New Release: Tor Browser 9.0a4

Tor Browser 9.0a4 is now available from the Tor Browser Alpha download page and also from our distribution directory.

Note: this is an alpha release, an experimental version for users who want to help us test new features. For everyone else, we recommend downloading the latest stable release instead.

This release features important security updates to Firefox.

Tor Browser 9.0a4 contains updates to a number of bundle parts, most importantly Firefox (60.8.0esr) and Tor (0.4.1.3-alpha).

In our ongoing efforts to reach more users with Tor Browser, we include native Macedonian bundles for the first time and ship Tor Browser for the aarch64 architecture on mobile (note: the aarch64 build is not currently available on Google Play. You can however download it from our distribution directory, along with its signature). Additionally, we have implemented fixes for accessibility support on Windows systems (big thanks to Richard Pospesel for the hard work here), which now deserve a wider testing. Finally, letterboxing is now being enabled by default. Please give it a try if you can, so we can iron out bugs before we ship it to all users starting with Tor Browser 9.

Similarly to the stable series we include a fundraising banner to help us getting more donations. Please donate if you can!

The full changelog since Tor Browser 9.0a3 is:

  • All platforms
    • Update Firefox to 60.8.0esr
    • Update Torbutton to 2.2.1
    • Update Tor Launcher to 0.2.19.2
      • Bug 30468: Add mk locale
      • Translations update
    • Update HTTPS Everywhere to 2019.6.27
    • Bug 31055+31058: Remove four default bridges
    • Bug 30849: Backport fixes for Mozilla's bug 1552627 and 1549833
  • Windows + OS X + Linux
  • Windows
    • Bug 27503: Provide full support for accessibility tools
    • Bug 30575: Don't allow enterprise policies in Tor Browser
  • OS X
    • Bug 30631: Blurry Tor Browser icon on macOS app switcher
  • Android
khled.8@hotmai.com

July 09, 2019

Permalink

First I wanna say THANK YOU for all your work!! :-))

After updating my Browser to 9.0a4 (Linux 64) I notized this annoying white border around the browser window and changed it by setting "privacy.resistFingerprinting.letterboxing" (via about:config) to false.

Dislike of white border sounds like dislike of changes to "View Image" background color.

There is not a preference to set the colour in the UI or about:config. To view the current colour, view the background's CSS. Right-click on an image (such as the Tor logo on this page), View Image, right-click on the grey background, Inspect Element, click <body> and look at the Rules tab to the right. Then, click <img ...> and look at the Rules tab again.

Go to, also, Mozilla Bug 1407366 for letterboxing, and "Find in this page" (Ctrl+F) the text, "color". Btw, displaying a tooltip when the mouse is hovered on the margin area was a good idea. Unfortunately, tooltips don't display on touchscreens.

I havent taken a look at the alpha yet, but I'd imagine that a user should never see the letter box if they're in windows mode at the default resolution (as the browser should automatically be sized to the letterbox).

If they've gone full screen, the browser should disable letterboxing as the user does not cre about their screen resoltuoon being tracked (hence ignoring the existing warning at the top).

If the user resizes their window to a nonstandard size, a warning similar to the one when you go full screen explaining what the white boxes are (with a simple option to disable it) would be ideal.

This may be how it's implemented currently and I'm not contributing anything worthwhile, but this would be my ideal UX :)

> If they've gone full screen, the browser should disable letterboxing as the user does not care about their screen resolution being tracked (hence ignoring the existing warning at the top).

Disagreed. The user may care. They may fullscreen or maximize the window by habit or accident. Display an explanation, learn more link (containing how to disable it, so they have to actually read the Learn More page), and OK/x to close the message. Stop warning after a number of times by adding a preference like the current extensions.torbutton.maximize_warnings_remaining.

> If the user resizes their window to a nonstandard size, a warning similar to the one when you go full screen explaining what the white boxes are (with a simple option to disable it) would be ideal.

Agreed except that the option to disable it shouldn't be on the warning itself because it's a major privacy feature, and the preference is intentionally not easy to access, buried in advanced about:config. What I would like to see on the message/warning is a button that resizes the window back to the default size. I've wanted one for years. It's painful to start a new identity because of simply dragging a border.

I too had the same initial reaction but then I realized it was probably for a good privacy reason.

In answer to your question though, maybe the white border is too thick? All that extra white space round the edges can be off putting. It doesn't bother me personally but with laptop and cell phone makers trying to increase screen space to the n-th degree, TOR Browser comes along and does the opposite. Might make older people feel like they're back in the 90s, when they're trying desperately to keep up with the youth of today. Wonder if that's just a male inadequacy type of response thing? Y'know, like those who by circumstance are forced to drive family cars and hate teens for having spoilers on their cars, 'cause secretly that's what they want to be doing.

Also, I don't know how many people have been caught doing something they shouldn't be, simply because of the size of their screen. Have you got any real world examples? This might help persuade those who want to turn it off. It's a trade off then: if more screen, then will take the small risk (if there even is one) for my personal attack vector.

> a male inadequacy type of response thing?

You mean FOMO? (and affecting all genders and ages) Facebook and social media in general gorge on that emotion.

> Have you got any real world examples?

Visit any browser fingerprinting check website. Unique window dimension numbers (1234 x 567) make you stand out as you browse and become tagged by tracking algorithms. It's worse if you set the same customized size in every browsing session.

Improve letterboxing: add a 'dark mode' to fill the white background with black to reduce contrast/accommodate for those who prefer darker backgrounds. Thanks for considering. (maybe even a simple pallet of colors to choose from...)

You go out of your way to find a browser for privacy and go so far as to install an alpha version of it, but then you dig through advanced preferences hidden on the UI to disable something explicitly named "privacy.resistFingerprinting..." for aesthetic reasons? Seriously?

"... so you don't have to disable it"

Nope, sorry Sir. I'm just a dumb user (mariner).

Greetings from Sweden :-)

>Tor Browser 9.0a4 contains updates to a number of bundle parts, most importantly Firefox (60.8.0esr) and Tor (0.4.1.3-alpha).
*bundled

Donation banner. What the hell is that triangle thing under the onion supposed to be? I'm stumped. The onion has stick figure feet? Smoke rising from ashtrays? Masonic symbolism??? Whoever makes your recent images isn't very good at it....

I run Ubuntu and have followed the small guides from https://www.torproject.org/ but Tor still doesn't run properly.

On console, "$ torbrowser-launcher" returns "Not all keys were imported successfully!".
It then outputs "Refreshing local keyring..." and freezes.
BUT, if I open HTOP and kill /usr/bin/tor, then Tor launches immediately and automatically through my previously mentionned console and outputs : "Launching './Browser/start-tor-browser --detach'..."

>My question therefor is : what happens when this is going on ; in particular, does this remove the anonimity features of Tor ?
Also, could I possibly launch Tor more conviniently, without having to kill a random software ?

Thanks for reading and considering an answer. ;)

>Bug 31059: Enable Letterboxing
Maximize the browser window and back. Then see what's happening.

I did, looks good for me. What's happening for you?

Maximizing warning. And it cropped the default height when returned from maximizing.

s/macedonian/Macedonian
s/Additionaly/Additionally
s/Similarly to the stable series/Similarly to the stable series,
s/to help us getting/to help us get
https://languagetool.org/

Tor(+meek) is experiencing the following problem, the geo location is China and I also tested it on version 8.5.4 and 8.0.2 and similar problem showed up. It seems the network status file was tampered!
7/11/19, 09:07:40.319 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
7/11/19, 09:07:46.989 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
7/11/19, 09:07:46.989 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
7/11/19, 09:07:46.989 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
7/11/19, 09:07:46.989 [NOTICE] Opening Socks listener on 127.0.0.1:9150
7/11/19, 09:07:46.989 [NOTICE] Opened Socks listener on 127.0.0.1:9150
7/11/19, 09:07:47.951 [WARN] Managed proxy at 'TorBrowser\Tor\PluggableTransports\terminateprocess-buffer.exe' reported: 2019/07/11 09:07:47 running firefox command ["C:\\Users\\alex\\Desktop\\Tor Browser\\Browser\\firefox.exe" "--invisible" "-no-remote" "-profile" "C:\\Users\\joe\\Desktop\\Tor Browser\\Browser\\TorBrowser\\Data\\Browser\\profile.meek-http-helper"]
7/11/19, 09:07:47.952 [WARN] Managed proxy at 'TorBrowser\Tor\PluggableTransports\terminateprocess-buffer.exe' reported: 2019/07/11 09:07:47 firefox started with pid 6352
7/11/19, 09:07:47.952 [WARN] Managed proxy at 'TorBrowser\Tor\PluggableTransports\terminateprocess-buffer.exe' reported: 2019/07/11 09:07:47 running meek-client command ["TorBrowser\\Tor\\PluggableTransports\\meek-client.exe" "--helper" "127.0.0.1:62510"]
7/11/19, 09:07:47.953 [WARN] Managed proxy at 'TorBrowser\Tor\PluggableTransports\terminateprocess-buffer.exe' reported: 2019/07/11 09:07:47 meek-client started with pid 7028
7/11/19, 09:07:47.954 [WARN] Managed proxy at 'TorBrowser\Tor\PluggableTransports\terminateprocess-buffer.exe' reported: 2019/07/11 09:07:47 using helper on 127.0.0.1:62510
7/11/19, 09:07:47.954 [WARN] Managed proxy at 'TorBrowser\Tor\PluggableTransports\terminateprocess-buffer.exe' reported: 2019/07/11 09:07:47 listening on 127.0.0.1:62511
7/11/19, 09:07:47.954 [NOTICE] Bootstrapped 1% (conn_pt): Connecting to pluggable transport
7/11/19, 09:07:47.957 [NOTICE] Bootstrapped 2% (conn_done_pt): Connected to pluggable transport
7/11/19, 09:07:47.957 [NOTICE] Bootstrapped 10% (conn_done): Connected to a relay
7/11/19, 09:07:57.191 [NOTICE] Bootstrapped 14% (handshake): Handshaking with a relay
7/11/19, 09:08:02.731 [NOTICE] Bootstrapped 15% (handshake_done): Handshake with a relay done
7/11/19, 09:08:02.733 [NOTICE] Bootstrapped 20% (onehop_create): Establishing an encrypted directory connection
7/11/19, 09:08:09.500 [NOTICE] Bootstrapped 25% (requesting_status): Asking for networkstatus consensus
7/11/19, 09:08:09.918 [NOTICE] Delaying directory fetches: No running bridges
7/11/19, 09:08:15.383 [NOTICE] Bootstrapped 30% (loading_status): Loading networkstatus consensus
7/11/19, 09:08:33.529 [WARN] Refusing to apply consensus diff because the base consensus doesn't match the digest as found in the consensus diff header.
7/11/19, 09:08:33.529 [WARN] Expected: 76E018869D8B463A6F60A8D9E8E212AFC7AC0F178B91E9FE00C48745A02C5866; found: BF36C88874750FE072CB06CA3DC52494BEEF53624BBCDD2F82B4323191A078D0
7/11/19, 09:08:33.529 [WARN] Could not apply consensus diff received from server '0.0.2.0:2'
7/11/19, 09:09:09.460 [WARN] Refusing to apply consensus diff because the base consensus doesn't match the digest as found in the consensus diff header.
7/11/19, 09:09:09.461 [WARN] Expected: 76E018869D8B463A6F60A8D9E8E212AFC7AC0F178B91E9FE00C48745A02C5866; found: BF36C88874750FE072CB06CA3DC52494BEEF53624BBCDD2F82B4323191A078D0
7/11/19, 09:09:09.461 [WARN] Could not apply consensus diff received from server '0.0.2.0:2'
7/11/19, 09:09:09.461 [WARN] Refusing to apply consensus diff because the base consensus doesn't match the digest as found in the consensus diff header.
7/11/19, 09:09:09.461 [WARN] Expected: 76E018869D8B463A6F60A8D9E8E212AFC7AC0F178B91E9FE00C48745A02C5866; found: BF36C88874750FE072CB06CA3DC52494BEEF53624BBCDD2F82B4323191A078D0
7/11/19, 09:09:09.461 [WARN] Could not apply consensus diff received from server '0.0.2.0:2'
7/11/19, 09:09:38.240 [WARN] Refusing to apply consensus diff because the base consensus doesn't match the digest as found in the consensus diff header.
7/11/19, 09:09:38.240 [WARN] Expected: 76E018869D8B463A6F60A8D9E8E212AFC7AC0F178B91E9FE00C48745A02C5866; found: BF36C88874750FE072CB06CA3DC52494BEEF53624BBCDD2F82B4323191A078D0
7/11/19, 09:09:38.241 [WARN] Could not apply consensus diff received from server '0.0.2.0:2'
7/11/19, 09:09:38.730 [WARN] Refusing to apply consensus diff because the base consensus doesn't match the digest as found in the consensus diff header.
7/11/19, 09:09:38.732 [WARN] Expected: 76E018869D8B463A6F60A8D9E8E212AFC7AC0F178B91E9FE00C48745A02C5866; found: BF36C88874750FE072CB06CA3DC52494BEEF53624BBCDD2F82B4323191A078D0
7/11/19, 09:09:38.732 [WARN] Could not apply consensus diff received from server '0.0.2.0:2'
7/11/19, 09:10:11.889 [WARN] Refusing to apply consensus diff because the base consensus doesn't match the digest as found in the consensus diff header.
7/11/19, 09:10:11.889 [WARN] Expected: 76E018869D8B463A6F60A8D9E8E212AFC7AC0F178B91E9FE00C48745A02C5866; found: BF36C88874750FE072CB06CA3DC52494BEEF53624BBCDD2F82B4323191A078D0
7/11/19, 09:10:11.889 [WARN] Could not apply consensus diff received from server '0.0.2.0:2'
7/11/19, 09:10:12.389 [WARN] Refusing to apply consensus diff because the base consensus doesn't match the digest as found in the consensus diff header.
7/11/19, 09:10:12.390 [WARN] Expected: 76E018869D8B463A6F60A8D9E8E212AFC7AC0F178B91E9FE00C48745A02C5866; found: BF36C88874750FE072CB06CA3DC52494BEEF53624BBCDD2F82B4323191A078D0
7/11/19, 09:10:12.390 [WARN] Could not apply consensus diff received from server '0.0.2.0:2'
7/11/19, 09:10:39.942 [WARN] Refusing to apply consensus diff because the base consensus doesn't match the digest as found in the consensus diff header.
7/11/19, 09:10:39.942 [WARN] Expected: 76E018869D8B463A6F60A8D9E8E212AFC7AC0F178B91E9FE00C48745A02C5866; found: BF36C88874750FE072CB06CA3DC52494BEEF53624BBCDD2F82B4323191A078D0
7/11/19, 09:10:39.942 [WARN] Could not apply consensus diff received from server '0.0.2.0:2'
7/11/19, 09:10:39.942 [WARN] Refusing to apply consensus diff because the base consensus doesn't match the digest as found in the consensus diff header.
7/11/19, 09:10:39.942 [WARN] Expected: 76E018869D8B463A6F60A8D9E8E212AFC7AC0F178B91E9FE00C48745A02C5866; found: BF36C88874750FE072CB06CA3DC52494BEEF53624BBCDD2F82B4323191A078D0
7/11/19, 09:10:39.942 [WARN] Could not apply consensus diff received from server '0.0.2.0:2'
7/11/19, 09:11:07.939 [WARN] Refusing to apply consensus diff because the base consensus doesn't match the digest as found in the consensus diff header.
7/11/19, 09:11:07.940 [WARN] Expected: 76E018869D8B463A6F60A8D9E8E212AFC7AC0F178B91E9FE00C48745A02C5866; found: BF36C88874750FE072CB06CA3DC52494BEEF53624BBCDD2F82B4323191A078D0
7/11/19, 09:11:07.940 [WARN] Could not apply consensus diff received from server '0.0.2.0:2'
7/11/19, 09:11:08.459 [WARN] Refusing to apply consensus diff because the base consensus doesn't match the digest as found in the consensus diff header.
7/11/19, 09:11:08.459 [WARN] Expected: 76E018869D8B463A6F60A8D9E8E212AFC7AC0F178B91E9FE00C48745A02C5866; found: BF36C88874750FE072CB06CA3DC52494BEEF53624BBCDD2F82B4323191A078D0
7/11/19, 09:11:08.459 [WARN] Could not apply consensus diff received from server '0.0.2.0:2'
7/11/19, 09:11:29.281 [WARN] Refusing to apply consensus diff because the base consensus doesn't match the digest as found in the consensus diff header.
7/11/19, 09:11:29.281 [WARN] Expected: 76E018869D8B463A6F60A8D9E8E212AFC7AC0F178B91E9FE00C48745A02C5866; found: BF36C88874750FE072CB06CA3DC52494BEEF53624BBCDD2F82B4323191A078D0
7/11/19, 09:11:29.281 [WARN] Could not apply consensus diff received from server '0.0.2.0:2'
7/11/19, 09:12:02.446 [WARN] Refusing to apply consensus diff because the base consensus doesn't match the digest as found in the consensus diff header.
7/11/19, 09:12:02.446 [WARN] Expected: 76E018869D8B463A6F60A8D9E8E212AFC7AC0F178B91E9FE00C48745A02C5866; found: BF36C88874750FE072CB06CA3DC52494BEEF53624BBCDD2F82B4323191A078D0
7/11/19, 09:12:02.446 [WARN] Could not apply consensus diff received from server '0.0.2.0:2'
7/11/19, 09:12:02.447 [WARN] Refusing to apply consensus diff because the base consensus doesn't match the digest as found in the consensus diff header.
7/11/19, 09:12:02.447 [WARN] Expected: 76E018869D8B463A6F60A8D9E8E212AFC7AC0F178B91E9FE00C48745A02C5866; found: BF36C88874750FE072CB06CA3DC52494BEEF53624BBCDD2F82B4323191A078D0
7/11/19, 09:12:02.447 [WARN] Could not apply consensus diff received from server '0.0.2.0:2'

This is the message I got when going to youtube without signing in because google was taking forever and will not sign me in...I am using the updated tor 9.0.a4

Our systems have detected unusual traffic from your computer network. Please try your request again later. Why did this happen?

This page appears when Google automatically detects requests coming from your computer network which appear to be in violation of the Terms of Service. The block will expire shortly after those requests stop.

This traffic may have been sent by malicious software, a browser plug-in, or a script that sends automated requests. If you share your network connection, ask your administrator for help — a different computer using the same IP address may be responsible. Learn more

Sometimes you may see this page if you are using advanced terms that robots are known to use, or sending requests very quickly.

Is their a bug ?
Tor Browser 8.5.4 updated July 9 2019
Every time i visit ' YouTube ' In the address bar, i have grey lock with an orange triangle. Mixed content is not blocked not secure. I have to reload each page to have HTTPS Green Secure Connection. Before this latest update, their was always a green lock for a fully secure page. I never had to keep reloading the same page.

Could you give me steps to reproduce your problem starting from a clean, new Tor Browser 8.5.4? On which operating system are you on? Do you have modified Tor Browser in any way?

There is an unwanted whitespace (border or frame) in the tab viewing area that surrounds all the pages. Get rid of it!

Latest update to TOR Browser breaks or blocks .onion version of pirate bay. I started up TOR Browser this morning, and went to http://uj3wazyk5u4hnvtk.onion/. I surfed through a couple of pages before I noticed the “blinking” onion warning me that there was an update. I clicked it and clicked check for updates and then restarted my computer.

When I restarted TOR Browser, I saw a popup stating that the updates were being applied (update to 9.0a4). When it finally started, I tried to go back to http://uj3wazyk5u4hnvtk.onion/ and this time I get the message that “The connection has timed out.” I checked another .onion site, https://3g2upl4pq6kufc4m.onion/ (which is the duckduckgo search engine) and it is working fine.

My guess is that TOR Browser is now actively blocking TPB’s onion site since it was working just prior to the update and has not worked since then.

If this is true, (and I hope I'm wrong) I have to say I don't think Tor should be in the business of censorship in any way shape or fashion. It goes against everything that I thought Tor stood for - namely freedom of expression in the face of censorship.

If I'm wrong, then I apologize, but it's very suspicious at the very least and someone who knows the inner workings of Tor should look into it to keep its reputation intact.

There is no Pirate Bay blocking by Tor Browser. No need to apologize, I guess the onion service just was or still is offline.

The sites are up for me on TBB 8.5.4. Must've been the site was down. Some onions often go offline or throttle traffic or become victims of DoS or something. TBB restricts features not domains although exit nodes can, but onion traffic doesn't exit the network.

hello
Tor project is the best
i wanna report a problem
when you remove " obfs3 " in new update, i have a real problem in loading pages!
" obfs3 " were so fast , and obfs4 is so secure(but slow)
let any body to choice what kind of condition is required
please give back "obfs3"

obfs3 is no longer recommended because, most of all, it doesn't resist active probing:

"The basic obfs3 protocol is completely vulnerable to active probing, as the client has zero requirements to prove that it knows that the server accepts obfs3 connections. This approach is currently used by the Chinese state firewall to censor obfs3 Bridges, and anecdotal evidence suggests that the delayed probing results in connections to previously unknown obfs3 bridges being terminated after approximately 10 minutes."

thank you for all the work you have put into this new version.. so far everything works great. no problems or anything.
i notice it starts up a lot faster and i dont get the log page . i'm not sure if this is good or bad..
i would like to see canvas data extraction and share scree blocked by default rather than always ask.. just makes me feel better i hate surprises and looking up and seeing a share screen icon is a surprise i don't really want ..

Thanks for the information.

Hi. In new version: The site is not shown on the entire area of the browser window. There are empty spaces and unnecessary scroll. See an example.
How to disable it? I think this is probably VERY necessary protection( :) ), but I would prefer to turn it off. May I?
https://i110.fastpic.ru/big/2019/0713/d2/d092cec03bb23d87f278e705699334…

privacy.letterboxing.enabled in your about:config is your friend. And, surely may you, it is your browser. :) (If not, then this would be a bug)

hey when you go to show site information , show connection details, more information , and permissions icon open it up i'm not so happy with some of the default settings.. the extract canvas is set to (always ask) by default , and the (share screen) is the same . if you uncheck the default and check the (block) circle on both it just goes right back to default when you go to a different website. i would like those 2 settings to stay at block unless i want to use them.. i hate surprises.. the other thing tor won't run in a sandbox broke the sandbox everytime ..
great job guy really that is the only problem i have run across that could be considered a bug with 9.4..

Which sandbox tool are you using?

I'm using the latest version of TOR to log on to my Wordpress blog.
However, Wordpress recently recognizes my PC, rendering TOR completely transparent.
Previously, when I visited the blog without logging on, it was counted as a unique visit each time. But that is no longer the case.
How do I hide my ID from Wordpress again?

Between visits, close the browser or click the onion icon -> New Identity (warning: closes tabs). You are experiencing a form of browser fingerprinting. When you close Tor Browser or start a New Identity, your cookies are removed, preferences by default are reset to default values, and tor creates a new circuit giving you a different public exit node IP address.

How do I know that I’m navigating on tor, the download says successful but how can I be sure?

You could network forensic tools like Wireshark and monitor your traffic to be extra sure.

I'm using Android
There's no way to click a file and "save as" .
Also no way to see version or Tor with help/about, only gives Firefox info.
Other than those 2 things it works great. Thanks

Thanks! Yeah, we have two bugs open for those issues but did not have time to fix them (not sure if your first item actually matches the first bug below, though):

https://trac.torproject.org/projects/tor/ticket/31013
https://trac.torproject.org/projects/tor/ticket/30943

a week ago suddenly
I can't open site: http://nyaa.si via tor
Can you help me?

Not really. If the site owner does not like Tor anymore they can easily block it. Please reach out to them to get this fixed. Thanks.

(Not op) I went to ask them. Here's what they said. Tor Project, your outreach team should read it.

Join the discussion...

We encourage respectful, on-topic comments. Comments that violate our Code of Conduct will be deleted. Off-topic comments may be deleted at the discretion of the post moderator. Please do not comment as a way to receive support or report bugs on a post unrelated to a release. If you are looking for support, please see our ​support portal or ways to get in touch with us.

This question is for testing whether or not you are a human visitor and to prevent automated spam submissions.

1 + 8 =
Solve this simple math problem and enter the result. E.g. for 1+3, enter 4.