New Release: Tor Browser 9.0a4

Tor Browser 9.0a4 is now available from the Tor Browser Alpha download page and also from our distribution directory.
Note: this is an alpha release, an experimental version for users who want to help us test new features. For everyone else, we recommend downloading the latest stable release instead.
This release features important security updates to Firefox.
Tor Browser 9.0a4 contains updates to a number of bundle parts, most importantly Firefox (60.8.0esr) and Tor (0.4.1.3-alpha).
In our ongoing efforts to reach more users with Tor Browser, we include native Macedonian bundles for the first time and ship Tor Browser for the aarch64 architecture on mobile (note: the aarch64 build is not currently available on Google Play. You can however download it from our distribution directory, along with its signature). Additionally, we have implemented fixes for accessibility support on Windows systems (big thanks to Richard Pospesel for the hard work here), which now deserve a wider testing. Finally, letterboxing is now being enabled by default. Please give it a try if you can, so we can iron out bugs before we ship it to all users starting with Tor Browser 9.
Similarly to the stable series we include a fundraising banner to help us getting more donations. Please donate if you can!
The full changelog since Tor Browser 9.0a3 is:
- All platforms
- Windows + OS X + Linux
- Windows
- OS X
- Bug 30631: Blurry Tor Browser icon on macOS app switcher
- Android
- Bug 28119: Tor Browser for aarch64
Wow, that's really sad to…
Wow, that's really sad to read. Sorry for that experience. I fear outreach won't help here much, though. :(
RED ALERT Tor Project's…
RED ALERT
Tor Project's certificate is poisoned.
https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f
For a specific example, take a look at the Tor Project signing key:
$ apt-key adv --recv-keys --keyserver keys.gnupg.net 886DDD89
gpg: requesting key 886DDD89 from hkp server keys.gnupg.net
gpg: packet(13) too large
gpg: read_block: read_error: invalid packet
gpg: Total number processed: 0
gpg: no valid OpenPGP data found.
This SKS keyserver poisoning is going to destroy the entire PGP system:
https://www.gentoo.org/news/2019/07/03/sks-key-poisoning.html
Impact of SKS keyserver poisoning on Gentoo (Jul 3, 2019)
The SKS keyserver network has been a victim of certificate poisoning attack lately. The OpenPGP verification used for repository syncing is protected against the attack. However, our users can be affected when using GnuPG directly. In this post, we would like to shortly summarize what the attack is, what we did to protect Gentoo against it and what can you do to protect your system.
Good key copies not poisoned…
Good key copies not poisoned:
0xEE8CBC9E886DDD89
0x4E2C6E8793298290
Is this why GET-TOR appears…
Is this why GET-TOR appears to have stopped working? You apparently can't get links for downloading TOR by email, at least if you use the CarNET web-mail.
Will Tor Project give users…
Will Tor Project give users any advice on how to verify future releases of Tor Browser without breaking their GPG keyring? See the posts by RJH and DKG at their blogs on the keyspamming attacks on themselves and on Tor Project.
Key from Torproject…
Key from Torproject/Torbrowser in the TAILS keyring would be a clever way for users interested in security?
Hi! What did you do with…
Hi!
What did you do with view of comments at this bolg? They become look ugly and unreadable.
(Tor Browser 8.5.4 Win7 32bit)
WTF???
We fixed Drupal security…
We fixed Drupal security issues which in turn messed with our blog layout. See: https://trac.torproject.org/projects/tor/ticket/31114.
beautiful
beautiful
Letterboxing is random size…
Letterboxing is random size per page load? It guess it should be, but it seems fixed?
Tor Browser has lately…
Tor Browser (8.5.4) has become unusable for me, because it crashes after a while and also crashes my entire system (no mouse or keyboard input possible anymore). My system is Arch Linux with XFCE. Never had this problem before, have been using Tor Browser for years.
Is that reproducible? If so,…
Is that reproducible? If so, what would be good steps for us to do so? Do the older Tor Browser versions that used to run on your system still run on the current one? (see: https://archive.torproject.org/tor-package-archive/torbrowser/ for older versions)
how to use tor browser
how to use tor browser
See: https://tb-manual…
See: https://tb-manual.torproject.org/ for our manual. Hope it helps.
The brige generator https:/…
The brige generator https://bridges.torproject.org/, does not generate any bridges for fte
Could be that no one is…
Could be that no one is currently running FTE bridges, hence there are none to actually give out.
Default Moat on default…
Default Moat on default Windows 10:
[07-23 04:57:10] TorLauncher WARN: meek client stderr: 2019/07/23 04:57:10 running firefox command ["C:\\Tor Browser\\Browser\\firefox.exe" "--invisible" "-no-remote" "-profile" "C:\\Tor Browser\\Browser\\TorBrowser\\Data\\Browser\\profile.moat-http-helper"]
[07-23 04:57:10] TorLauncher WARN: meek client stderr: 2019/07/23 04:57:10 firefox started with pid 14832
[07-23 04:57:12] TorLauncher WARN: meek client stderr: 2019/07/23 04:57:12 running meek-client command ["TorBrowser\\Tor\\PluggableTransports\\meek-client.exe" "--helper" "127.0.0.1:50861"]
[07-23 04:57:13] TorLauncher WARN: meek client stderr: 2019/07/23 04:57:13 meek-client started with pid 4896
[07-23 04:57:13] TorLauncher WARN: meek client stderr: 2019/07/23 04:57:13 using helper on 127.0.0.1:50861
[07-23 04:57:13] TorLauncher WARN: meek client stderr: 2019/07/23 04:57:13 listening on 127.0.0.1:50862
[07-23 04:57:20] TorLauncher WARN: meek client stderr: 2019/07/23 04:57:20 status code was 500, not 200; trying again after 30 seconds (9)
[07-23 04:57:50] TorLauncher WARN: meek client stderr: 2019/07/23 04:57:50 error reading from local: EOF
Moat is still unusable (Tor…
Moat is still unusable (Tor is broken):
Tor NOTICE: Switching to guard context "bridges" (was using "default")
Tor NOTICE: Delaying directory fetches: No running bridges
Tor WARN: Pluggable Transport process terminated with status code 0 [07-23 05:03:36] Torbutton NOTE: no SOCKS credentials found for current document.
Tor NOTICE: new bridge descriptor 'Unnamed' (fresh): $XXX~Unnamed at XX.XX.XX.XX
Tor NOTICE: Our directory information is no longer up-to-date enough to build circuits: We're missing descriptors for 1/2 of our primary entry guards (total microdescriptors: 6328/6328).
Tor WARN: Proxy Client: unable to connect to XX.XX.XX.XX:33189 ("general SOCKS server failure")
Tor WARN: Proxy Client: unable to connect to XX.XX.XX.X:40353 ("general SOCKS server failure")
[07-23 05:04:01] Torbutton NOTE: no SOCKS credentials found for current document.
Tor NOTICE: Application request when we haven't used client functionality lately. Optimistically trying known bridges again.
Moderators, please redact…
Moderators, please redact the bridge fingerprint (unhashed) and 3 IP addresses from the "Moat" comment. OP, please keep information that identifies a bridge except its hashed fingerprint a secret.
Hello! Our phones must stop…
Hello!
Our phones must stop being gadgets spying on us!
"Stealth mode" for mobile phones.
When this mode is activated, the phone does not receive or send any signals.
Police mode and all such things should be turned off.
This mode can also be added to smart watches, heart rate monitors, cars, etc.
And it will help sell new models of smartphones.
But I doubt that Apple and other IT-companies will stop cooperating with the state.
Most likely the stealth mode in their phones will be incomplete.
That poisoned keys are the…
That poisoned keys are the reason GET-TOR has stopped working? Apparently, gettor@torproject.org doesn't respond to e-mails from the CarNET web-mail (and it should, since I am not asking for bridges, but for download links).
"HELL YEAH" I'll say "THANK…
"HELL YEAH" I'll say "THANK YOU" better believe it, you guys pored heart, mind, soul, blood, sweat & tears,into this upgraded version of tor,,, it seems to be sportier model it fly's through the internet or, outernet (yeah i know "Inter" "enter") I digress, wear was I? OH!! "all the nets out there" super fast! Thank you very much & best wishes
Hello, since I have…
Hello,
since I have download the torbrowser on this site, I have two trojanes on my pc. Is it possible that the filous (agents/police), from france works secretly in your community and did this ?
C:\Users\Benutzername\Downloads\torbrowser-install-win64-8.5.3_de.exe: Win.Malware.Nymeria-6913499-0 FOUND
C:\Windows\System32\SearchIndexer.exe: [Win.Trojan.Agent-7015311-0] FALSE POSITIVE FOUND
Win.Malware.Nymeria-6913499…
Win.Malware.Nymeria-6913499-0 in torbrowser-install-win64-8.5.4_en-US.exe found!
NoScript detected a…
NoScript detected a potential Cross-Site Scripting attack
from https://www.comss.ru to https://disqus.com.
Suspicious data:
Error: Exceeded 20000ms timeout,(URL)
The tor-project is…
The tor-project is infiltrated by secret service agents! I found this malware here on site and my comment is not published!
C:\Users\Benutzername\Downloads\torbrowser-install-win64-8.5.3_de.exe: Win.Malware.Nymeria-6913499-0 FOUND
Each forum that does not publish the comments instantly, makes censorship because they works for ouer enemies!
Please calm down. There is…
Please calm down. There is no one censoring your posts here, just devs that are overloaded. That said: what you found is likely either a false positive of your antivirus program or some infection you got from somewhere else. Do you download the .exe files from our website and check that you actually got what you downloaded?
> Do you check that you…
> Do you check that you actually got what you downloaded?
Hard to do in the wake of certificate flooding. Your answer about false positives or third-party infection should be followed by "How can I verify Tor Browser's signature?" and substitute 0x4E2C6E8793298290 that isn't flooded. Then, reinstall the verified exe and "My antivirus or malware protection is blocking me from accessing Tor Browser."
When something wrong happens…
When something wrong happens with tor, it stalls loading tpo in Tor Browser and changes guard node after some time. But there's no reason to do that: tpo is ok, net is ok, guard is ok - https://metrics.torproject.org/rs.html#details/E37724D8AD87B149EAD2F3DF…
The only thing it logs to console is:
Tor NOTICE: We tried for 15 seconds to connect to '[scrubbed]' using exit $9C5AFD49AAE4E0272BAD780C6DD71CE1A36012A6~coffswifi4 at 82.223.14.245. Retrying on a new circuit.
which is a bad notice.
You said it changes the…
You said it changes the guard node, but your log says it changed the circuit and exit node. Tor is supposed to change exit nodes every 10 minutes if the circuit is idle. Tor is not supposed to change your guard node until months have passed. Are you sure the IP address of your guard node in the circuit display panel is changing?
Tor is still able to be…
Tor is still able to be fingerprinted according to https://www.nothingprivate.ml/
Why is this and is it getting fixed?
What result do you get? And…
What result do you get? And how can I reproduce that?
i try to disable torLauncher…
i try to disable proxy (orbot?) on launch brouser but it back it everytime after restart.
i dont have a root so i cant delete this pluguin in extensions folder. i want use it as general brouser but more "clear".
if devs read this, please fix this problem that we have possible to disable orbot with about:config and it not back into "1" after restart
What are you trying to do?…
What are you trying to do? There is no Orbot or Tor Launcher shipped with Tor Browser for Android. I guess you mean https://trac.torproject.org/projects/tor/ticket/28786?
A fresh install of Ubuntu is…
A fresh install of Ubuntu is unable to run Tor Browser from the repositories because of the SKS key poisoning attack. Don't you think the Tor team should have a blog post on this detailing an official work around? This is very bad.
Not sure what you mean are…
Not sure what you mean are you downloading Tor Browser from our website and you run into the problem? Or are you using torbrowser-launcher
? The latter is not supported by the Tor Project.
For the Debian/Ubuntu…
For the Debian/Ubuntu repository, follow these instructions. As it says, a minimal copy of the key is on deb.torproject.org.
Good copies:
0xEE8CBC9E886DDD89
0x4E2C6E8793298290
In alpha versions 9.a03 - 9…
In alpha versions 9.a03 - 9.a05 android there is a problem posing a threat!
Description of the problem:
I am going through authorization, logging in to the account, I am on the site, closing the page past the "exit" button; After closing the page, I clear the browser cache. I go back to the site, the following happens: I see that I am logging in to my account without authorization. This means that the browser cache is not completely cleared, which can in some cases pose a serious threat.
How are you clearing the…
How are you clearing the browser cache? What happens if you make sure Tor Browser is not running anymore on your device and restart it?
There is a option to enable…
There is a option to enable DNS over HTTPS and add DoH resolvers in Firefox 62 and later which seems to be not available in this Tor version though its based on Firefox 68.
First, Tor, tor, and Tor…
First, Tor, tor, and Tor Browser are all different things. Capital Tor is the network of volunteer relays. Lowercase tor is the small "expert" binary (exe) configured using a torrc file. The Tor Browser Bundle comes in a large installer containing tor and the Tor Browser based on Firefox ESR.
Second, "this Tor (Browser) version" is not "based on Firefox 68". The post you replied to says, "Update Firefox to 60.8.0esr".
Third, DoH is controversial. Understand it before enabling it.
Hi, it seems to crash on…
Hi, it seems to crash on MacOS catalina on start. Makes it a bit further than the stable 8.5.4 release and asks to reopen windows or not and crashes right after.
Process: firefox [1002]
Path: /Applications/Tor Browser.app/Contents/MacOS/firefox
Identifier: org.torproject.torbrowser
Version: 9.0a4 (6019.4.1)
Code Type: X86-64 (Native)
Parent Process: ??? [1]
Responsible: firefox [1002]
User ID: 501
Date/Time: 2019-08-12 19:46:59.798 -0400
OS Version: Mac OS X 10.15 (19A526h)
Report Version: 12
Bridge OS Version: 3.0 (14Y904)
Anonymous UUID: EC1D2359-242C-7D12-66A8-232AC60E0C2F
Time Awake Since Boot: 760 seconds
System Integrity Protection: enabled
Crashed Thread: 0 Dispatch queue: com.apple.main-thread
Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: EXC_I386_GPFLT
Exception Note: EXC_CORPSE_NOTIFY
Termination Signal: Segmentation fault: 11
Termination Reason: Namespace SIGNAL, Code 0xb
Terminating Process: exc handler [1002]
That's a macOS bug, see:…
That's a macOS bug, see: https://trac.torproject.org/projects/tor/ticket/31316. Should be fixed in the next macOS beta.
i cant find a.proper version…
i cant find a.proper version o TOR browser for my tablet running windows 8.1 32bit. What can i do
On the download page, the…
On the download page, the first installers you see in the purple circles are 64 bit. You need the 32 bit version. Under the circles, click "Download in another language or platform." On that page, find your language, and click "32-bit". If that doesn't help, reply with details of the problem.
For other help, read the Tor Browser User Manual, Support FAQ, old General FAQ, and old documentation overview.
Can anyone help me With…
Can anyone help me With joining?? ive been trying to get on all day and for some reason its not allowing it. ive downloaded a bunch of different browsers, all end up in the same result..
Tor Project controls the…
Tor Project controls the torproject.org domain. If you are trying to access another domain, ask the webmasters of that domain. Search for a service that checks if a site is down for everyone or if it's just you.
Hi tor, just letting you…
Hi tor, just letting you know that when I go to a local news site it won't allow me to access, it says that am from another country and gives a phone number to call locally..also one other website says too much traffic is coming from my pc when I use the tor browser.
The Tor network consists of…
The Tor network consists of relay servers operated by volunteer users around the world. Your local copy of tor chooses circuits through the network and exit relays that connect your traffic to the normal internet. When your traffic exits the network, it appears to come from the location of the exit node which can be in another country. To see your circuit for a site, click on the padlock or circled "i" icon in the address bar.
General FAQ:
(Not op) I went to ask them…
(Not op) I went to ask them. Here's what they said. Tor Project, your outreach team should read it.