New Release: Tor Browser 9.0a4

by boklm | July 09, 2019

Tor Browser 9.0a4 is now available from the Tor Browser Alpha download page and also from our distribution directory.

Note: this is an alpha release, an experimental version for users who want to help us test new features. For everyone else, we recommend downloading the latest stable release instead.

This release features important security updates to Firefox.

Tor Browser 9.0a4 contains updates to a number of bundle parts, most importantly Firefox (60.8.0esr) and Tor (0.4.1.3-alpha).

In our ongoing efforts to reach more users with Tor Browser, we include native Macedonian bundles for the first time and ship Tor Browser for the aarch64 architecture on mobile (note: the aarch64 build is not currently available on Google Play. You can however download it from our distribution directory, along with its signature). Additionally, we have implemented fixes for accessibility support on Windows systems (big thanks to Richard Pospesel for the hard work here), which now deserve a wider testing. Finally, letterboxing is now being enabled by default. Please give it a try if you can, so we can iron out bugs before we ship it to all users starting with Tor Browser 9.

Similarly to the stable series we include a fundraising banner to help us getting more donations. Please donate if you can!

The full changelog since Tor Browser 9.0a3 is:

  • All platforms
    • Update Firefox to 60.8.0esr
    • Update Torbutton to 2.2.1
    • Update Tor Launcher to 0.2.19.2
      • Bug 30468: Add mk locale
      • Translations update
    • Update HTTPS Everywhere to 2019.6.27
    • Bug 31055+31058: Remove four default bridges
    • Bug 30849: Backport fixes for Mozilla's bug 1552627 and 1549833
  • Windows + OS X + Linux
  • Windows
    • Bug 27503: Provide full support for accessibility tools
    • Bug 30575: Don't allow enterprise policies in Tor Browser
  • OS X
    • Bug 30631: Blurry Tor Browser icon on macOS app switcher
  • Android
Tags
tor browser
tbb
tbb-9.0
khled.8@hotmai.com

PGP (not verified) said:

July 17, 2019

Permalink

RED ALERT

Tor Project's certificate is poisoned.

https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f

For a specific example, take a look at the Tor Project signing key:

$ apt-key adv --recv-keys --keyserver keys.gnupg.net 886DDD89
gpg: requesting key 886DDD89 from hkp server keys.gnupg.net
gpg: packet(13) too large
gpg: read_block: read_error: invalid packet
gpg: Total number processed: 0
gpg: no valid OpenPGP data found.

This SKS keyserver poisoning is going to destroy the entire PGP system:

https://www.gentoo.org/news/2019/07/03/sks-key-poisoning.html

Impact of SKS keyserver poisoning on Gentoo (Jul 3, 2019)

The SKS keyserver network has been a victim of certificate poisoning attack lately. The OpenPGP verification used for repository syncing is protected against the attack. However, our users can be affected when using GnuPG directly. In this post, we would like to shortly summarize what the attack is, what we did to protect Gentoo against it and what can you do to protect your system.

khled.8@hotmai.com

Anonymous (not verified) said:

July 17, 2019

Permalink

Will Tor Project give users any advice on how to verify future releases of Tor Browser without breaking their GPG keyring? See the posts by RJH and DKG at their blogs on the keyspamming attacks on themselves and on Tor Project.

khled.8@hotmai.com

Anonymous (not verified) said:

July 18, 2019

Permalink

Hi!
What did you do with view of comments at this bolg? They become look ugly and unreadable.
(Tor Browser 8.5.4 Win7 32bit)
WTF???

beautiful

Letterboxing is random size per page load? It guess it should be, but it seems fixed?

Tor Browser (8.5.4) has become unusable for me, because it crashes after a while and also crashes my entire system (no mouse or keyboard input possible anymore). My system is Arch Linux with XFCE. Never had this problem before, have been using Tor Browser for years.

Is that reproducible? If so, what would be good steps for us to do so? Do the older Tor Browser versions that used to run on your system still run on the current one? (see: https://archive.torproject.org/tor-package-archive/torbrowser/ for older versions)

how to use tor browser

See: https://tb-manual.torproject.org/ for our manual. Hope it helps.

The brige generator https://bridges.torproject.org/, does not generate any bridges for fte

Could be that no one is currently running FTE bridges, hence there are none to actually give out.

Default Moat on default Windows 10:

[07-23 04:57:10] TorLauncher WARN: meek client stderr: 2019/07/23 04:57:10 running firefox command ["C:\\Tor Browser\\Browser\\firefox.exe" "--invisible" "-no-remote" "-profile" "C:\\Tor Browser\\Browser\\TorBrowser\\Data\\Browser\\profile.moat-http-helper"]

[07-23 04:57:10] TorLauncher WARN: meek client stderr: 2019/07/23 04:57:10 firefox started with pid 14832

[07-23 04:57:12] TorLauncher WARN: meek client stderr: 2019/07/23 04:57:12 running meek-client command ["TorBrowser\\Tor\\PluggableTransports\\meek-client.exe" "--helper" "127.0.0.1:50861"]

[07-23 04:57:13] TorLauncher WARN: meek client stderr: 2019/07/23 04:57:13 meek-client started with pid 4896

[07-23 04:57:13] TorLauncher WARN: meek client stderr: 2019/07/23 04:57:13 using helper on 127.0.0.1:50861

[07-23 04:57:13] TorLauncher WARN: meek client stderr: 2019/07/23 04:57:13 listening on 127.0.0.1:50862

[07-23 04:57:20] TorLauncher WARN: meek client stderr: 2019/07/23 04:57:20 status code was 500, not 200; trying again after 30 seconds (9)

[07-23 04:57:50] TorLauncher WARN: meek client stderr: 2019/07/23 04:57:50 error reading from local: EOF

Moat is still unusable (Tor is broken):

Tor NOTICE: Switching to guard context "bridges" (was using "default")
Tor NOTICE: Delaying directory fetches: No running bridges
Tor WARN: Pluggable Transport process terminated with status code 0 [07-23 05:03:36] Torbutton NOTE: no SOCKS credentials found for current document.
Tor NOTICE: new bridge descriptor 'Unnamed' (fresh): $F06791B59DDE6C8554C51B2DEE18FEF89AC94400~Unnamed at 87.102.15.216
Tor NOTICE: Our directory information is no longer up-to-date enough to build circuits: We're missing descriptors for 1/2 of our primary entry guards (total microdescriptors: 6328/6328).
Tor WARN: Proxy Client: unable to connect to 95.105.140.52:33189 ("general SOCKS server failure")
Tor WARN: Proxy Client: unable to connect to 187.37.97.217:40353 ("general SOCKS server failure")
[07-23 05:04:01] Torbutton NOTE: no SOCKS credentials found for current document.
Tor NOTICE: Application request when we haven't used client functionality lately. Optimistically trying known bridges again.

Hello!

Our phones must stop being gadgets spying on us!

"Stealth mode" for mobile phones.

When this mode is activated, the phone does not receive or send any signals.
Police mode and all such things should be turned off.

This mode can also be added to smart watches, heart rate monitors, cars, etc.

And it will help sell new models of smartphones.
But I doubt that Apple and other IT-companies will stop cooperating with the state.
Most likely the stealth mode in their phones will be incomplete.

That poisoned keys are the reason GET-TOR has stopped working? Apparently, gettor@torproject.org doesn't respond to e-mails from the CarNET web-mail (and it should, since I am not asking for bridges, but for download links).

"HELL YEAH" I'll say "THANK YOU" better believe it, you guys pored heart, mind, soul, blood, sweat & tears,into this upgraded version of tor,,, it seems to be sportier model it fly's through the internet or, outernet (yeah i know "Inter" "enter") I digress, wear was I? OH!! "all the nets out there" super fast! Thank you very much & best wishes

Hello,

since I have download the torbrowser on this site, I have two trojanes on my pc. Is it possible that the filous (agents/police), from france works secretly in your community and did this ?

C:\Users\Benutzername\Downloads\torbrowser-install-win64-8.5.3_de.exe: Win.Malware.Nymeria-6913499-0 FOUND

C:\Windows\System32\SearchIndexer.exe: [Win.Trojan.Agent-7015311-0] FALSE POSITIVE FOUND

Win.Malware.Nymeria-6913499-0 in torbrowser-install-win64-8.5.4_en-US.exe found!

NoScript detected a potential Cross-Site Scripting attack

from https://www.comss.ru to https://disqus.com.

Suspicious data:

Error: Exceeded 20000ms timeout,(URL)

The tor-project is infiltrated by secret service agents! I found this malware here on site and my comment is not published!
C:\Users\Benutzername\Downloads\torbrowser-install-win64-8.5.3_de.exe: Win.Malware.Nymeria-6913499-0 FOUND
Each forum that does not publish the comments instantly, makes censorship because they works for ouer enemies!

Please calm down. There is no one censoring your posts here, just devs that are overloaded. That said: what you found is likely either a false positive of your antivirus program or some infection you got from somewhere else. Do you download the .exe files from our website and check that you actually got what you downloaded?

When something wrong happens with tor, it stalls loading tpo in Tor Browser and changes guard node after some time. But there's no reason to do that: tpo is ok, net is ok, guard is ok - https://metrics.torproject.org/rs.html#details/E37724D8AD87B149EAD2F3DF…
The only thing it logs to console is:
Tor NOTICE: We tried for 15 seconds to connect to '[scrubbed]' using exit $9C5AFD49AAE4E0272BAD780C6DD71CE1A36012A6~coffswifi4 at 82.223.14.245. Retrying on a new circuit.
which is a bad notice.

Tor is still able to be fingerprinted according to https://www.nothingprivate.ml/
Why is this and is it getting fixed?

What result do you get? And how can I reproduce that?

i try to disable proxy (orbot?) on launch brouser but it back it everytime after restart.
i dont have a root so i cant delete this pluguin in extensions folder. i want use it as general brouser but more "clear".
if devs read this, please fix this problem that we have possible to disable orbot with about:config and it not back into "1" after restart

What are you trying to do? There is no Orbot or Tor Launcher shipped with Tor Browser for Android. I guess you mean https://trac.torproject.org/projects/tor/ticket/28786?

A fresh install of Ubuntu is unable to run Tor Browser from the repositories because of the SKS key poisoning attack. Don't you think the Tor team should have a blog post on this detailing an official work around? This is very bad.

Not sure what you mean are you downloading Tor Browser from our website and you run into the problem? Or are you using torbrowser-launcher? The latter is not supported by the Tor Project.

Join the discussion...

We encourage respectful, on-topic comments. Comments that violate our Code of Conduct will be deleted. Off-topic comments may be deleted at the discretion of the post moderator. Please do not comment as a way to receive support or report bugs on a post unrelated to a release. If you are looking for support, please see our ​support portal or ways to get in touch with us.

About text formats
CAPTCHA

This question is for testing whether or not you are a human visitor and to prevent automated spam submissions.

8 + 5 =
Solve this simple math problem and enter the result. E.g. for 1+3, enter 4.