New Release: Tor Browser 8.0.2

by gk | October 02, 2018

Tor Browser 8.0.2 is now available from the Tor Browser Project page and also from our distribution directory.

This release features important security updates to Firefox. We picked up the necessary patches, but because we needed to start building before Mozilla was ready with a first candidate build, we did not bump the Firefox version to 60.2.2esr. Thus, users are fine with Tor Browser 8.0.2 even though the Firefox version is 60.2.1esr.

Known Issues

We already collected a number of unresolved bugs since Tor Browser 7.5.6 and tagged them with our tbb-8.0-issues keyword to keep them on our radar. The most important current issues are:

The full changelog since Tor Browser 8.0.1 is:

  • All platforms
    • Update Firefox to 60.2.1esr
    • Backport fix for Mozilla bug 1493900 and 1493903
  • OS X
    • Backport fix for Mozilla bug 1489785 for macOS 10.14 compatibility
Tags
tor browser
tbb
tbb-8.0
Anonymous

Töpin Hamburg (not verified) said:

October 02, 2018

Permalink

Don't know what happened but I upgraded from 7.5.x to 8.0.2 and since, I got a ton of Cloudflare pages telling me to solve lots of Google Captcha because I need to "run an anti-virus scan on [my] device to make sure it is not infected with malware". But whatever I try, the problem is still there : anti-virus, anti-malware, reinstalling TBB, and so on. I even tried to reset my W10 and to install a full TBB 8.02 archive : the problem is still there. I cannot beleive the problem is on my side, but since you don't report such a problem, I'm wondering what's going on ? :/

No, don't do that. It would make you fingerprintable.

The proper workaround when you see a Cloudflare CAPTCHA is to press Ctrl+Shift+L ("New Tor Circuit for this Site") until it goes away.

This is the only thing that works without making me extremely homicidal towards Google and Cloudflare, but it is not a sustainable solution, as the list of accepted TOR exit nodes must get smaller all the time (due to abuse, or just being flagged as TOR exit nodes - ask Cloudflare how it works).

This is precisely why I learned the shortcut.
Another way is to use archive.org or another service to access the site, which is no problem if you know the page is years/months/weeks old anyway. Or find another way.
Some sites don't work at all no matter how much you try a "New tor circuit", those are sites that throw an Error 403 or a raw text page to that effect. Even sites where you may need to download Windows drivers. Be careful there I only trust drivers from the original manufacturer website.

I agree insofar that the Tor project could have/should have done this themselves. They have tested this beforehand and must have noticed this issue.

It doesn't matter how "secure" your browser is if it doesn't work half of the time. I'll stick to using Tor 7.5.6 until the 8.x Tor browser works reliably. And in that I include a summary that doesn't start with "Known Issues: WebGL is broken right now." I get it: WebGL is not very good. And FireFox itself has been getting worse and worse with every update. Maybe the Tor project should dial the Firefox version back a bit and just apply the updates concerning privacy/security.

This is nothing to do with viruses, malware or the update, or your system. Cloudflare simply has a list of tor exit nodes and applies the captcha globally to them. That can be adjusted individually by each website which uses cloudflare. Lots of websites block tor exit nodes by default.
You can use bing or startpage cache / proxy to read some websites, without solving a captcha. Google itself has a captcha on tor.
If you don't believe me then install tor browser 7.5.x on a different computer, then look at the same websites on both.

The upgrade went fine!

For the CAPTCHA issue there is https://trac.torproject.org/projects/tor/ticket/27848

I get the same. Also the captcha seems to be poor quality? It takes a lot of clicks to get verified. All I can assume is the circuit you are given is on their blacklist of sites - but its very common.

It should be better now. The bug report mentioned in other replies is marked fixed now and anecdotally I don't see as many captchas as before.

New version screws up my fave sites (Win 7) asking for captcha and can not solve the captcha. I system restored old Tor version and now all is OK. But Tor updates automatically, so next time I restart I'll be hooped again! Please fix so no captcha required for sites, such as YIFY movies

Since xul to webextensions was the biggest change when ff went quantum, I'd *suspect* that loss of noscript functionality causes these tor browser 8 site "incompatibilities".

But why even have Quantum then? You know what I mean? It's not like Mozilla owns torproject. The core concepts of Tor (as far as I'm aware) are anonymity through a daisy chain of proxies and everybody looking the same. Just stick to a pre-Quantum Firefox - or even an entirely different browser. I bet the Linux community would have a few lovely browser suggestions that are neither Firefox nor Google's Chrome. While I would miss the addons, I would be happy to have a Tor browser that delivers a... smoother experience. I mean 8.0 was released in early September but every time I check the current version, everything's ... kind of a mess, really. It honestly feels to me like an alpha version was pushed to live as part of a joke but the rest of the team took it at face value and now the person responsible doesn't dare to speak up...

This worked for me in Windows. Re-install the old version. In the Tor Browser folder, navigate to \Browser\TorBrowser\UpdateInfo. Delete the folder UpdateInfo. Or, alternatively, open UpdateInfo and delete the file "active-update.xml". Then navigate on to "*\updates\0" and delete the files "update.mar", "update.status", and "update.version". Use the hamburger stack to open Options, then set the update preference to "Never check for updates (not recommended)". If you don't mind being nagged by a popup, enable "Check for updates but let you choose to install them". Close your browser and restart it. If the delete folder "UpdateInfo" option was chosen, that folder should be regenerated upon restart. But it will be empty, and your TBB version should persist as your old version.

It would be really nice to have a Tor browser on UBports' Ubuntu Touch...

I second the comment above about Cloudflare problems.

I also have huge problems with Cloudflare captchas since the upgrade to TBB 8.0 at the beginning of September, 2018. I use TBB on both Win10 and Ubuntu, and the Cloudflare problems occur on both.

Cloudflare has been a big problem for us TBB users for a long time, but the situation had gotten a bit better throughout 2017 and 2018, even without any "privacy pass". But starting exactly with the TBB 8.0 upgrade, huge numbers of websites became unusable because of Cloudflare captcha loops (you're shown captcha after captcha, but it never acknowledges that you solve the captcha correctly, and the loop never ends).

How many sites you find which are now inaccessible depends on your browsing habits of course, so I can only give my situation. I read many sites every day, covering a big range of topics. In my case, I now find around 30-40 different sites per day where TBB is completely blocked by Cloudflare. Even for heavy internet use, it's a lot. Since most are sites I visit regularly, I'm certain that they were not blocked before the 8.0 upgrade.

It should be better now. There was a bug report tracking the issue that has been marked fixed and my personal experience is that I don't get as many captchas as in recent weeks.

The bug report is here:
https://trac.torproject.org/projects/tor/ticket/27848

Second dot release and still: Safer - is unusable, Safest - is unusable. Is new 8.x for dummies only?

What do you mean with "unusable"?

That means the control of partially allowing some web content is totally lost.

And without js most sites are unusable.

After upgrading to 8.0.1. my system seems overwhelmed. I am not too savvy but prior to upgrade I would have one firefox.exe open for each tab that was open. Now I may gave as many as 3 for each tab open. I am using an older laptop running windows 7 and at my age not too inclined to spend the money to stay with the newest platforms. I used TOR because it was not a resource hog but that has changed. Is there something I can do to fix this?

Go into the options and under "Performance" disable "Use hardware acceleration when available" and change "Content process limit" to 1. For me, this reduces memory usage considerably. There are reasons why the default settings are good, but for me they aren't worth the cost.

I'm running LinuxMint 19.0 and Tor browser 8.0.2
Tor onion circuit menu still not available
what's going on?

I think you are looking at the wrong place. We moved the circuit display to the URL bar (more specifically it is now behind the "i" icon which you get when loading a web page) which we announced in our Tor Browser 8.0 blog post, both with some animations and in the blog post text.

Why does it show a padlock instead of an onion for onion domains?

Not sure exactly what you mean but you might hit https://trac.torproject.org/projects/tor/ticket/27657.

That's it.

Check More Information for https://3g2upl4pq6kufc4m.onion and discover it doesn't fit into Page Info window.

The circuit display is not there when we click the 'i' icon - Only displayed is ''secure connection'' and ''permissions'' - this is for windows 43 bit and windows 64 bit too.

Please sort it out r update us here when it has been fixed.

I've seen that, and it's erratic. But if I click "New Circuit for this Site", it seems to load a complete circuit path.

NO CIRCUIT DISPLAY - see my image link for thie proof
https://imgur.com/a/xUyvRbR

What operating system and security slider level is that? Do you get errors if you look at the log output in the browser console (Ctrl + Shift + J)? Does that happen with a clean, new Tor Browser installed to a different location?

Windows 10, 64 bit, tried it with 32bit and same issue, same issue when security level is at low or high. download and refreshed and installed it 3 times and same issue no circuit displayed at all.

I installed the tor browser on a new machine a few days ago and just realized it doesn't show the circuit hops anymore. (I'm not sure if that was the case from the moment it was installed.) It's running on Ubuntu 18.04. The security slider level is standard.

It does -- it's just in a different place.

On the home page that it gives you on startup ("about:tor") it tries to help you learn what has changed.

I'm referring to the same issue as SMITHY is showing on the screen shot.
I have been using 8.0.2 since it has been released and know the circuits were displayed in a new place. It's a different problem:
When I use a bridge, the circuit is not displayed (I get the same information as SMITHY)
when I don't use a bridge the circuit is displayed.
I only noticed that yesterday because I didn't use a bridge before and I think it's confusing.

Interesting. Are you using any of the built-in bridges? If so, does that just happen with a particular type? If not, does it happen with built-in bridges as well?

It actually desn't happen with the built-in bridges that successfully connected to the network no matter the type.

How do you get the bridges where you can reproduce it?

I forgot:

nodeData[i].ip is undefined tor-circuit-display.js:297
updateCircuitDisplay chrome://torbutton/content/tor-circuit-display.js:297:11
onLocationChange chrome://torbutton/content/tor-circuit-display.js:326:25
callListeners chrome://browser/content/tabbrowser.js:704:18
_callProgressListeners chrome://browser/content/tabbrowser.js:727:7
_callProgressListeners chrome://browser/content/tabbrowser.js:4230:12
onLocationChange chrome://browser/content/tabbrowser.js:4577:7
_callProgressListeners resource://gre/modules/RemoteWebProgress.jsm:144:11
receiveMessage resource://gre/modules/RemoteWebProgress.jsm:237:7

That was driving me freaking crazy, not being able to find the circuit info. Thought it had been removed and I was going to downgrade back to 7.

extensions.langpacks.signatures.required;false
WTF?!

The 'Reload Every' option for each tab seems to have disappeared over the last couple of updates. Why has this been removed, and can it be placed back again?

web search implies that "reload every" is a feature of at least three extensions. It is also either feature of opera or a chrome extension.

receive you device does not have permission to access file no matter how many times i download it

Since these updates to version 8, version 8.0.1 and 8.0.2 there has been nothing but problems,

Do you have some Antivirus/Firewall software installed that could be interfering with Tor Browser?