Tor Browser Bundle 3.5 is released

Update 12/20: Test builds of Pluggable Transport bundles are now available. See inline and see the FAQ link for more details.

The 2.x stable series of the Tor Browser Bundle has officially been deprecated, and all users are encouraged to upgrade to the 3.5 series.

Packages are now available from the Tor download page as well as the Tor Package archive.

For now, the Pluggable Transports-capable TBB is still a separate package, maintained by David Fifield. Download them here: https://people.torproject.org/~dcf/pt-bundle/3.5-pt20131217/. We hope to have combined packages available in a beta soon.

For people already using TBB 3.5rc1, the changes are not substantial, and are included below.

However, for users of TBB 2.x and 3.0, this release includes important security updates to Firefox. All users are strongly encouraged to update immediately, as we will not be making further releases in the 2.x or 3.0 series.

In terms of user-facing changes from TBB 2.x, the 3.x series primarily features the replacement of Vidalia with a Firefox-based Tor controller called Tor Launcher. This has resulted in a vast decrease in startup times, and a vast increase in usability. We have also begun work on an FAQ page to handle common questions arising from this transition -- where Vidalia went, how to disable JavaScript, how to check signatures, etc.

The complete changelog for the 3.x series describes the changes since 2.x.

The set of changes since the 3.5rc1 release is:

All Platforms
- Update Tor to 0.2.4.19
- Update Tor Launcher to 0.2.4.2
  - Bug 10382: Fix a Tor Launcher hang on TBB exit
- Update Torbutton to 1.6.5.2
  - Misc: Switch update download URL back to download-easy

Please try not to confuse

Please try not to confuse Java*Script* with Java.

Thanks.

The censored users - MUST

The censored users
- MUST see the Tor circuits,
- MAKE SURE the excluded country nodes are not in the circuits, and
- SEE the Tor ststus/error messages.
Without Vidalia this is all taken away. Do you suppose now we need to blindly trust everything and always? Or we need to dig in the files to return Vidalia manually?

OK, Vidalia is bad (per mentioned above FAQ), but please develop a modern informative substitute. Come on.

It's in the works -- faster

It's in the works -- faster if you help.

In the mean time, feel free to use the standalone Vidalia workaround.

Thank you for all your hard

Thank you for all your hard work.

Looks like

Looks like https://trac.torproject.org/projects/tor/ticket/10444

With 3.5 the message "Tor

With 3.5 the message "Tor unexpectedly exited" appears when adding to torrc
SocksPort 127.0.0.1:9999
Or any address and port.

Also, TorBrowser crashes on exit when setting in options
"Show my windows and tabs..."

And when re-opened, it of course does not set the window size properly if the size has been altered before closing. Is this intended behaviour?

For the SocksPort part, that

For the SocksPort part, that looks like https://trac.torproject.org/projects/tor/ticket/10447

If you can repeat the Tor Browser crash, please open a ticket about it at bugs.torproject.org. Thanks!

Javascript is enabled by

Javascript is enabled by default.

Quote: "We configure NoScript to allow JavaScript by default in the Tor Browser Bundle because many websites will not work with JavaScript disabled."

Okay fine, what happened to the option to shut it off, its not longer under content.
Wtf is going on?

Alas, Mozilla decided to

Alas, Mozilla decided to remove that option in Firefox 24. Here's the recommended fix:

https://trac.torproject.org/projects/tor/wiki/doc/TorBrowserBundle3FAQ#…

Why is there no longer an

Why is there no longer an option and no mention of the removal of enabling/disabling javascript from FF options? Also, "allow scripts globally" is enabled by default in noscript.

https://trac.torproject.org/p

https://trac.torproject.org/projects/tor/wiki/doc/TorBrowserBundle3FAQ#…

https://www.torproject.org/docs/faq#TBBJavaScriptEnabled

Just like to say thanks for

Just like to say thanks for the new bundles - in particular the stand alone Vidalia. I too had a few problems with the two missing dlls but I managed to locate them in the previous Tor bundle and put them in my System32 folder.

Now everything works fine.

Thanks again.

Tor Browser

Tor Browser 3.5-MacOS
Javascript is on by default, with no obvious way to it turn off.

Why has the option been removed from preferences, and where has it been moved to?

Also, may I please have a link to *correct* article(s) on Javascript and cookies when using tor. There is much to much conflicting information out there.

https://trac.torproject.org/p

https://trac.torproject.org/projects/tor/wiki/doc/TorBrowserBundle3FAQ#…
is the short answer.

As for correct articles, the story is alas complex and changing.

I recommend
https://www.torproject.org/projects/torbrowser/design/
and
https://www.torproject.org/torbutton/en/design/
as good reading.

In all the previous TBB

In all the previous TBB versions Javascript needed to be manually disabled.

I'm no techie so I ask Is Javascript now permanently disabled in TBB 3.5 - otherwise how would I go about doing this please.

TIA

https://trac.torproject.org/p

https://trac.torproject.org/projects/tor/wiki/doc/TorBrowserBundle3FAQ#…

TBB-3.5 not started without

TBB-3.5 not started without tor from TBB. To use transparent torification with Linux system tor, first remove tor-browser_en-US/Data/Browser/profile.default/extensions/tor-launcher@torproject.org.xpi,
then go to Torbutton preferences and select "Transparent Torification (Requires custom transproxy or Tor router)". Press OK and restart TBB.

How do you turn off

How do you turn off Javascript in tor browser and why is it on by default? I have heard many bad things about Java. please advise

https://trac.torproject.org/p

https://trac.torproject.org/projects/tor/wiki/doc/TorBrowserBundle3FAQ#…

Also, be sure not to confuse Java (generally a really bad idea) with JavaScript (not a particularly good idea either, but sure does break a lot of websites if you disable it).

It is more accurate to state

It is more accurate to state that many websites break themselves by relying on javascript, and expecting visitors to enable js to fix the defective website.
Proper website design requires testing the site then adding frills such as js later.

that is correct

vidalia is more user

vidalia is more user friendly that new tor launcher

the new version might be

the new version might be good for pro. users but i'm afraid it's not user friendly and isn't easy to me to set it up! i have no idea abt the information it wants me to enter! setting proxies?! is my isp open for tor servers or not?! are you kidding? how could a non-professional user could know these? i hope "tor" could be as helpful as always again :)

Please help us make it

Please help us make it easier.

What make you click 'configure' rather than 'connect' on the opening page?

you are absolutely right

you are absolutely right man! I've gone to the wrong direction. today i tried again and i must correct what i said yesterday (in the comment above) and apologize for that of course :)
the new Tor software is really great! faster and lighter than older ones and i have nothing to say but thank you "Tor" guys for making a way for us to connect to the web securely; specially in Iran that you have no idea about the largeness of its filtering system formed by the gov.!

How to disable javascript in

How to disable javascript in TBB 3.5?

https://trac.torproject.org/p

https://trac.torproject.org/projects/tor/wiki/doc/TorBrowserBundle3FAQ#…

This new version doesn't

This new version doesn't start and always tells me Firefox is already running, but I don't even have Firefox installed.....

Fun. What version, what OS,

Fun. What version, what OS, how are you installing it, etc?

Well, the 3.5 Version of

Well, the 3.5 Version of Tor.
I'm using Windows 8 and installed it normally into program files.
I'm starting the Tor exe then and get this weird error message.

Any Windows 8 users have any

Any Windows 8 users have any hints here?

I have seen this behavior

I have seen this behavior with firefox in other versions and other platforms (when firefox is closed ten reopen attempted. It seems firefox doesn't always close cleanly. Check task manager and close any instances of firefox and try launching again. In Linux the "kilall firefox" command always does the trick.

Yeah, but I don't have FF

Yeah, but I don't have FF installed. xD
Well, but I feel stupid know. I got around the problem by just opening Tor as an administrator. I only didn't thought of that because the error was me directing in a totally different direction.

Ah ha. I bet if you unpack

Ah ha. I bet if you unpack TBB into some directory that you have permissions to, you won't have to run it as administrator. (Doing that seems wiser all-around.)

Why is there no safe,

Why is there no safe, separate, zip file to extract and run apart from my regular installation? I'm not going to run an installer, I want everything separate and with no changes applied to my main machine!

Actually, the installer just

Actually, the installer just sticks stuff in a self-contained directory, just like unzip did.

I've opened https://trac.torproject.org/projects/tor/ticket/10452 as a central point of discussion on making things clearer. Please help!

WTF ? We've gone back to

WTF ? We've gone back to days of installers ?????

How does TBB 3.5 install on OS X? It's not gonna ask me for username/password is it ? It used to be just a zip you unpacked then a file you dragged to /Applications/

Do you know what ? I really think a lot of bad design decisions have been made with 3.5, they are just plucked out of thin air and undermine trust in the product. And trust is critical here. You can't make this kind of software just from the point of what works for devs mechanically, and I wonder anyone is learning this by now.

No, the OS X one is still

No, the OS X one is still just a zip file.

We only added the installer for Windows users, because they were the ones we consistently saw unpacking it wrong.

Why is the new Tor asking

Why is the new Tor asking for a file in my user folder called "geoip6"?

Sounds like

Sounds like https://trac.torproject.org/projects/tor/ticket/10425

why the new bundle exe file

why the new bundle exe file and not a zip file ?

See above discussion

See above discussion pointing to https://trac.torproject.org/projects/tor/ticket/10452

Thanks!

"But smart users don't

"But smart users don't *know* that that's all it's doing. We should a) make it clearer in the installer text itself that TBB remains self-contained in just the directory they specify, and b) make it clearer on the download webpage when they're fetching it."

smart users don't want to be infected by some shit by exit-node (fake exe)

Well, this is why you must

Well, this is why you must check the signature on the thing you download, whether that thing is a zip or an exe.

If you're worried about getting a fake Tor bundle, and you're happy with a zip file but not happy with an exe installer, but inside the zip file is an exe file that you'll happily run... you're doing it wrong.

All of that said, checking signatures in Windows is horrible. Maybe somebody here will write up some better instructions on how to do it more easily?

To make it easier for the

To make it easier for the NSA to inject virus into the exe files some (not all) people download.

New version is bad. Can't

New version is bad. Can't use it to log into ebay. Downloads don't show in download tabs.

I don't know about the ebay

I don't know about the ebay part (works for me? ebay is blocking logins from some Tor exits?), but the second issue is because this is Firefox 24 not Firefox 17. Firefox 17 is unmaintained now. Sorry you're railroaded into a newer browser, but Mozilla hasn't left people much choice.