a life and select another mail provider

google will error with the same 2 or 3 error messages
will try make you change password
try force you to add personal telephone numbers to the account
will try to say you needed to be contacted to confirm your identity

All of which is aimed at keeping track of you,identity and location

Google isn't Tor friendly; this isn't a problem with tor or this version of Tor Browser. It's probably a combination of trying to protect their users and that they can't datamine users of tor as well.

If you've got to log into a google service using tor you can potentially use a proxy after tor, but be aware that that brings security/anonymity concerns.

Thanks, I'm a big fan of tor. However, this version crashes constantly. Not just once in a while. I mean all the time.

The last comment mentioned youtube. Sure enough after 3 minutes it crashed (using all the defaults and a clean extract on Win7).

Also on OS X frequent crashes of 5.0. Will figure out where to send crash reports...

custom settings from official manual dont seem to work after update.
how is this possible?

Which settings do you have in mind and what did you do to get them working?

EntryNodes

Thxs

use Entrynodes, and Tor errors crashes and never starts, remove uncomment it and starts fine.

can i suggest ask the previous coders working on the last builds to come back.

can i suggest ask the previous coders working on the last builds to come back.

How much in US$ are you willing to pay them to make them come back?

The US National Security Agency is offering US$60,000-tax free per month per previous coder plus benefits (eg. first class travel on flights, paid accommodation in lavishly decorated penthouses, free booze and barely legal 18-year-old girls).

if you are considering that job at nsa, you've missed the point about Tor and anonymity and probably cant be trusted afterall.

Umm, there hasn't been any change in the programming team as far as I am aware...

whoever is flagging it ready for release without testing.

With a new TBB does it make sense automatically change the entry node? Isn't it more secure from time to time to change it? So the entry note loses some information about my ip and so on.

Setup a bridge and you can control what is your entry node. Your bridge is the entry node and you can change it as much as you like.

For serious anonymity you should never trust the Tor chosen entry-node. When using Tor without your own bridge you should always assume you're being monitored.

how does this undermine serious security?!
i dont see any issue with electing country entry nodes, what if I dont trust good old usa?!

reply missing so i'll type it again
I dont see your logic with serious anonymity and using entrynode setting.

Tor changes the Guard node once every few months. A faster rotation interval will dramatically reduce anonymity vs adversaries that run relays.

If anything, the guard rotation interval needs to be longer than what it currently is. See https://trac.torproject.org/projects/tor/ticket/8240

hello, using TOR since few years, Now, I have disabled Noscript and changed to umatrix and privacy badger. Also any things I know to do this in about:"..".
Please give your opinion if it is ok to do this.
For me, I think, Tor is easerly to use . It is the Standard-Browser here.
Thanks in advance and greetings from Germany

Now, I have disabled Noscript and changed to umatrix and privacy badger. Also any things I know to do this in about:"..".Please give your opinion if it is ok to do this.

No, what you did is totally wrong and you are doing more harm than good to yourself.

You should never ever add stuff to or remove stuff from Tor Browser Bundle. Before releasing it to the public, Tor developers have tried their best to ensure that all the stuff in Tor Browser Bundle work well together to ensure the best possible anonymous experience.

You will not receive technical support if you modify parts of Tor Browser Bundle yourself, that is add your own stuff to or remove official stuff from Tor Browser Bundle. You are on your own. You have been forewarned.

Not that The Tor Project provides technical support in the first place...

It should be mentioned that using nonstandard addons may change your fingerprint in addition to potentially adding a vulnerability. Fingerprinting may or may not be a concern based on your threat model, but even if it isn't a concern for you it is still a concern for others, and it does help them if you don't alter your TorBrowser from it's defaults.

Not that The Tor Project provides technical support in the first place...

With due respect, I believe it or its supporters who are themselves experts do, on a best effort basis.

Firstly, via email (the email address is stated on Tor's official website).

Secondly via this blog site.

Thirdly Tor's webpage on StackExchange.

Fourthly Tails' support mailing list.

https://www.reddit.com/r/privacy/comments/366d3e/is_the_combo_of_ublock_and_umatrix_good_enought/

this link explain all.

*with tor bundle, adding another plugin is not recommended.

Please be specific: plugins are different from addons.

Of course, it's suggested you don't add either of them, but a trusted addon is probably just going to make it easy to fingerprint you while a plugin can easily leak your real IP all over the place. Of course, a malicious addon could do that too.

Plug-in and Add-on are two terms that are pointing to the same functionality; they are simply extensions that extends the usability of the program. It just depends on the software maker on what to call the software extensions of their programs. These extensions could be made by other companies, individuals, or by the software makers themselves.
Plug-in is the term that is usually used when referring to third party software that is meant to interact with a certain program (plug-in flash player).
An Add-on also extends the functionality of a certain program but they are usually meant to function on a certain program(add-ons that are meant for Firefox would only work with Firefox).
The separation between an add-on and a plug-in is not really that clear. They are both made to do specific functions that are suited to a certain user’s preference.
Add-on: essentially anything that can be installed into the browser. This includes for example extensions, themes, plugins, dictionaries, language packs, search engines.
Mozilla uses the term "add-on" as an inclusive category of augmentation modules that consists of plug-ins, themes, and search engines.
Extension: a package extending browser functionality

Fingerprint is an another subject (answered on this page) leaking ip another and malicious add-on another.

Usually, an add-on or a plugin or an extension is not build for the purpose to let a big fingerprint or to leak the ip or to be malicious. I suggest you add all extensions plugins or add-on you wish and even ask to the tor team to include it for the next release if you do think that it can improve your surfing.

What fingerprinting it would be if I enable the Preferences/Advanced/General/Use hardware acceleration when available?

There's a lot of crashes from this version, and it comes from watching videos or having too many things going on at one time which never happened before. If I watch a youtube video I have to do it 1 at a time otherwise it crashes. If I have tumblr on, it can only be 2 tabs because the gifs on tumblr are another video that make it crash. I can't press embed videos of youtube cuz it crashes. when I'm avoiding videos altogether I can only have 2 (and maybe 3 if I'm risky) open. Anymore and it crashes. I really hope this is fixed in the future.

as soon as you change the settings , it becomes less secure

"Before releasing it to the public, Tor developers have tried their best to ensure that all the stuff in Tor Browser Bundle work well together to ensure the best possible anonymous experience." like yet said another post.

About fingerprint (erase all your cookie/block http request/check noscript options) , on eff, a test can be performed showing you the level of anonymity you obtain (see stack exchange questions&answers for the discussion).

https://myshadow.org/panopticlick
https://panopticlick.eff.org/
https://nakedsecurity.sophos.com/2014/07/28/panopticlick-reveals-the-cookie-you-cant-delete/

you can try with this eff test (panopticclick) the option hardware acceleration and see the result. do not forget after each test to take another identity/circuit to erase the old fingerprint.

tor solution ;
1°new identity
2°new tor circuit
3°security high level

Does anyone else notice huge spikes in CPU usage when the updater is active?

On an admittedly very old computer with Ubuntu the process is consistently using 50-70% of the CPU, making the computer pretty much unusable until I kill the process.

Regarding the CPU usage: Also of note is if you store any data (old or new) in the Tor download folder, Tor apparently tries to copy these files to Browser/updated/Downloads (especially notable with Tails images or other large files).

never again will i trust auto upgrade of TBB
isnt the first time its trashed my installation

Syndicate content Syndicate content