New Release: Tor Browser 8.0.4

Tor Browser 8.0.4 is now available from the Tor Browser Project page and also from our distribution directory.

This release features important security updates to Firefox.

Tor Browser 8.0.4 contains updates to Tor (0.3.4.9), OpenSSL (1.0.2q) and other bundle components. Additionally, we backported a number of patches from our alpha series where they got some baking time. The most important ones are

  • a defense against protocol handler enumeration which should enhance our fingerprinting resistance,
  • enabling Stylo for macOS users by bypassing a reproducibility issue caused by Rust compilation and
  • setting back the sandboxing level to 5 on Windows (the Firefox default), after working around some Tor Launcher interference causing a broken Tor Browser experience.

Moreover, we ship an updated donation banner for our year-end donation campaign.

The full changelog since Tor Browser 8.0.3 is:

  • All platforms
    • Update Firefox to 60.4.0esr
    • Update Tor to 0.3.4.9
    • Update OpenSSL to 1.0.2q
    • Update Torbutton to 2.0.9
      • Bug 28540: Use new text for 2018 donation banner
      • Bug 28515: Use en-US for english Torbutton strings
      • Translations update
    • Update HTTPS Everywhere to 2018.10.31
    • Update NoScript to 10.2.0
    • Bug 1623: Block protocol handler enumeration (backport of fix for #680300)
    • Bug 25794: Disable pointer events
    • Bug 28608: Disable background HTTP response throttling
    • Bug 28185: Add smallerRichard to Tor Browser
  • Windows
    • Bug 26381: about:tor page does not load on first start on Windows
    • Bug 28657: Remove broken FTE bridge from Tor Browser
  • OS X
    • Bug 26475: Fix Stylo related reproducibility issue
    • Bug 26263: App icon positioned incorrectly in macOS DMG installer window
  • Linux
    • Bug 26475: Fix Stylo related reproducibility issue
    • Bug 28657: Remove broken FTE bridge from Tor Browser
  • Build System
    • All Platforms
      • Bug 27218: Generate multiple Tor Browser bundles in parallel
Anonymous

December 15, 2018

Permalink

Security / anonymity bug?
Go to some site with graphics ( I have tested only images on Instagram )
Click "i" icon
Go to "Show connection details" ( right arrow > )
Then click "More Information"
Select "Media" tab
Double click on an image
Standard Firefox runs and starts connection to some service ( google ? ).
This version of TBB on x64 Linux ( with standard Firefox installed as default browser, obviously ).

Anonymous

December 15, 2018

Permalink

Just got the TOR browser updated to 8.0.4 and nothing works and I mean nothing. Get message that there is an error and that is all with the "restart browser" which then just comes back with the same. Windows 8 OS.

Anonymous

December 16, 2018

Permalink

Im sorry to say but i cannot access any website on this new version of tor I've tried the usual uninstall /reinstall but the problem persists. I've been using since 7.5 and have never experienced this issue. Please look into it thanks.

Anonymous

December 16, 2018

Permalink

Why has the Torbrowser project, for several iterations now, deliberately sabotaged their NoScript plugin to automatically forget NoScript settings and subject users to massive script exposure without them being aware of it? By simply reinstalling NoScript from the official NoScipt site, this issue goes away; ergo, this is sabotage coming from within the Tor project itself. We've heard the lame excuses so far (NoScipt settings allow fingerprinting; silly nubes not liking their websites not working out of the box, etc.) and yet the problem persists...

You can test the alpha release where we implemented this option. (You have to flip a pref to activate it, though). It will be available in the next major stable, Tor Browser 8.5, or earlier if we think we should backport it.

Is this new with this version of Tor Browser? If not do you know when this started? On which operating system does this happen (and which version of it)? Do you get an error message when the crash happens? Which language has your Tor Browser you downloaded?

Anonymous

December 16, 2018

Permalink

NoScript is so bad now, and so pointless, I always uninstall it and use ScriptSafe instead. Its the only way to get rid of NoScript's self-defeating settings, which now have all scripts on by default, ignores your own settings, and ignores your own whitelists. What's the point of it anymore. Probably not safe to uninstall, but its soooo bad that it's now useless from a user's point of view. Sort NoScript out. Make it remember settings. Make sure it switches most scripts off by default. Like it was. Otherwise I and many others will keep on uninstalling it and replacing it regardless of the techy consequences.

Anonymous

December 17, 2018

Permalink

after the update no .onion link will work as duckduckgo says "You are trying to reach an onion/hidden service. (link) via web you will have to use the Tor Browser" wheni am using the tor browser this has completely ruined tor for me any suggestions?

Anonymous

December 18, 2018

Permalink

Greetings,

I have recently upgraded my os from windows xp sp3 to windows 7 pro (64). In this process I copied the tor browser directory in its entirety to the windows 7 disk which was the tor build based on firefox 52.9.0. Tor fired up as usual and performed fine. I used it several times and let it upgrade to 8.0.3 (32 bit). Again all was well. A day or so later I updated to 8.0.4 (64)

The first time it ran I got a window about choosing running in a censored area or not. I chose 'continue'. The tor connection screen came up for a time and the firefox window loaded but in a very small size with no tor related buttons. It would not accept text input. I closed it down. After a minute or so a window opened saying tor.exe had stopped. After a time I tried it again. The tor connection screen did not load and again the firefox window was very small. I did a fresh install of 8.0.4 (32) which did the same thing.

What I think I'm seeing is that the tor related modules are not loading or are damaged. The following are the windows error messages I'm seeing:

[TORBROWSER-INSTALL-WIN64-8.0.4_EN-US.EXE]
Problem signature:
Problem Event Name: APPCRASH
Application Name: firefox.exe
Application Version: 60.4.0.6609
Application Timestamp: 00000000
Fault Module Name: xul.dll
Fault Module Version: 60.4.0.6609
Fault Module Timestamp: 00000000
Exception Code: c0000005
Exception Offset: 00000000029efb10
OS Version: 6.1.7601.2.1.0.256.48
Locale ID: 1033
Additional Information 1: e41f
Additional Information 2: e41fefa4070dd5768c6bd4c2e727562d
Additional Information 3: 01dd
Additional Information 4: 01dd2105e69f9c2f62c308c990b32510

Running depends gives me this:
"System can not these files on the system"
API-MS-WIN-CORE-WINRT-ERROR-L1-1-0.DLL
API-MS-WIN-CORE-WINRT-L1-1-0.DLL
API-MS-WIN-CORE-WINRT-ROBUFFER-L1-1-0.DLL
API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL
DCOMP.DLL
IESHIMS.DLL

I can confirm that these files are not on the win 7 os disk. I've googled this and found several 'solutions' (which did not work) but no definition as to why this situation should exist. Oh, and the three files listed in the dependicies.txt are all the same build as the firefox.exe.

So, I have a tor setup that does not work. I'd appreciate some thoughts. I'm going to go back to a 32 bit setup before 8.0.3 until it will work again.

TIA

Okay, so 8.0.3 32bit and 64bit are working on your computer but 8.0.4 is crashing? Have you tried installing a fresh 8.0.4 on a different location, not using your old profile to check whether the issue might be located there?

Well I'm not going to get very far with this! I can not find tor browser 7.6. It is not in the archive directories. I need to get back to the older firefox esr. Do you have any old installers online before 8.? Need some help here.

Anonymous

December 22, 2018

Permalink

Hello. First time here (and first time joining a blog). So the question may be far too simple for the experts. I've just installed this release. Once clicking on the Tor onion allowed to see the circuit/relays. Is that feature still available? If positive where is it now? thanks

Anonymous

December 23, 2018

Permalink

I have a new MacBook Pro, and I had Tor up and running, but after the new software update and the the tor update, it will no longer run. I have tried uninstalling and reinstalling Tor on my computer to no avail. What am I doing wrong?

Anonymous

December 24, 2018

Permalink

Strange thing happened. When on blog.torproject.org, NoScript switched ITSELF from default/blocked to (temporarily) trusted.

Anonymous

December 28, 2018

Permalink

Beginning with upgrading to tor browser 8.0, a warning about having javascript enabled flashes up for a brief moment when visiting http://dreadditevelidot.onion, despite having the security slider set to safest. Is this a general bug in Tor Browser/NoScript, like having javascript enabled for a short time before being blocked (couldn't find anything related to this on your bug tracker, or better: Nothing I could relate to this, which is not necessarily the same), or just a problem with the website itself?

Implementation of the warning:

Warning!
You have JavaScript enabled, you are putting yourself at risk!
Please disable it immediately!

.jsWarning { display: none !important; }

Yes, every time straight after bypassing the chapter, same when clicking on a thread there, visiting a different sub, changing to the next site or whatever..

It's not my personal problem either, and I'm flat out stunned that it worked for you, there are several threads about this issue over there:
http://dreadditevelidot.onion/post/1def1de2bdde152b2a0d
http://dreadditevelidot.onion/post/da8125d0bb936e7e6b7a
http://dreadditevelidot.onion/post/70cd3127de06e831e179
http://dreadditevelidot.onion/post/5c1fcd0539a3a5484eb3
http://dreadditevelidot.onion/post/4be277ae5aa98048062d
to name just a few of them.

I don't care too much about the forum itself, I'm more interested to know whether this is a bug in noscript/tor browser which should be addressed.

I'm on linux as well and run tor browser without any modification.

Also, sorry for not using codeblocks in my previous comment, the formatting got messed up completely - that's definitely not the way the warning is implemented as you might have guessed.

Thank you!
For what it's worth it: The issue stays the same when using regular Firefox routed through tor with noscript enabled. Disabling javascript in about:config however will get rid of the warning, in Tor Browser as much as in regular Firefox.

Disregard my last two comments, I saw the outcome on trac.

Thank you very much for reassuring that this is purely a cosmetic thing rather than a weakness in NoScript/Torbutton! Also thanks to ma1 for the detailed explanation.

Anonymous

December 30, 2018

Permalink

Windows 10, Tor Browser 8.04, I get no bookmarks toolbar visible. I can add bookmarks and go to them by clicking on bookmarks and then navigating to my favorites folder.

Join the discussion...

This question is for testing whether or not you are a human visitor and to prevent automated spam submissions.

4 + 0 =
Solve this simple math problem and enter the result. E.g. for 1+3, enter 4.