Pluggable transports bundles 2.4.15-beta-2-pt1 with Firefox 17.0.8esr

We've updated the Pluggable Transports Tor Browser Bundles with Firefox 17.0.8esr and Tor 0.2.4.15-beta-2. These correspond to the Tor Browser Bundle release of August 9 and contain important security fixes.

These bundles contain flash proxy and obfsproxy configured to run by default. If you want to use flash proxy, you will have to take the extra steps listed in the flash proxy howto.

These bundles contain the same hardcoded obfs2 bridge addresses as the previous bundles which may work for some jurisdictions but you are strongly advised to get new bridge addresses from BridgeDB.

These bundles are signed by David Fifield (0x5CD388E5) with this fingerprint.

Where is the FreeBSD build?

Where is the FreeBSD build? I'd really prefer to avoid using poorly and insecurely coded kernels when there are better options available.

I hear FreeBSD can run Linux

I hear FreeBSD can run Linux programs if you try hard enough.

Otherwise, the answer is "why haven't you made one for us yet?"

China here. Update works

China here. Update works fine. This is great.
Thank you very much.

can not run new plugged

can not run new plugged bridge in china

Shazam! Thank ya, thank ya,

Shazam! Thank ya, thank ya, thank ya!

What are the cool new

What are the cool new features in 2.4? ECDSA?

I just installed the OS X

I just installed the OS X version but the green onion keeps blinking, saying I should update.

I think I have witnessed the

I think I have witnessed the same behaviour on my linux machine earlier today. I downloaded it again just some minutes ago and this time I don't get the message. So my advice is to download it again, probably there was an update some hours ago.

Thank you!

From Iran: For the first

From Iran:
For the first time the connecting time for "Pluggable transports bundles 2.4.15-beta-2-pt1 with Firefox 17.0.8esr" is about 20 sec.
But the next time it length about 3 min or more.

2.4.16-beta-1 on the

2.4.16-beta-1 on the Pluggable Transports page. 2.4.15-beta-2 on the Blog page. Which one is correct?

The newer one. It has Tor

The newer one. It has Tor 0.2.4.16-rc, which is better.

It seems BridgeDB is no

It seems BridgeDB is no longer giving obfs proxy addresses?
the plain bridges work here in China... for a few minutes...
but its only giving 3 plain bridges, each repeated 3 times :P
and the obfs addresses i have from before are dying out 1 by one.

Aug xx xx:28:04.xxx [Warning] Problem bootstrapping. Stuck at 90%: Establishing a Tor circuit. (Connection timed out [WSAETIMEDOUT ]; TIMEOUT; count 20; recommendation warn)<br />
Aug xx xx:28:04.xxx [Warning] 19 connections have failed:<br />
Aug xx xx:28:04.xxx [Warning] 19 connections died in state connect()ing with SSL state (No SSL object)

Ummm which 19 exactly?

Seems there are no obfsproxy

Seems there are no obfsproxy is given in the BridgeDB, which are harder to block at least in Iran

九月 05 22:16:59.031

九月 05 22:16:59.031 [Notice] Tor v0.2.4.16-rc (git-889e9bd529297284) running on Windows XP with Libevent 2.0.21-stable and OpenSSL 1.0.0k.
九月 05 22:16:59.031 [Notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning
九月 05 22:16:59.140 [Notice] Read configuration file "C:\Proxy\tor-pluggable-transports-browser-2.4.16-beta-1-pt1_en-US\Data\Tor\torrc".
九月 05 22:16:59.140 [Notice] Opening Socks listener on 127.0.0.1:9150
九月 05 22:16:59.140 [Notice] Opening Control listener on 127.0.0.1:9151
九月 05 22:16:59.140 [Notice] Parsing GEOIP IPv4 file .\Data\Tor\geoip.
九月 05 22:16:59.359 [Notice] Parsing GEOIP IPv6 file .\Data\Tor\geoip6.
九月 05 22:17:06.015 [Notice] Bootstrapped 5%: Connecting to directory server.
九月 05 22:17:06.015 [Notice] Bootstrapped 10%: Finishing handshake with directory server.
……

九月 05 22:18:35.218 [Notice] Tor has successfully opened a circuit. Looks like client functionality is working.
九月 05 22:18:35.218 [Notice] Bootstrapped 100%: Done.
九月 05 22:18:36.859 [Warning] onion_skin_client_handshake failed.
九月 05 22:18:36.859 [Warning] circuit_finish_handshake failed.
九月 05 22:18:36.859 [Warning] connection_edge_process_relay_cell (at origin) failed.
九月 05 22:19:06.171 [Warning] onion_skin_client_handshake failed.
九月 05 22:19:06.171 [Warning] circuit_finish_handshake failed.
九月 05 22:19:06.171 [Warning] connection_edge_process_relay_cell (at origin) failed.

We need all this develpment

We need all this develpment for Chorme also.

Upcoming Events

July 13, 2020 - July 17, 2020

Privacy Enhancing Technologies Symposium (online!)

July 27, 2020 - July 31, 2020

Rightscon online

August 11, 2020 - August 18, 2020

Bornhack (DK)

August 12, 2020 - August 14, 2020

Walking Onions @ USENIX Security Symposium '20

See All Upcoming Events

Recent Updates

#MoreOnionsPorfavor: Onionize your website and take back the internet

Starting today, July 8th, the Tor Project is running a one month campaign called #MoreOnionsPorfavor to raise awareness about onion sites, that is, websites

New releases: Tor 0.3.5.11, 0.4.2.8, and 0.4.3.6 (with security fixes)

We have new stable releases today. If you build Tor from source, you can download the source code for 0.4.3.6 on the website. Packages should be available within the next several weeks, with a new Tor Browser by the end of the month.

There are also updated versions for older supported series. You can download 0.3.5.11 and 0.4.2.8 at https://dist.torproject.org/.

These releases fix TROVE-2020-001, a medium-severity denial of service vulnerability affecting all versions of Tor when compiled with the NSS encryption library. (This is not the default configuration.) Using this vulnerability, an attacker could cause an affected Tor instance to crash remotely. This issue is also tracked as CVE-2020- 15572. Anybody running a version of Tor built with the NSS library should upgrade to 0.3.5.11, 0.4.2.8, 0.4.3.6, or 0.4.4.2-alpha or later. (If you are running a version of Tor built with OpenSSL, this bug does not affect your installation.)

Tor 0.4.3.6 backports several bugfixes from later releases, including some affecting usability. Below are the changes in 0.4.3.6. You can also read the changes in 0.3.5.11 and the changes in 0.4.2.8.

Changes in version 0.4.3.6 - 2020-07-09

Major bugfixes (NSS, security, backport from 0.4.4.2-alpha):
- Fix a crash due to an out-of-bound memory access when Tor is compiled with NSS support. Fixes bug 33119; bugfix on 0.3.5.1-alpha. This issue is also tracked as TROVE-2020-001 and CVE-2020-15572.
Minor bugfix (CI, Windows, backport from 0.4.4.2-alpha):
- Use the correct 64-bit printf format when compiling with MINGW on Appveyor. Fixes bug 40026; bugfix on 0.3.5.5-alpha.

New alpha release: Tor 0.4.4.2-alpha

There's a new alpha release available for download. If you build Tor from source, you can download the source code for 0.4.4.2-alpha from the download page on the website. Packages should be available over the coming weeks, with a new alpha Tor Browser release around the end of the month.

Remember, this is an alpha release: you should only run this if you'd like to find and report more bugs than usual.

This is the second alpha release in the 0.4.4.x series. It fixes a few bugs in the previous release, and solves a few usability, compatibility, and portability issues.

This release also fixes TROVE-2020-001, a medium-severity denial of service vulnerability affecting all versions of Tor when compiled with the NSS encryption library. (This is not the default configuration.) Using this vulnerability, an attacker could cause an affected Tor instance to crash remotely. This issue is also tracked as CVE-2020- 15572. Anybody running a version of Tor built with the NSS library should upgrade to 0.3.5.11, 0.4.2.8, 0.4.3.6, or 0.4.4.2-alpha or later. If you're running with OpenSSL, this bug doesn't affect your Tor.

Changes in version 0.4.4.2-alpha - 2020-07-09

Major bugfixes (NSS, security):
- Fix a crash due to an out-of-bound memory access when Tor is compiled with NSS support. Fixes bug 33119; bugfix on 0.3.5.1-alpha. This issue is also tracked as TROVE-2020-001 and CVE-2020-15572.
Minor features (bootstrap reporting):
- Report more detailed reasons for bootstrap failure when the failure happens due to a TLS error. Previously we would just call these errors "MISC" when they happened during read, and "DONE" when they happened during any other TLS operation. Closes ticket 32622.

Anti-censorship team report: June 2020

Tor's anti-censorship team writes monthly reports to keep the world updated on its progress. This blog post summarizes the anti-censorship work we got done in June 2020.