Tor Browser 6.0 is released
The Tor Browser Team is proud to announce the first stable release in the 6.0 series. This release is available from the Tor Browser Project page and also from our distribution directory.
This release brings us up to date with Firefox 45-ESR, which should mean a better support for HTML5 video on Youtube, as well as a host of other improvements.
Beginning with the 6.0 series code-signing for OS X systems is introduced. This should help our users who had trouble with getting Tor Browser to work on their Mac due to Gatekeeper interference. There were bundle layout changes necessary to adhere to code signing requirements but the transition to the new Tor Browser layout on disk should go smoothly.
The release also features new privacy enhancements and disables features where we either did not have the time to write a proper fix or where we decided they are rather potentially harmful in a Tor Browser context.
On the security side this release makes sure that SHA1 certificate support is disabled and our updater is not only relying on the signature alone but is checking the hash of the downloaded update file as well before applying it. Moreover, we provide a fix for a Windows installer related DLL hijacking vulnerability.
A note on our search engine situation: Lately, we got a couple of comments on our blog and via email wondering why we are now using DuckDuckGo as the default search engine and not Disconnect anymore. Well, we still use Disconnect. But for a while now Disconnect has no access to Google search results anymore which we used in Tor Browser. Disconnect being more a meta search engine which allows users to choose between different search providers fell back to delivering Bing search results which were basically unacceptable quality-wise. While Disconnect is still trying to fix the situation we asked them to change the fallback to DuckDuckGo as their search results are strictly better than the ones Bing delivers.
Update: We plan to post instructions for removing the OS X code signing parts on our website soon. This should make it easier to compare the OS X bundles we build with the actual bundles we ship.
The full changelog since Tor Browser 5.5.5 is:
Tor Browser 6.0 -- May 30
- All Platforms
- Update Firefox to 45.1.1esr
- Update OpenSSL to 1.0.1t
- Update Torbutton to 1.9.5.4
- Bug 18466: Make Torbutton compatible with Firefox ESR 45
- Bug 18743: Pref to hide 'Sign in to Sync' button in hamburger menu
- Bug 18905: Hide unusable items from help menu
- Bug 16017: Allow users to more easily set a non-tor SSH proxy
- Bug 17599: Provide shortcuts for New Identity and New Circuit
- Translation updates
- Code clean-up
- Update Tor Launcher to 0.2.9.3
- Update HTTPS-Everywhere to 5.1.9
- Update meek to 0.22 (tag 0.22-18371-3)
- Bug 15197 and child tickets: Rebase Tor Browser patches to ESR 45
- Bug 18900: Fix broken updater on Linux
- Bug 19121: The update.xml hash should get checked during update
- Bug 18042: Disable SHA1 certificate support
- Bug 18821: Disable libmdns support for desktop and mobile
- Bug 18848: Disable additional welcome URL shown on first start
- Bug 14970: Exempt our extensions from signing requirement
- Bug 16328: Disable MediaDevices.enumerateDevices
- Bug 16673: Disable HTTP Alternative-Services
- Bug 17167: Disable Mozilla's tracking protection
- Bug 18603: Disable performance-based WebGL fingerprinting option
- Bug 18738: Disable Selfsupport and Unified Telemetry
- Bug 18799: Disable Network Tickler
- Bug 18800: Remove DNS lookup in lockfile code
- Bug 18801: Disable dom.push preferences
- Bug 18802: Remove the JS-based Flash VM (Shumway)
- Bug 18863: Disable MozTCPSocket explicitly
- Bug 15640: Place Canvas MediaStream behind site permission
- Bug 16326: Verify cache isolation for Request and Fetch APIs
- Bug 18741: Fix OCSP and favicon isolation for ESR 45
- Bug 16998: Disable <link rel="preconnect"> for now
- Bug 18898: Exempt the meek extension from the signing requirement as well
- Bug 18899: Don't copy Torbutton, TorLauncher, etc. into meek profile
- Bug 18890: Test importScripts() for cache and network isolation
- Bug 18886: Hide pocket menu items when Pocket is disabled
- Bug 18703: Fix circuit isolation issues on Page Info dialog
- Bug 19115: Tor Browser should not fall back to Bing as its search engine
- Bug 18915+19065: Use our search plugins in localized builds
- Bug 19176: Zip our language packs deterministically
- Bug 18811: Fix first-party isolation for blobs URLs in Workers
- Bug 18950: Disable or audit Reader View
- Bug 18886: Remove Pocket
- Bug 18619: Tor Browser reports "InvalidStateError" in browser console
- Bug 18945: Disable monitoring the connected state of Tor Browser users
- Bug 18855: Don't show error after add-on directory clean-up
- Bug 18885: Disable the option of logging TLS/SSL key material
- Bug 18770: SVGs should not show up on Page Info dialog when disabled
- Bug 18958: Spoof screen.orientation values
- Bug 19047: Disable Heartbeat prompts
- Bug 18914: Use English-only label in <isindex/> tags
- Bug 18996: Investigate server logging in esr45-based Tor Browser
- Bug 17790: Add unit tests for keyboard fingerprinting defenses
- Bug 18995: Regression test to ensure CacheStorage is disabled
- Bug 18912: Add automated tests for updater cert pinning
- Bug 16728: Add test cases for favicon isolation
- Bug 18976: Remove some FTE bridges
- Windows
- Bug 13419: Support ICU in Windows builds
- Bug 16874: Fix broken https://sports.yahoo.com/dailyfantasy page
- Bug 18767: Context menu is broken on Windows in ESR 45 based Tor Browser
- OS X
- Build System
- All Platforms
- Windows
- OS X
- Linux
Tor Browser uses OCSP
Tor Browser uses OCSP stapling, please see https://en.wikipedia.org/wiki/OCSP_stapling
But doesn't it still contact
But doesn't it still contact OCSP servers in the (very common) case that the HTTPS server doesn't include an OCSP response in the TLS handshake?
ctrl-shift-U (the shortcut
ctrl-shift-U (the shortcut key for new identity) is already used in GTK applications for unicode character entry: https://en.wikipedia.org/wiki/Unicode_input#In_X11_.28Linux_and_other_U…
as such, the new identity keyboard shortcut only works when the cursor is not in a text input area.
Thanks, this is
Thanks, this is https://bugs.torproject.org/19211 now.
Help. I cannot change the
Help. I cannot change the Preferences settings and can't get move between any of the options. I'm using a Mac 10.8.5.
Thanks
What are you trying to do?
What are you trying to do? Can you give steps to reproduce your problem?
just upgraded to v6 this
just upgraded to v6 this morning and nothing happens when i run the shortcut. have been using tor browser for the last 7 or so versions with no issues. my system is windows 7 64 bit. have tried running as Administrator, disabling firewall, and antivirus with no joy. please help
uninstall tor
uninstall tor completely
then install tor version 6
and will work like charm
tyvm for the reply. as far
tyvm for the reply. as far as i can tell the installation is self contained in the one directory and not in the registry? there was no uninstall that i could find...Tor Browser isnt listed in Programs. I did delete the upgraded Tor Browser directory and ran the install again..still no joy. apologies if im missing something obvious
ok i just installed v6 to
ok i just installed v6 to new directory after upgraded directory would not load Tor Browser. the new directory install also will not load. no processes for firefox or tor shows up in my windows 7 64 bit system.
Do you get any error
Do you get any error messages? Have you tried removing your antivirus and firewall software for testing purposes? It happens that merely disabling them is not enough.
no error messages anywhere.
no error messages anywhere. i have not tried uninstalling antivirus and firewall yet. just a bit peeved to have to do this as multiple previous versions have worked fine without this step. not complaining just maybe a little lazy
Will you make 64-bit Windows
Will you make 64-bit Windows build?
Not with the ESR45 based
Not with the ESR45 based series. We plan to do that for the next ESR (i.e 52), though.
What are system requeriments
What are system requeriments ? For example: how much space will it take on my win 7?
thank you very much
thank you very much
I can't find the torrc file
I can't find the torrc file anywhere
i'm using os x 10.11.5
in 5.5.5 version it was with torrc-default file
but now i cant find it?
THANK YOU
THANK YOU
Thanks a lot for the hard
Thanks a lot for the hard work!
How about officially integrating the DuckDuckGo onion search into TOR Browser (at least as an option)? Like it is done here: https://addons.mozilla.org/en-US/firefox/addon/duckduckgo-on-tor/
Their onion address is here: http://3g2upl4pq6kufc4m.onion
That's already done.
That's already done.
This was
This was https://trac.torproject.org/projects/tor/ticket/16322 and is already implemented in Tor Browser 6.0.
I store Tor Browser inside a
I store Tor Browser inside a Veracrypt volume, but It will not upgrade after updating it, I have to cut and paste outside the volume, and only then, will upgrade to new version. What could be? Happens the same with plugins, they won't update, only out of the volume.
hey tor browser wont start
hey tor browser wont start on debian jessie or 8 basicly. it will just say connecting to the Tor network and grabbing certificate authorities and stuff but it stays stuck 1/4 of the way there. icant get the network to load no matter what i do let alone the browser to pop up...
What output do you get when
What output do you get when you start it on the terminal like so: ./start-tor-browser.desktop --debug inside your tor-browser_$LOCALE directory? Do older Tor Browser versions work?
Meek pluggable transport not
Meek pluggable transport not working on OS X. meek-client-torbrowser proxy is not launching.
Probably due to new directory structure, noted /Applications/TorBrowser.app/Contents/Resources/TorBrowser/Tor/PluggableTransports/template-profile.meek-http-helper
folder exists
actual proxy located in:
/Applications/TorBrowser.app/Contents/MacOS/Tor/PluggableTransports/meek-client-torbrowser
Maybe the link to the transport has not been updated for the new setup or in torrc.
Other proxies work.
In 5.5, meek was only located in /Applications/TorBrowser.app/TorBrowser/Tor/PluggableTransports/meek-client-torbrowser and worked.
This error occurs on a fresh install of 6.0.
LOG:
DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
...
Opening Socks listener on 127.0.0.1:9150
...
The communication stream of managed proxy 'PluggableTransports/meek-client-torbrowser' is 'closed'. Most probably the managed proxy stopped running.
...
We were supposed to connect to bridge '0.0.2.0:3' using pluggable transport 'meek', but we can't find a pluggable transport proxy supporting 'meek'. This can happen if you haven't provided a ClientTransportPlugin line, or if your pluggable transport proxy stopped running.
Works fine for me with a
Works fine for me with a fresh install and choosing meek-azure (this is on an old 10.6 testing Mac) . I wonder what is wrong on your side, hrm.
Maybe would be better to
Maybe would be better to test on 10.11 before just saying everything is fine?
I did not say everything is
I did not say everything is fine. I just said this is working on my OS X machine. How do you know from the original post that this is an issue on 10.11?
10.11 is the latest, and
10.11 is the latest, and only version of OS X Apple issues full security updates for, so you'd think TorProject would want to test on it.
I just used a Mac OS 10.11.5
I just used a Mac OS 10.11.5 system to try to reproduce this problem. I could not. I tried both en-US and es-ES packages.
In Tor Browser 6.0, the template-profile.meek-http-helper directory contents should be copied to TorBrowser-Data/Tor/PluggableTransports/profile.meek-http-helper by the meek client when it starts up. If the original commenter is still having problems, they should open a trac ticket so we can discuss this problem and investigate further.
Will try to when I have
Will try to when I have time. Does anyone know how to enable logging on the meek proxy?
In torrc, change the
In torrc, change the
ClientTransportPluginline to:This will give you two log files, meek-client-torbrowser.txt and meek-client.txt. meek-client-torbrowser is the program that starts up a headless copy of Firefox for TLS camouflage. meek-client actually implements the transport.
Note to all OSX users
Note to all OSX users encountering similar error: make sure before upgrade/clean install for 6.0+ that user installing has sudo privileges. TorBrowser needs write access to /Applications/TorBrowser-Data/ which will fail unless the user is an administrator. sudo privileges can be removed after installation and first run without problems.
Thanks. This is
Thanks. This is https://trac.torproject.org/projects/tor/ticket/19646
Read the ticket for a workaround.
thanks! i guess it's normal
thanks!
i guess it's normal that http://ip-check.info/?lang=en says my user-agent is bad or should i reinstall it?
They probably need to update
They probably need to update their test to reflect our switch to ESR45.
Under ‘main’ ‘env’
Under ‘main’ ‘env’ ‘test 1’ ‘test 2’ and ‘ssi’ http://www.stilllistener.com/checkpoint1/index.shtml gives the same user agent information that ip-check.info rates as bad (red).
Maybe we should think
Maybe we should think carefully when consulting ip-check.info.
Since with TOR 6.0, when checking on ip-check.info, I was getting an orange and a red rating for Signature and User-Agent respectively I decided to reinstall TOR 5.5.5 and check the results again.
The Signature ‘Orange’ rating for TOR 6.0 becomes a ‘Green’ rating for TOR 5.5.5 showing EXACTLY the SAME ‘Value’.
In the case of User Agent the only difference between the Green rating for TOR 5.5.5 and a Red rating for TOR 6.0 is that for TOR 5.5.5 38.0 appears under Value and for TOR 6.0 that changes to 45.0.
Keep up the good work.
This forced ass raping of
This forced ass raping of updates for 6.0 is bullshit.
Please make preventing auto updates an enjoyable, and possible, experience.
Yes, the updates still
Yes, the updates still download when the respectively located update files have been removed and when about:config and the file crying about not being edited that directs you there have been altered to prevent them from doing so.
More trust in users would be nice :)
about:config app.update.auto
about:config
app.update.auto = false
With that said, is there any reason why you don't want updates? You're leaving yourself open to known security vulnerabilities.
as for me its against my
as for me its against my personal security rule #6:
never allow anyone to touch your property
This isn't a Tor bug, but a
This isn't a Tor bug, but a Youtube one.
I was using 5.5.5 to surf Youtube without issue (each time using a fresh Tor extraction), then a few days ago HTML5 started to crash reliably after watching a few videos (does the same with v6.0).
Getting a "new identity" didn't fix the issue. You have to shut it down, kill Firefox in task manager, and restart in order to view HTML5 videos again (non-video websites still work).
Obviously Youtube made a change that is crashing Tor (since I used a fresh Tor extraction each time for weeks without issue).
For security reasons it's probably a good idea to restart as much as possible when getting a new identity, especially HTML5, so settings/cache/bugs/and other data aren't retained, and this would provide a fix to not only this issue, but countless others.
Which operating system is
Which operating system is this happening on? And what does "reliably" mean? Do you have some particular steps I could try?
This update is pretty
This update is pretty big!
Where is the hardened version for Windows?
Yes, it is big as the new
Yes, it is big as the new Firefox got a lot bigger (again). There is no hardened version for Windows. And it is none planned at the moment.
So is it normal that it is
So is it normal that it is about 200MB? It was about 160 before this update.
The "hardened" version
The "hardened" version specifically includes Address Sanitizer(ASan) which has a significant impact on performance in both memory usage and speed, which is why hardened is permanently stuck in alpha.
As for why it isn't available on Windows: Last I checked, ASan didn't fully support Windows.
>Accept-Encoding: gzip,
>Accept-Encoding: gzip, deflate, br
>brotli
Whatever makes you happy.
Is brotli secured and
Is brotli secured and bug-free?