Tor Browser 3.6.1 is released

The first pointfix release of the 3.6 series is available from the Tor Browser Project page and also from our distribution directory.

This release features a fix for a regression with using a proxy for normal Tor usage. It does not yet allow the configuration of proxies for pluggable transports. We hope to fix that issue in the following point release.

This is not a security release — feel free to keep using TBB 3.6 if it's working for you.

Here is the complete changelog:

  • All Platforms
    • Update HTTPS-Everywhere to 3.5.1
    • Update NoScript to
    • Bug 11658: Fix proxy configuration for non-Pluggable Transports users
    • Backport Pending Tor Patches:
      • Bug 8402: Allow Tor proxy configuration while PTs are present
    • Note: The Pluggable Transports themselves have not been updated to support proxy configuration yet.

Tor Weekly News — May 7th, 2014

Welcome to the eighteenth issue of Tor Weekly News in 2014, the weekly newsletter that covers what is happening in the Tor community.

Tor Browser 3.6 is released

The long-awaited Tor Browser 3.6 was finally declared stable on April 29th. Tor Browser 3.6 is the first version to fully integrate pluggable transports, enabling easier access to the Tor network on censored networks. The browser is based on the latest Firefox ESR 24.5.0 and includes a new round of security fixes.

When configuring how to access the Tor network, users can now select one of the included list of obfs3 or fte bridges. Using Flashproxy is also an option, but often requires further configuration on the local firewall and router. Manually specifying bridges is still an option, now with support for the aforementioned pluggable transports.

Many small usability enhancements have been made: Tor error messages are translated, the wording on several dialog windows has been improved based on user feedback, and Mac users now install the browser from the usual disk image format. Turkish localization has also been enabled.

Read the release announcement for a complete changelog. Be sure to upgrade!

Tails 1.0 is out

“Version 1.0 is often an important milestone that denotes the maturity of a free software project. The first public version of what would become Tails was released on June 23 2009 […]. That was almost five years ago. Tails 1.0 marks the 36th stable release since then.”

The release announcement could have not said it better. On top of the simple idea of having a system entirely running in memory that guarantees Tor usage for all network connections, Tails has been extended with an USB installer, automatic upgrades, persistence, support for Tor bridges, MAC address spoofing, an extensive and translated documentation and many more features.

Over Tails 0.23, the new version brings security fixes from Firefox and Tor, an updated I2P, several enhancements to the Tor configuration interface, and the appearance of the new Tails logo.

More details are in the release announcement. For those who have not made use of the integrated updater, time to download the new version!

Monthly status reports for April 2014

The wave of regular monthly reports from Tor project members for the month of April has begun. Georg Koppen released his report first, followed by reports from Arthur D. Edelstein, Sherief Alaa, Karsten Loesing, Lunar, Nick Mathewson, Matt Pagan, Damian Johnson, George Kadianakis, Pearl Crescent, Colin C., Kevin Dyer, Isis Lovecruft, Kelley Misata, Arlo Breault, and Andrew Lewman.

Lunar also reported on behalf of the help desk, Mike Perry for the Tor Browser team, and Arturo Filastò for the OONI team.

Miscellaneous news

The Tails developers warned that two fake public keys have been found bearing email addresses associated with the project; do not trust these keys, or anything they may have been used to sign. You can check the real keys used to sign Tails software on the Tails website.

Erinn Clark alerted users of the Trac-based Tor wiki to the fact that a bug (now fixed) made it possible to register an account with an already-taken username, “overwriting the existing user’s password and thereby taking over the account”. “We recommend users try to login and if you find you are unable to do so, you can reset your password” on the appropriate Trac page.

Following up on previous discussions and a proposal on the topic of how to make hidden services scale, Christopher Baines went on and implemented a prototype, “for one possible design of how to allow distribution in hidden services”. The code and concrete design is up for feedback.

Daniel Martí sent out a list of proposed revisions — arrived at in discussion with other developers on IRC — to the now slightly outdated proposal 140, which forms the basis of his upcoming Google Summer of Code project to implement consensus diffs and so reduce the amount of information downloaded hourly by Tor clients. Among the proposals are support for microdescriptor consensus diffs and a time limit to prevent the leak of information about when Tor was last used; “ideas about what might be missing or needing an update are welcome”, wrote Daniel.

Alpha releases of Orbot v14 are now available for testing. They include support for the obfs3 and ScrambleSuit protocols, thanks to obfsclient.

Griffin Boyce solicited feedback on the first release of Satori, an “app for Google Chrome that distributes circumvention software in a difficult-to-block way and makes it easy for users to check if it’s been tampered with in-transit.”

Kelley Misata announced on the Tor Blog that this year’s Tor Summer Dev Meeting will be held between June 29th and July 4th at the French offices of Mozilla in Paris.

Also on the blog, Andrew Lewman announced that the temporary limit on donations to the Tor Project through Paypal has now been lifted.

Nicolas Vigier announced that the Tor Browser test suite will now be run automatically when a new build is ready. The results will be emailed to the tor-qa mailing list.

Nick Mathewson suggested that proposal 236, which deals with the proposed transition to single guard nodes for Tor clients, should include the retention of multiple guards for directory requests, since “trusting a single source for the completeness and freshness of your directory info is suboptimal.”

Jacob H. Haven, Mikhail Belous, and Noah Rahman each introduced their Tor-related projects for this year’s Google Summer of Code: Jacob’s project is titled “A Lightweight Censorship Analyzer for Tor”, and aims to “allow non-technical users to monitor censorship of Tor occurring in their country/network”; Mikhail will work to implement a multicore version of the tor daemon; and Noah plans on “refactoring Stegotorus more along DRY lines as well as enhancing and updating various handshaking protocols, and getting it ready to merge in upstream changes from its originators at SRI.”

Thanks to NetCologne and fr33tux for running mirrors of the Tor Project website!

Frederic Jacobs invited comments on an alternative Tor icon designed by a friend “for fun”.

Tor help desk roundup

Many users alerted the help desk to a new bug in Tor Browser 3.6 that prevents users from setting a proxy. Developers have said this bug is related to the introduction of Pluggable Transport support; a new Tor Browser release addressing this issue is expected this week.

News from Tor StackExchange

Tom Ritter wonders how the Exit Probability is calculated and wants to know if all values add up to 100 %. If anyone knows a good answer, please don’t hesitate to add it to the question.

user1698 wants to extend the number of Tor relays in a circuit, and asks if it is possible to have one with 5 or 6 nodes. Tom Ritter suggests that this is only possible when one changes the source code. There is another question which deals with extending the number of nodes in a circuit: Steven Murdoch warns the user in his answer that under some circumstances it might be possible to de-anonymize a person who is using this technique. Furthermore alaf discusses the performance, throughput and anonymity of longer circuits.

This issue of Tor Weekly News has been assembled by Lunar, harmony, Matt Pagan, qbi and the Tails team.

Want to continue reading TWN? Please help us create this newsletter. We still need more volunteers to watch the Tor community and report important news. Please see the project page, write down your name and subscribe to the team mailing list if you want to get involved!

Paypal Account Limits now resolved

On April 24, 2014 Paypal notified us our account was being limited due to potentially fraudulent donations. According to Paypal, donors were claiming chargebacks to their credit card companies for fraudulent donations or purchases. We solely use Paypal to receive donations and therefore rely on Paypal's systems of validation and fraud detection. As a result of the limitations, a number of donors were denied the ability to donate. We appreciate your donations. As of April 30, the limits on our account have been lifted. Please consider a donation today.

We received around $67,000 from 4,700 individuals donating through Paypal in 2013. These donations are used to keep Tor running and developers improving Tor.

Tor Weekly News — April 30th, 2014

Welcome to the seventeenth issue of Tor Weekly News in 2014, the weekly newsletter that covers what is happening in the Tor community.

Tor is released

The latest incarnation of the current development branch of Tor, dubbed, was released on April 26th. This release brings mainly security and performance improvements for clients and relays.

As a preventive measure (there being no evidence that the keys have been compromised), authority signing keys that were used while susceptible to the OpenSSL “heartbleed” bug are now blacklisted.

Other improvements include fixing two expensive functions on busy relays, better TLS ciphersuite preference lists, support for run-time hardening on compilers that support AddressSanitizer, and more work on the Linux sandbox code. There are also several usability fixes for clients (especially clients that use bridges), two new TransPort protocols supported (one on OpenBSD, one on FreeBSD), and various other bugfixes.

As Nick Mathewson wrote: “This release marks end-of-life for Tor 0.2.2.x; those Tor versions have accumulated many known flaws”.

Source code is available at the usual location and binary packages have already started to be updated.

Introducing the 2014 Google Summer of Code projects

As announced in February, Tor is once again participating in Google’s Summer of Code program, allowing students and aspiring developers the chance to work on a Tor-related project with funding from Google and expert guidance from Tor Project members. After several months of coordination and discussion, this summer’s successful proposals have now been chosen, and some of the students took to the tor-dev mailing list to introduce themselves and their upcoming work.

Juha Nurmi will continue to work on the already-operational hidden service search engine, while Marc Juarez will be “implementing the building blocks for a future padding-based website fingerprinting countermeasure as a pluggable transport”. Daniel Martí has taken up the challenge of implementing proposal 140, which aims to considerably reduce the size of the network consensus data that Tor clients fetch every hour, and Israel Leiva plans to spruce up the neglected GetTor service, which allows users to download the Tor Browser Bundle even if the Tor website and its mirrors are inaccessible. Amogh Pradeep will be contributing to the Guardian Project’s development of Orfox, a new Android web browser to be used with Orbot, while Kostas Jakeliunas returns to Tor GSoC to construct a new BridgeDB distributor, serving bridge addresses to users in censored areas over Twitter, and possibly other channels as well. Quinn Jarrell will be working on building a pluggable transports combiner that “will allow transports to be chained together to form more varieties of transports and make them harder to detect and block”. Sreenatha Bhatlapenumarthi will pick up the effort of rewriting Tor Weather.

You can read more about each proposal in the respective introductory messages and their replies; a full list of accepted projects is available on the Google Summer of Code website. As Daniel wrote, “comments are very welcome”!

Miscellaneous news

Meejah released version 0.9.2 of txtorcon — the Tor controller library for the Twisted Python framework: “this release adds a few minor bug-fixes and a few API enhancements”.

The Tails team is looking for enthusiasts equipped with a Bluetooth keyboard and mouse to ensure that Tails works properly with such hardware.

Matthew Finkel forwarded a copy of the email that was sent to bridge operators  to warn them about the “Heartbleed” vulnerability, and the actions that should be taken as a result. If you know any bridge operator who might not have filled in their contact information, please forward the message!

Karsten Loesing has been working on switching Onionoo — the web service to retrieve information about the Tor network — to use the Gson library instead of plain string concatenation to format its JSON output. As the change might break some applications, client authors should test their applications and see if everything still works as it should.

Tor help desk roundup

The help desk has been asked why the Tor Project’s hidden service site mirrors are offline. The sites were taken down during the fallout from the Heartbleed security vulnerability. New hidden service addresses were not generated. The sysadmin team has expressed that they no longer wish to maintain these services.

News from Tor StackExchange

Kristopher Ives is working on a card game using Tor. Each user accepts inbound connections through hidden services, and also needs to make outbound connections. Tom Ritter acknowledged it was possible to use only one Tor daemon to do both.

Dan gets the error message “Cannot load XPCOM” whenever Tor Browser is started. Jens Kubieziel pointed to the discussion at #10789. The culprit is WebRoot Internet Security as it prevents the proper loading of all browser components; either uninstalling it or adding DLL files to the whitelist has helped other users.

This issue of Tor Weekly News has been assembled by Lunar, harmony, Matt Pagan, qbi, and Karsten Loesing.

Want to continue reading TWN? Please help us create this newsletter. We still need more volunteers to watch the Tor community and report important news. Please see the project page, write down your name and subscribe to the team mailing list if you want to get involved!

Tor Browser 3.6 is released

The Tor Browser Team is proud to announce the first stable release of the 3.6 series. Packages are available from the Tor Browser Project page and also from our distribution directory.

For users upgrading from Tor Browser 3.5.x, the 3.6 series features fully integrated Pluggable Transport support, including an improved Tor Launcher UI for configuring Pluggable Transport bridges. The Pluggable Transport code is also fully disabled for users who do not configure them. The 3.6 series also changes the MacOS archive format from zip to DMG, which should improve installation usability for Mac users.

This release also includes important security updates to Firefox.

Please see the TBB FAQ listing for any issues you may have before contacting support or filing tickets. In particular, the TBB 3.x section lists common issues specific to the Tor Browser 3.x series. We also maintain a list of frequently encountered known issues in our bugtracker.

Here is the complete changelog since TBB 3.5.4:

  • All Platforms

    • Update Firefox to 24.5.0esr
    • Include Pluggable Transports by default:
      • Obfsproxy3 0.2.4, Flashproxy 1.6, and FTE 0.2.13 are now included
    • Bug 11586: Include license files for component software in Docs directory.
    • Bug 9010: Add Turkish language support.
    • Bug 9387 testing: Disable JS JIT, type inference, asmjs, and ion.
    • Update NoScript to
    • Update Tor Launcher to
      • Bug 9665: Localize Tor's unreachable bridges bootstrap error
      • Bug 10418: Provide UI configuration for Pluggable Transports
      • Bug 10604: Allow Tor status & error messages to be translated
      • Bug 10894: Make bridge UI clear that helpdesk is a last resort for bridges
      • Bug 10610: Clarify wizard UI text describing obstacles/blocking
      • Bug 11074: Support Tails use case (XULRunner and optional customizations)
      • Bug 11482: Hide bridge settings prompt if no default bridges.
      • Bug 11484: Show help button even if no default bridges.
    • Update Torbutton to
      • Bug 11242: Fix improper "update needed" message after in-place upgrade.
      • Bug 10398: Ease translation of about:tor page elements
      • Bug 9901: Fix browser freeze due to content type sniffing
      • Bug 10611: Add Swedish (sv) to extra locales to update
      • Bug 7439: Improve download warning dialog text.
      • Bug 11384: Completely remove hidden toggle menu item.
    • Backport Pending Tor Patches:
      • Bug 9665: Report a bootstrap error if all bridges are unreachable
      • Bug 11200: Prevent spurious error message prior to enabling network.
      • Bug 5018: Don't launch Pluggable Transport helpers if not in use
      • Bug 9229: Eliminate 60 second stall during bootstrap with some PTs
      • Bug 11069: Detect and report Pluggable Transport bootstrap failures
      • Bug 11156: Prevent spurious warning about missing pluggable transports
  • Mac:

    • Bug 4261: Use DMG instead of ZIP for Mac packages
    • Bug 9308: Prevent install path from leaking in some JS exceptions on Mac and Windows
  • Linux:

    • Bug 11190: Switch linux PT build process to python2
    • Bug 10383: Enable NIST P224 and P256 accel support for 64bit builds.
  • Windows:
    • Bug 9308: Prevent install path from leaking in some JS exceptions on Mac and Windows

Here is the changelog since the 3.6-beta-2:

  • All Platforms
    • Update Firefox to 24.5.0esr
    • Update Tor Launcher to
      • Bug 11482: Hide bridge settings prompt if no default bridges.
      • Bug 11484: Show help button even if no default bridges.
    • Update Torbutton to
      • Bug 7439: Improve download warning dialog text.
      • Bug 11384: Completely remove hidden toggle menu item.
    • Update NoScript to
    • Update fte transport to 0.2.13
    • Backport Pending Tor Patches:
      • Bug 11156: Additional obfsproxy startup error message fixes
    • Bug 11586: Include license files for component software in Docs directory.
  • Windows and Mac:
    • Bug 9308: Prevent install path from leaking in some JS exceptions on Mac and Windows builds

Tor Summer 2014 Dev Meeting Hosted by Mozilla

We are excited to announce our Summer 2014 Dev meeting will be held in Paris, France June 29 - July 4.

Thank you to Mozilla for hosting us at their Paris offices and for their continued support of Tor!

Further details regarding public events will be announced very soon - stay tuned!

Tails 1.0 is out

Tails, The Amnesic Incognito Live System, version 1.0, is out.

All users must upgrade as soon as possible: this release fixes numerous security issues.

For more information about what the 1.0 release means for Tails, and about its future, see the full announcement.


Notable user-visible changes include:

  • Security fixes
    • Upgrade the web browser to 24.5.0esr-0+tails1~bpo60+1 (Firefox 24.5.0esr + Iceweasel patches + Torbrowser patches).
    • Upgrade Tor to
      • Based on
      • Backport the fix for bug #11464 on Tor Project's Trac. It adds client-side blacklists for all Tor directory authority keys that was vulnerable to Heartbleed. This protects clients in case attackers were able to compromise a majority of the authority signing and identity keys.
  • Bugfixes
    • Disable inbound I2P connections. Tails already restricts incoming connections, but this change tells I2P about it.
    • Fix link to the system requirements documentation page in the Tails Upgrader error shown when too little RAM is available.
  • Minor improvements
    • Upgrade I2P to 0.9.12-2~deb6u+1.
    • Import TorBrowser profile. This was forgotten in Tails 0.23 and even though we didn't explicitly set those preferences in that release they defaulted to the same values. This future-proofs us in case the defaults would ever change.
    • Import new custom version of Tor Launcher:
    • Integrate the new Tails logo into various places:
      • The website
      • The boot splash
      • The "About Tails" dialog

See the online Changelog for technical details.

Known issues

I want to try it or to upgrade!

Go to the download page.

As no software is ever perfect, we maintain a list of problems that affects the last release of Tails.

What's coming up?

The next Tails release is scheduled for June 10.

Have a look to our roadmap to see where we are heading to.

Would you want to help? There are many ways you can contribute to Tails. If you want to help, come talk to us!

Support and feedback

For support and feedback, visit the Support section on the Tails website.

Tor Weekly News — April 23rd, 2014

Welcome to the sixteenth issue of Tor Weekly News in 2014, the weekly newsletter that covers what is happening in the Tor community.

Cutting out relays running version 0.2.2.x

Tor relays running the now ancient Tor 0.2.2.x are scheduled to be removed from the consensus. The change has already been merged in the master branch and will be out with the next Tor 0.2.5 alpha.

Even if most relay operators have been warned, the change has not yet been widely announced. But as three directory authorities are already not voting for the deprecated versions, the downtime of two others while cleaning up after the OpenSSL “Heartbleed” issue was sufficient to get these relays removed from the consensus for a couple of days, as Roger Dingledine explained.

Eventually relays running versions prior to might also be removed from the consensus. “I think’s fix of #6033 makes that one a plausible ’not below this one’ cutoff”, Roger writes in the relevant Trac entry.

Relay operators should always make sure to run a recommended Tor version. The Tor Weather service can be used by relay operators to get email notifications if an outdated version is detected.

Miscellaneous news

Nathan Freitas announced the third (and probably final) release candidate for Orbot 13.0.6: “The big improvements in this build are a fix for the disconnected UI/activity (Tor is on, but UI shows off), and improvements to the transparent proxying iptables scripts”.

The Tails developers put out two calls for testing: the first is for the first release candidate of Tails 1.0; while the second is for UEFI support, which “allows you to start Tails using a USB stick on recent hardware, and especially on Mac”. “Test wildly”, and report any bugs you find!

Andrea Shepard sent a list of 1777 fingerprints for relays “which have ever turned up as potentially exposed by Heartbleed”. It appears that enough directory authority operators now reject relays known to be problematic: sssheep reported that the still-vulnerable section of the network was down to 0.01% of the consensus weight.

Mick drew attention to the fact that in its current state, arm — the command-line relay status monitor — wrongly advises relay operators to run it with the same user as Tor, in order to access information about the relay’s connections. This is in fact a very bad idea, and a ticket is already open to address this issue. Lunar detailed the correct method of doing this, which is also explained in the ticket.

On the tor-relays mailing list, David Stainton mentioned his Tor role for the Ansible automation tool. David hoped that “relay operators will find this useful for deploying and maintaining large numbers of Tor relays and bridges”. The documentation specifies that it currently works with Debian and Ubuntu systems, and contains several configuration examples.

David Fifield continued his progress on meek, a pluggable transport “that routes your traffic through a third-party web service in a way that should be difficult to block”. David sent a call for wider testing of experimental Tor Browser builds and a call for reviews of the code. “There are a lot of components that make up the meek transport […] This is your chance to get in on the ground floor of a new transport!”

Ximin Luo raised several points regarding how “indirect” pluggable transports like flashproxy or meek are currently handled by Tor. Whereas obfs3 or ScrambleSuit connect directly to the specified peer, transforming the data flow along the way, Ximin describes meek and flashproxy as providing “the metaphor of connecting to a global homogeneous service”. The latter being “incompatible with the metaphor of connecting to a specific endpoint”. Solutions on how to make the design, code, and configuration better are up for discussion.

Nicolas Vigier submitted his status report for March.

Philipp Winter relayed the call for papers for the 4th USENIX Workshop on Free and Open Communications on the Internet. The workshop will be held on August 18th, and should bring together the wider community of researchers and practitioners interested in Tor and other ways to study, detect, or circumvent censorship. Papers have to be submitted before May 13th.

Fabio Pietrosanti wondered whether anyone had “ever tried to start Tor from a Python application using Ctypes”, making it possible to “sandbox the Python application using AppArmor without enabling any kind of execve() call”.

Tor help desk roundup

Many people email the Tor Help Desk from behind restrictive university firewalls that require them to connect using a proxy. Often these firewalls, Cyberoam and Fortiguard are two examples, use Deep Packet Inspection and block Tor traffic. Unfortunately Tor Browser users can’t use a proxy to connect to the internet and also use a pluggable transport. The Tor Browser team plans to include this capability in a future release.

This issue of Tor Weekly News has been assembled by Lunar, harmony, Matt Pagan, and an anonymous contributor.

Want to continue reading TWN? Please help us create this newsletter. We still need more volunteers to watch the Tor community and report important news. Please see the project page, write down your name and subscribe to the team mailing list if you want to get involved!

Syndicate content Syndicate content