New Release: Tor Browser 9.0a8

Tor Browser 9.0a8 is now available from the Tor Browser Alpha download page and also from our distribution directory.

Note: this is an alpha release, an experimental version for users who want to help us test new features. For everyone else, we recommend downloading the latest stable release instead.

This is the last alpha release before the first stable release in the 9.0 series, which is planned for next week. It contains various fixes and improvements. Among them, we added a New Identity button to the toolbar, we included Tor network settings into about:preferences, we fixed the App menu items on macOS, and we solved the issue which made the Android build non-reproducible.

Known issue:

While building this release and checking that the build is reproducible, we found that our linux32 and macOS bundles did not match. However this seems to be an intermittent issue, as triggering a rebuild caused our builds to match. We are currently investigating the issue.

If you find any issue with this release, please help us by reporting them so we can fix as much as we can before the first stable release based on ESR68, which is planned for next week, October 22.

The full changelog since Tor Browser 9.0a7 is:

All Platforms
- Bug 13543: Spoof smooth and powerEfficient for Media Capabilities
- Bug 28196: about:preferences is not properly translated anymore
- Bug 19417: Disable asmjs on safer and safest security levels
- Bug 30463: Explicitly disable MOZ_TELEMETRY_REPORTING
- Bug 31935: Disable profile downgrade protection
- Bug 31811: Backport fix for bug 1554805
- Bug 16285: Disable DRM/EME on Android and drop Adobe CDM
- Bug 31602: Remove Pocket indicators in UI and disable it
- Bug 31914: Fix eslint linter error
- Translations update
Windows + OS X + Linux
- Update Tor to 0.4.2.2-alpha
- Update Tor Launcher to 0.2.19.5
  - Bug 31286: New strings for about:preferences#tor
  - Translations update
- Bug 31286: Provide network settings on about:preferences#tor
- Bug 31886: Fix ko bundle bustage
- Bug 31768: Update onboarding for Tor Browser 9
- Bug 27511: Add new identity button to toolbar
- Bug 31778: Support dark-theme for the Circuit Display UI
- Bug 31910: Replace meek_lite with meek in circuit display
- Bug 30504: Deal with New Identity related browser console errors
- Bug 31929: Don't escape DTD entity in ar
- Bug 31747: Some onboarding UI is always shown in English
- Bug 32041: Replace = with real hamburguer icon ≡
Windows
- Bug 31942: Re-enable signature check for language packs
- Bug 29013: Enable stack protection for Firefox on Windows
OS X
- Bug 31607: App menu items stop working on macOS
- Bug 31955: On macOS avoid throwing inside nonBrowserWindowStartup()
Linux
- Bug 31942: Re-enable signature check for language packs
- Bug 31968: Don't fail if /proc/cpuinfo is not readable
- Bug 24755: Stop using a heredoc in start-tor-browser
- Bug 31550: Put curly quotes inside single quotes
Android
- Bug 31822: Security slider is not really visible on Android anymore
Build System
- All Platforms
  - Bug 31293: Make sure the lo interface inside the containers is up
- Windows
  - Bug 29013: Enable stack protection support for Firefox on Windows
- Android
  - Bug 31564: Make Android bundles based on ESR 68 reproducible
  - Bug 31981: Remove require-api.patch
  - Bug 31979: TOPL: Sort dependency list
  - Bug 30665: Remove unnecessary build patches for Firefox

One Tor Browser quirk that's…

One Tor Browser quirk that's been quite annoying for the past few major releases is the way it interacts with dconf database on GNU/Linux. It seem this is because Tor Browser runs with only "partially" modified HOME environment variable which results in strange behavior.

It does not to read the values from the user's dconf database, which is of course how it should be. Because it can't find such database under modified HOME, the values used are the defaults. This is expected behavior. Yet at the same time it somehow manages to write these default values to user's dconf database under original HOME nonetheless. In effect, this results in user's dconf values (which are used outside of Tor Browser by other programs) being continuously reset by Tor Browser to defaults.

One noticeably example is the file dialog in Tor Browser (GTK3 FileChooser) which resets org.gtk.Settings.FileChooser values. In practice this means GTK3 file dialog is reset to its default behavior in all other programs that use it. For example, the window size of the dialog maxes out.

Another way to confirm this is by copying ~/.config/dconf/user to Browser/.config/dconf/user. What happens is that Tor Browser now reads values from this copied file and thus does not use default values, but it still writes values to the first original file in original HOME instead of the second one in modified HOME. So to reiterate, it reads (or tries to read) dconf values from the modified HOME, but then writes them to the original HOME. And for some things like the file dialog above this write operation is performed just by opening the dialog without actually doing anything with it.

Now in this narrow case of dconf this can all legitimately be dismissed as upstream's inconsistent use of the HOME variable. However in the long run I think a better approach should be developed that more thoroughly modifies and isolates the environment that Tor Browser runs in. I know there were some abandoned sandboxing attempts in the past, however even a dumb approach like using a "chroot jail" would be better in the meantime than the current situation.

What would you suggest as an isolation of Tor Browser that we can setup ourselves?

I've been experimenting with…

I've been experimenting with apparmor profiles from torbrowser-launcher, adding rules to explicitly deny read/write access to ~/.config/dconf. But Tor Browser still writes to those files. It seems GTK3 stuff is being done in some other process.

So I've decided to go with the completely opposite approach by just creating a Browser/.config/dconf -> ~/.config/dconf symlink. This removes the problem with Tor Browser resetting user's GTK3 values, I just don't know if this is potentially de-anonymizing. If not you might add this symlink to your linux releases.

I guess that's related to…

I guess that's related to https://trac.torproject.org/projects/tor/ticket/27903. What we'd need here is someone writing a proper patch (it could be you!) and testing it. It won't bubble up on our ToDo list anytime, soon, alas.

The symlink only fixes the…

The symlink only fixes the issue in the 8.5 release, I'm sorry. In this alpha the symlink has no effect, the problem remains. Or maybe it has nothing to do with versions themselves but with some other conditions, it's hard to tell what gtk settings daemon is actually doing.

Anyway, the root of the issue seems to be an inconsistent environment: HOME variable is changed, but that's not enough. I'm not sure there's any portable way to enforce Browser/ as a home directory. Hypothetically one could use some chroot hacks, but that's probably too specific to each user's system.

The new icon for new…

The new icon for new identity projects an image of something being merely cleaned or cleared. What's missing is the idea of restarting the session, that is to say, as if Tor Browser itself restarted. The fact that all existing windows actually close and a new fresh window opens is a great way of signalling that, it gives the user the feeling that they started completely afresh in a new session. (Which is why the fact that windows close and open on newnym should not be "fixed" because it's too "brusque", it's a good UX feature.)

The old icon, despite its shortcomings (e.g. can be mistaken for the "reload page" icon), nevertheless had this advantage because the spin/circle arrow symbolized restarting of the session. It also fit somewhat nicely with the "New Tor Circuit" icon (Tor onion with the spin arrow) whereas the broom icon doesn't fit in very well with the rest of icons, it doesn't seem to be TBB-related.

Maybe you could base the new icon on a flat version of the TBB icon itself (half-open onion). I think just adding a plus emblem or a reload spin arrow to the half-open onion could work very well given the fact that TBB windows will actually close and a new window will appear, as if TBB itself has restarted afresh. The icon would more clearly signify what happens before being used the first time, and the user would more easily make the intuitive association on subsequent uses.

I'm more inclined towards the spin arrow though, because the plus emblem symbolizes an addition to the current state, whereas the spin arrow is more directly associated with restarting or reloading something i.e. the previous thing gets discarded and replaced by a new one in its stead.

Recent Updates

New Release: Tor Browser 9.0.1

Tor Browser 9.0.1 is now available from the Tor Browser download page and also from our

A better internet is possible. I’ve seen it.

Surveillance, censorship, and tracking run rampant online.

Take Back the Internet with Us

You understand the importance of online privacy.

New Alpha Release: Tor 0.4.2.3-alpha

There's a new alpha release available for download. If you build Tor from source, you can download the source code for 0.4.2.3-alpha from the download page on the website. Packages should be available over the coming weeks, with a new alpha Tor Browser release in a couple of weeks.

Remember, this is an alpha release: you should only run this if you'd like to find and report more bugs than usual.

This release fixes several bugs from the previous alpha release, and from earlier versions of Tor.

Changes in version 0.4.2.3-alpha - 2019-10-24

Major bugfixes (relay):
- Relays now respect their AccountingMax bandwidth again. When relays entered "soft" hibernation (which typically starts when we've hit 90% of our AccountingMax), we had stopped checking whether we should enter hard hibernation. Soft hibernation refuses new connections and new circuits, but the existing circuits can continue, meaning that relays could have exceeded their configured AccountingMax. Fixes bug 32108; bugfix on 0.4.0.1-alpha.
Major bugfixes (v3 onion services):
- Onion services now always use the exact number of intro points configured with the HiddenServiceNumIntroductionPoints option (or fewer if nodes are excluded). Before, a service could sometimes pick more intro points than configured. Fixes bug 31548; bugfix on 0.3.2.1-alpha.