New Release: Tor Browser 8.5a11

by boklm | April 16, 2019

Tor Browser 8.5a11 is now available from the Tor Browser Alpha download page and also from our distribution directory.

Note: this is an alpha release: an experimental version for users who want to help us test new features. For everyone else, we recommend downloading the latest stable release instead.

This new alpha release includes some bug fixes and improvements. Among other things, on the desktop side we improved the browser toolbar layout, replaced the security slider with a toolbar icon and added mechanisms to introduce new features to users. We also improved the screen reader accessibility on Windows and added the es-AR locale.

On the Android side, we started using the Tor Onion Proxy Library.

The full changelog since Tor Browser 8.5a10 is:

  • All platforms
    • Update Torbutton to 2.1.6
      • Bug 22538+22513: Fix new circuit button for error pages
      • Bug 29825: Intelligently add new Security Level button to taskbar
      • Bug 29903: No WebGL click-to-play on the standard security level
      • Bug 27484: Improve navigation within onboarding (strings)
      • Bug 29768: Introduce new features to users (strings)
      • Bug 29943: Use locales in AB-CD scheme to match Mozilla
      • Bug 26498: Add locale: es-AR
      • Bug 29973: Remove remaining stopOpenSecuritySettingsObserver() pieces
      • Translations update
    • Update NoScript to 10.6.1
      • Bug 29872: XSS popup with DuckDuckGo search on about:tor
    • Bug 29916: Make sure enterprise policies are disabled
    • Bug 26498: Add locale: es-AR
  • Windows + OS X + Linux
    • Update Tor to 0.4.0.4-rc
    • Update Tor Launcher to 0.2.18.2
      • Bug 26498: Add locale es-AR
      • Translations update
    • Bug 29768: Introduce new features to users
    • Bug 27484: Improve navigation within onboarding
    • Bug 25658: Improve toolbar layout for new security settings
  • Windows
    • Bug 27503: Improve screen reader accessibility
  • Android
    • Bug 27609 (and child bugs): Use Tor Onion Proxy Library
    • Bug 29312: Bump Tor to 0.3.5.8
    • Bug 29859: Disable HLS support for now
    • Bug 28622: Update Tor Browser icon for mobile
    • Bug 29238: Prevent crash on Android after update
    • Bug 29982: Add additional safe guards against crashes during bootstrap
    • Bug 29906: Fix crash on older devices due to missing API
    • Bug 29858: Load onboarding panels after bootstrapping is done
    • Bug 28329: Improve bootstrapping experience
    • Bug 30016: Localize bootstrap-/bridge-related strings for mobile
  • Build System
    • All platforms
      • Bug 29868: Fix installation of python-future package
      • Bug 25623: Disable network during build
    • Linux
      • Bug 29966: Use archive.debian.org for Wheezy images
    • Android
      • Bug 30089: Use apksigner instead of jarsigner
Tags
tor browser
tbb
tbb-8.5
Anon

Lo (not verified) said:

April 23, 2019

Permalink

I did the latest Update for the TOR browser, now I cannot log into my proton mail account, it just spins and spins, then says "another page is making it slow", when I do not have anything else open. It is so frustrating, I need to get into my email. I have uninstalled and reinstalled 2 times, still the same issues. ???

Protonmail loads an entire encrypted interface in your browser using Javascript. Click "Wait" a few times. If it doesn't eventually complete, try lowering your security slider. Onion icon -> Security Settings.

Anon

Anonymous (not verified) said:

April 25, 2019

Permalink

Hello,
the last Tor Browser release for Android has not been uploaded yet on F-Droid. Is Tor Project relying on Guardian Project's repo? Or do you have your own and I missed something?

Cheers

Anon

randomguyorgirl (not verified) said:

April 25, 2019

Permalink

torbrowser currently unusable, suspect italian guard node is deliberately sabotaging traffic by restricting it to a trickle of bytes

Verify the guard's "Advertised Bandwidth" value and History graphs of bytes-per-second on the Tor Metrics Relay Search. See the old contact page for instructions to contact Tor Project about security issues or bad relays.

When I start the installation of English (en) - 32-bit (https://www.torproject.org/dist/torbrowser/8.0.8/torbrowser-install-8.0…), it asks to choose between 2 languages ONLY (Arabic and Persian) although I clearly choose the English version, and the file indicates that it is an en_US version. It does the same when I choose the Arabic version, it asks to choose between the 2 same languages. I realize that it is reading the region and languages that I have installed, but It's very inconvenient for me cause I want to install it in English. Please look into this as I can't update to that version (or any new version if it keeps doing that) until that issue is fixed, thanks for your efforts.

It should show you quite a bunch of locales, regardless of your region (although it might make an educated guess and offer you one as the first option based on your desktop environment).

That said this is quite puzzling and you are the first one reporting this behavior. Some questions:

1) Does this happen with the 64-bit version as well (I hope you can run that one)?
2) Does it happen with older versions, too? If not with all older versions, could you pinpoint the one where this behavior started? You can find older versions here: https://archive.torproject.org/tor-package-archive/torbrowser/.

Thanks for your reply gk,

No, it only shows those 2 languages only (Arabic and Persian), I do speak Arabic and my locale is set to Arabic, but I don't know Persian, so I would understand that Arabic is given as a choice, but why Persian and not English?

To answer your questions:

1- I did download the 64-bit version, but not installed it yet as I don't use it much, this is happening on the 32-bit system which I use 24/7, and it shouldn't because as I pointed out it is the En_US version that I chose to download 1st, when that issue happened, I tried the Arabic version thinking maybe the files are cross-linked by error, but it gave me the same 2 languages choices.

2- I currently have version 8.0.3 installed and running fine in English, I haven't downloaded any versions between that and 8.0.8, so I will try to install the versions in between and reply to you.

Thanks, really appreciated. Regarding the 64-bit version: no need to install it if you need, just click on the installer and start it to see whether the locale issue is the same as with the 32-bit bundle or not.

Ok, this issue is only happening with all the 32-bit versions, even with v 8.0.1 which I still have, only those 2 languages options are given, this is new and weird since I installed 8.0.1, 8.0.2, and 8.0.3 before in English, but now all 32-bit versions only shows those 2 languages options.

On the 64-bit system, they give me all the languages options, and I just upgraded from 8.0.3 to 8.0.8 in English, so I ran the 32-bit installer on the 64-bit system to see what happens, and it does the same thing, only those 2 languages are given which is puzzling!

I'm scratching my head to what is causing this issue on the 32-bit versions (on both systems), and why now when there were a lot of languages options before!

Did you try to reproduce that issue on your end? Is the same issue happening, or is it just me?

It can't just be my systems, since it's happening on both the 32-bit and 64-bit, right?

Also, on the 64-bit system, I have noticed that when running the x64 installer (any version) it creates a *.tmp folder in the temp folder, in that *.tmp folder there are 2 file created during the installation process (langDLL.dll and system.dll).

That does NOT happen when I run the x86 versions on the x64 system.

I am sure that could be the issue, that langDLL.dll file is the key to choosing which language is chosen during installation. I need a developer to confirm this is what is causing the problem.

Thanks for your assistance.

I use Tor Brawser for Android(Alfa).Taken from the Play Store.
Works well,BUT THERE is ONE BIG PROBLEM WITH a VERY IMPORTANT WEBSITE!
All sites open fine EXCEPT ONE.
From ~50-80(!) trial downloads site,TOR comes to www.important.website only 1-2 times... And at a very slow speed. Site loading is promoted only by 10% and stands still.Then he writes: "The connection has timed out
The server at important.website is taking too long to respond.
The site could be temporarily unavailable or too busy. Try again in a few moments.
If you are unable to load any pages, check your mobile device's data or Wi-Fi connection."
This situation with the website www.important.website not only me,but ALL TOR USERS.

I tried ALL kinds of bridges,made their request on the site - it's useless.

WHAT COULD IT BE???
The reason???
What exactly is tor or the site www.important..website wrong???
Can I change something in Togh to have a normal loading of the site? Please try personally to go to www.important.website with their Togas and tell the result.
I will be grateful for any help and advice!
Thank you!

It seems the site is somehow misconfigured or blocking Tor (fwiw: i replaced it with "important.website" to not leak that information). Alas, that's nothing we can fix on our side. Please contact the owner of that website to get that resolved on their end.

> I tried ALL kinds of bridges

Websites don't see your bridge or guard node. They see your exit node. There was nothing wrong with your bridge or guard node if all other sites were opening fine. In your situation, the problem could have been either the exit node or the website. But you tried other exit nodes, so the problem is the website, not you or Tor.

https://support.torproject.org/#censorship-2
https://2019.www.torproject.org/docs/faq.html.en#GoogleCAPTCHA

It blocks HTTPS for a start

Your shitty obfs4proxy.exe doesn't exit when tor crashes, making Tor Browser unusable.

What is happening in that case? Like how does that render Tor unusable? Do you have a way to crash Tor in a reproducible fashion so that we can reproduce that bug (and investigate the Tor crashes)? If so, what are the steps for that?

Hm, maybe that's actually https://trac.torproject.org/projects/tor/ticket/21967. Or better: maybe a fix for that bug with help with the crash scenario as well...

If it fixes the problem for all platforms, it'lll be great.

Tor Launcher asks to Restart Tor, but it crashes again and again. You can crash tor.exe manually to test.

switching from built-in bridge to bridgedb doesn't work on Windows!
Tor WARN: Failed to find node for hop #1 of our path. Discarding this circuit.

What Tor Browser version is that? Is that reproducible on your system or only sometimes happening?

This version. It is reproducible, but, probably, you need to select 'This computer goes through a firewall' as well....

Are the bridges accepting connections on a port that you selected in the "firewall" option? Examine the bridge lines to find the number after the colon ":". Don't tell it to anyone.

If it isn't a configuration problem on your end, you can see if it's a problem on the bridge's end in Relay Search.

request a new bridge via bridgedb gives the same bridge every time.

Yes, that's a feature so that an attacker can't enumerate all the bridges available.

that's fine for bridgedb, but moat gives you one bridge only, and what to do if it doesn't work?

trying to connect via bridgedb's bridge ends with nothing, but:
Tor NOTICE: Application request when we haven't used client functionality lately. Optimistically trying known bridges again.

Which operating system are you on? What happens after that notice? Do you have steps to reproduce that problem? Maybe the bridge is down?

Windows 10. Nothing. If the bridge from moat is down, how to get another one?

What I am missing in TOR-browser is "middle-click-open" in Linux. (First select text and then paste it by middle-click.)

I would use it to open a link from my text-based reader. It is possible to middle-click-open by clicking the "info-icon" in front of the address bar. But where to click if there is no page open (then there is no info-icon).

I start TOR-browser using empty page and thus have no info-icon where to click.

I propose to make the big "+"-sign of new tab to be middle-clickable like it is in Opera-browser.

Middle-click paste works for me between Tor Browser and other programs, but you want middle-click open which is dangerous if done by accident. See bug ticket #10089. Developers of Mozilla Firefox patched it in Firefox in 2017.

Middle-click behaviors are configuration options between user-level programs and your OS. As far as Tor Browser goes, it's based on Firefox, so search for Firefox's preferences. Open a new tab in Tor Browser, and visit "about:config". Click "I accept the risk." In the search box there, type "middle" for example. You'll see one of the preferences named "middlemouse.paste" which is default true. Another named "middlemouse.contentLoadURL" is default false. "contentLoadURL" is the preference to open what is in your clipboard. Do web searches for these preferences for more information. To enable middle-click-open and accept its dangers, toggle "middlemouse.contentLoadURL" to "true".

Thank you for uncovering that "contentLoadURL = false" does not affect middle-clicking on the "Show site information" icon in the address bar in front of a loaded URL. Tor Browser developers, take a look at that.

Interesting. I am not sure whether we should block the "i" behavior here as well as we set the pref to "false" to prevent _accidentally_ leaking information. However, it seems to be pretty hard to accidentally hit the "i" icon and have a URL on the clipboard and middle-click. If you feel strongly, though, please open a bug (bonus points for actually opening a bug at Mozilla's bug tracker to get that on their radar).

fuckingfox CP got stuck in networking IO, ate memory till OOM and was terminated. Win 10.

Tor WARN: Failed to unlink C:\Tor Browser\Browser\TorBrowser\Data\Tor\unverified-microdesc-consensus: Permission denied

Which Windows is that? When do you see this message?

win10. saw that at startup.

Do you see that with every start?

No, only if it was previously deleted.

Okay, which Tor Browser version are you using? I suspect Tor Browser 8.5a11? If so, could you test whether you see the same problem with the current stable Tor Browser (8.0.8) downloaded from our website?

I've been unable to find the version control, or even source code for "Tor Browser for Android". I believe it is derived from MPL-licensed source code, is it not?

3.2. Distribution of Executable Form

If You distribute Covered Software in Executable Form then:

such Covered Software must also be made available in Source Code Form, as described in Section 3.1, and You must inform recipients of the Executable Form how they can obtain a copy of such Source Code Form by reasonable means in a timely manner, at a charge no more than the cost of distribution to the recipient; and

It is. We build the Firefox part for all platforms (including Android) from code in our tor-browser repository: https://gitweb.torproject.org/tor-browser.git.

still have the same issue with this release as well, the only difference is that there is no crash popup message from android, instead the tor settings page is white and torbrowser freezes. not a significant difference, I only have to terminate torbrowser manually now when its stuck in that white page.

https://trac.torproject.org/projects/tor/ticket/29982
https://blog.torproject.org/comment/280338#comment-280338 (original thread)

Could you jump on that Trac ticket and help us tracking the issue down? Otherwise I can try to give you instructions to get us the necessary info here in the thread (that has the disadvantage, though, that a lot of the devs would miss that conversation).

Why webgl is enabled by default?

Because a bunch of websites are broken without it. We have the security issues covered by the security slider and the fingerprinting issues are covered by patches/preference settings.