New Release: Tor Browser 8.5.1

by boklm | June 04, 2019

Tor Browser 8.5.1 is now available from the Tor Browser Download page and also from our distribution directory.

Tor Browser 8.5.1 is the first bugfix release in the 8.5 series and aims at mostly fixing regressions and providing small improvements related to our 8.5 release. Additionally, we disable the WebGL readPixel() fingerprinting vector, realizing, though, that we need a more holistic approach when trying to deal with the fingerprinting potential WebGL comes with.

The full changelog since Tor Browser 8.5 is:

  • All platforms
    • Update Torbutton to 2.1.10
      • Bug 30565: Sync nocertdb with privatebrowsing.autostart at startup
      • Bug 30464: Add WebGL to safer descriptions
      • Translations update
    • Update NoScript to 10.6.2
      • Bug 29969: Remove workaround for Mozilla's bug 1532530
    • Update HTTPS Everywhere to 2019.5.13
    • Bug 30541: Disable WebGL readPixel() for web content
  • Windows + OS X + Linux
    • Bug 30560: Better match actual toolbar in onboarding toolbar graphic
    • Bug 30571: Correct more information URL for security settings
  • Android
    • Bug 30635: Sync mobile default bridges list with desktop one
  • Build System
    • All platforms
      • Bug 30480: Check that signed tag contains expected tag name
Tags
tor browser
tbb
tbb-8.5
Anon

aquestion (not verified) said:

June 05, 2019

Permalink

to the point: how do you update tor within tails? i have looked but cannot find an answer that is clear enough..a step by step would be very nice..

A bit more on why it's best to wait for the next Tails: if you try to install something fairly complicated like a Tor Browser bundle in Tails you might easily break some of the carefully tweaked configurations which Tails team put in to keep you safe(r). The risks of the consequences of something like that probably outweigh the possible benefit of replacing TB 8.5 with the current TB 8.5.1.

Anon

Betty (not verified) said:

June 05, 2019

Permalink

Please, listen to users and remove the extra and scary sounding Advanced Settings prompt. I only clicked on it after reading the comments here. Tiananmen Massacre's birthday was 2 days ago and China is getting more sophisticated.

Anon

Macbook (not verified) said:

June 05, 2019

Permalink

Hi, I can not connect. It shows me the following message on my MacbookPRo:
"Tor exited during startup. This might be due to an error in your torrc file, a bug in Tor or another program on your system, or faulty hardware. Until you fix the underlying problem and restart Tor, Tor Browser will not start."
I downloaded the last version tried to restart TOR but the problem persists.

Please try running the application from a shell prompt and let us know what messages you see. Open Terminal and type this: /Applications/TorBrowser.app/Contents/MacOS/firefox (assuming you have installed Tor Browser into /Applications).

You have javascript enabled in your browser! Disable this for your own safety!

we want javascript plz i dont see it

Change the Security Level shield icon to "Safer" or "Safest".

[06-06 09:30:42] Torbutton WARN: Version check failed! Web server error: 0

Is that reproducible? If so, how?

It doesn't seem so. Maybe, it happens when Torbutton check occurs earlier than Tor circuit is established. What is reproducible is:
19:40:24.508 Public-Key-Pins: An unknown error occurred processing the header specified by the site. 1 en-US
https://aus1.torproject.org/torbrowser/update_3/release/WINNT_x86-gcc3-…

Thanks. I wonder whether the latter error is related to https://trac.torproject.org/projects/tor/ticket/21908.

Yes, it looks the same. In general, it is intermittent browser bug, because I checked the headers, and they were correct. Also it seems to happen when you access some site for the first time only.

you can get even:
09:09:23.060 TypeError: this._callback is null /Tor Browser/Browser/omni.ja!/components/nsUpdateService.js:3092:7

Mozilla boasts "Enhanced Tracking Protection" look-alike shield icon, June 4, 2019. Sure to confuse newbies of Tor Browser.
https://blog.mozilla.org/blog/2019/06/04/when-it-comes-to-privacy-defau…
https://blog.mozilla.org/blog/2019/06/04/firefox-now-available-with-enh…

Perhaps a better way would be to give the user the option for the 3 security levels directly in the menu of the shield icon, but add a warning that changing this will change it for ALL tabs, not just the currently active one.

The regular Firefox settings should probably not be accessible through the UI at all. Same goes for the extensions settings. Making these accessible is a trap for people who don't know what they're doing and who think they can just switch stuff around like in a regular browser. If anyone wants to change a setting on Tor browser, for example a person who wants to test something and who doesn't need to be anonymous, they could still access the settings through the about:preferences page.

> add a warning that changing this will change it for ALL tabs

And that they should change it only when starting or ending a New Identity. What if a modal popup to change the security level displayed after a New Identity so you couldn't browse until you set or canceled it? Or the radio buttons were displayed on about:tor until HTTP activity? Would it dampen the effect of impulsive behavior? Would it link them to learn more?

> And that they should change it only when starting or ending a New Identity.

I think this is good advice. Indeed I think somewhere TP offers the same advice. Possibly this injunction (choose New Identity whenever you move the security settings) should be more prominent?

Why is not possible to comment this post?

https://blog.torproject.org/pride-and-privacy

Comments are turned off for that post, probably to avoid hate speech. It's happened before.

For how long have the 64-bit version of TBB for windows been available?
Just noticed I was running 32-bit version which i installed long ago when 64-bit wasn't available and it seems 32-bit users are not auto-upgraded to 64-bit so I had to re-install with the 64-bit TBB....

It's stable since Tor Browser 8.0, so a couple of months.

If the bridge type scramblesuit is deprecated should it be removed from the documentation for bridges?

I guess it depends on where the documentation is? It might still help people but, yes, we should make it in general explicit which pluggable transports we still support and which not.

I was referring to the bridge site for receiving new bridges

Videos aren't playing after the update? Any help?

From which to which version did you update? Could you give us steps to reproduce? What did you modify in Tor Browser?

To all complainers - please be grateful, we are very fortunate to have tor

Plus one.

P.S. Anyone who can spare a few bucks please consider donating! I did.

Ever since the previous update I've been having problems with downloading files, it's added to the download list, but on occasions it gets stuck starting the download, the bar is flashing blue and remains as in "unknown time left", is not a problem with the file or site, since if I try again it may then download normally, although it could happen for the new download to get stuck as well.
Another symptom of the issue is that the failed download cannot be cancelled or removed from the list, the entry would just remain there till the end of the session, while downloads that succeeded would behave just normal.
Now, this in on itself was not a problem(but quite annoying), I'll just try a new download and let the other one hanging there for hours until I was done using Tor, but now if I want to retry the download I'll be meet by a window stating that "the download cannot be completed for unknown reasons", and won't let me try for a new one unless I restart the browser, worse is some other downloads will be affected as well, some will show that window, others will download fine.

The behavior is random as far I can tell, but is almost always certain that the first download I try, whatever it is, will be stuck there for the rest of the session, along with any other that happens along the way.

Could you give us steps to reproduce and system information and Tor Browser modifications you did?

Had these same problems many times, a new circuit has helped me with downloads. Also can help alot with the speed of the downloads. Have had no luck at canceling stuck downloads, sometimes they cancel sometimes they don't.

I've read so much about TOR since i've been using it these last three and a bit years and i am basically no wiser than i was 1st time i used it. I had, and still have absolutely no idea how to change or even locate security settings before this latest change or since this latest change. Moreover even if i was able to locate security settings i do not know what security settings are the safest.
And as for downloading /uploading content???
winzip? or 7? or about 5 other free unpackers or whatever the hell they are called i have at various points downloaded them all but could i understand even 1% of how to use them? NOPE!

What infuriates me also is that i have CONTENT that i would happily share - but again ... i'd firstly need to know how to share beforedoing that.

Just my two cents worth also!

> I've read so much about TOR since i've been using it these last three and a bit years and i am basically no wiser than i was 1st time i used it. I had, and still have absolutely no idea how to change or even locate security settings before this latest change or since this latest change.

That's disheartening but let me try to help.

> Moreover even if i was able to locate security settings

Look at the right side of the menu bar at the top of your Tor Browser 8.5.1 window. Click on the shield icon between the onion icon and the red UBlock icon.

> i do not know what security settings are the safest.

Unfortunately as a general rule we should expect to risk trading some usability (and maybe some anonymity) for better cybersecurity. And what works better for most might work not so well for you. All that said, the settings are "Standard", "Safer", and "Safest".

When you clicked the shield icon you should see a page with brief explanations of what additional security features are added by "safer" and "safest".

I always try to use the safest setting at every site I visit which does not entirely prevent me from using the site at all. For example, many sites work with "safest", but to play a video you may need to drop down to "safer" and reload (curly arrow icon at top left of menu bar).

I generally avoid sites which do not work at all except at "standard", and the number of blocked scripts I see tend to confirm that this is a wise practice.

> And as for downloading /uploading content??? winzip? or 7?

7zip, maybe?

> or about 5 other free unpackers or whatever the hell they are called i have at various points downloaded them all but could i understand even 1% of how to use them? NOPE!

I use Linux so I can't help you with Windows. Maybe someone else will address your question about using compression utilities on Windows?

> What infuriates me also is that i have CONTENT that i would happily share - but again ... i'd firstly need to know how to share beforedoing that.

Content (blog posts? videos of a street protest?) to share on... popular social media sites? This is a tricker subject I think and I have to agree that instructions seem to be hard to find, but I know people do this successfully all the time. The type of content and where you want to upload the content probably matters. I guess it is more likely you will be required to register an account (and to give a valid email) if you want to upload content. I hear good things about protonmail as an email provider which won't sell out their own users.

Maybe someone else can suggest a video tutorial?

(Not OP) What red uBlock icon? OP didn't say they are using Tails or separate add-ons.

https://tb-manual.torproject.org/security-settings/

As for downloading/uploading content, I can't recommend appropriate things without knowing the kind of content and by what method or where you want to send it. 7-zip and others in general are called file archivers. You said Winzip, which is proprietary shareware for Windows, so I will assume you are using Windows. 7-zip is free/libre open-source software and is the one, single, archive program I recommend on Windows. Sometimes, however, it is not necessary to compress files.

There are many possible methods to share content, and there are positives and negatives for each method. Tor Project recommends OnionShare. https://support.torproject.org/misc/misc-12/

Suck off, fuckers! Fuck your tiny updates and you yourself too. From yesterday I was not able to connect to my favorite site. Today, the tor browser said that it does not support the tor. Why? Were your invisible changes so important to reduce people in using their favorite browsers? Burn in hell, you and 'I added a space in my code, but million people will be required to update my software right now" people

> From yesterday I was not able to connect to my favorite site

Using Tor Browser? No doubt the unnamed site has blocked Tor exit nodes from connecting. You cannot expect Tor Project to fix that, but you might try emailing the site owner yourself to ask that Tor be unblocked.

I have no idea what you might have been raging about in the rest of your comment.

By the way, how about a thank you to TP for providing Tor in the first place? Or at least a donation?

Yeah, it sounds like their favorite site blocked Tor exit nodes.
https://support.torproject.org/censorship/censorship-2/

> Suck off, fuckers! Fuck your tiny updates and you yourself too.

In future please bear in mind the self-evident wisdom of an earlier comment from a more positive minded user:

> To all complainers - please be grateful, we are very fortunate to have tor

> Burn in hell, you and "I added a space in my code, but million people will be required to update my software right now" people

You seem to be terribly unhappy that the Tor Project developers are working hard to fix bugs and to introduce necessary new anonymity and security enhancing features---- an attitude which frankly appears to be counter productive.

The devs cannot and clearly do not expect all users to understand all the changes introduced in each new version, but in the announcements they do list them for those with the background to personally study the changes in detail. Users should for the most part be happy, I think, that they do not need to understand the reasoning behind changes in the code in order to keep using Tor Browser.

For my part, I am full of gratitude to everyone who is working hard to keep Tor users safe(r) in an increasingly dangerous world.

Hi. I decided to remove Orbot + Orfox and installed latest version of Tor Browser (from Google Play store) on my Samsung Galaxy Tab A 2016 (Android 8.1), but now all web pages have a truly disturbing fixed-width font appearence.

I guess that's https://trac.torproject.org/projects/tor/ticket/30913.

Hello Tor developers & users!

How can I easily know and understand the differences
between the various Tor Browser (TB) versions
(for example current v8.0.9, v8.5.1 and v9.0a1)?

Which preferences and about:config settings values is common
and which is vary in all these TB variants?

Where can I read about this more, in clearly explained form?

(I'm unexperienced TB user, began using it this New Year.)

Thanks in advance.

I read your 9.0a1 comment first, see my reply there: https://blog.torproject.org/comment/282413#comment-282413.

Tor Browser 8.5.1 seems to be working fine for me under Debian stable (currently Debian 9.9).

Regarding the question above from Mac users: I seem to recall that years ago, Apple computers were said to be harder to use with Tor Browser. Assuming I remember correctly, is that still the case?

More generally, I think it would be very useful for Tor Project to ask someone like Micah Lee to write a blog post offering up to date advice on how Tor users can improve their cybersecurity and privacy, beginning I suppose with constructing a threat model (this is the place where "up to date" is so important because several recent major revelations imply that many with an online life should revise their threat model to increase the likelihood that they will become particular if possibly automated targets of state-sponsored cyberespionage campaigns). Another basic point would probably be that there is litte point in using Tor if you never install security patches for your system.