Tor Browser Bundle 3.5 is released

Update 12/20: Test builds of Pluggable Transport bundles are now available. See inline and see the FAQ link for more details.

The 2.x stable series of the Tor Browser Bundle has officially been deprecated, and all users are encouraged to upgrade to the 3.5 series.

Packages are now available from the Tor download page as well as the Tor Package archive.

For now, the Pluggable Transports-capable TBB is still a separate package, maintained by David Fifield. Download them here: https://people.torproject.org/~dcf/pt-bundle/3.5-pt20131217/. We hope to have combined packages available in a beta soon.

For people already using TBB 3.5rc1, the changes are not substantial, and are included below.

However, for users of TBB 2.x and 3.0, this release includes important security updates to Firefox. All users are strongly encouraged to update immediately, as we will not be making further releases in the 2.x or 3.0 series.

In terms of user-facing changes from TBB 2.x, the 3.x series primarily features the replacement of Vidalia with a Firefox-based Tor controller called Tor Launcher. This has resulted in a vast decrease in startup times, and a vast increase in usability. We have also begun work on an FAQ page to handle common questions arising from this transition -- where Vidalia went, how to disable JavaScript, how to check signatures, etc.

The complete changelog for the 3.x series describes the changes since 2.x.

The set of changes since the 3.5rc1 release is:

  • All Platforms
    • Update Tor to 0.2.4.19
    • Update Tor Launcher to 0.2.4.2
      • Bug 10382: Fix a Tor Launcher hang on TBB exit
    • Update Torbutton to 1.6.5.2
      • Misc: Switch update download URL back to download-easy

Glad you got it working.

Re startup times, the other big change in TBB 3.5 is that the homepage is a local file (about:tor), so 1) it comes up immediately, and 2) loading the homepage isn't racing the rest of your directory bootstrap info to use the network at the same time (making Tor seem even slower than it will be once the bootstrapping is finished).

We can do this change because Tor launcher does its own version check in the background, so we no longer need to send users to an external website (which is a bad idea for other reasons).

I installed V3.5 a few days ago, and it worked fine until today. Beginning today it brings up the start page, then tells me, "Firefox is configured to use a proxy server that is refusing connections." Without Vidalia we have no tools at all to evaluate something like this.

For the record, I turned off Windows firewall and checked to make sure the Tor Browser was still configured to use the socks 5 proxy on port 9150. It is. I shut down Tor Browser and started up a regular copy of Firefox and everything was working fine.

I can't say that having Vidalia would have allowed me to easily find and fix the problem, but I would have had some idea of what had been going on during the bootup, and I would have had to log to refer to. Was the Tor network down Saturday evening?

Something else I noticed is that a misspelled URL will launch TB off to a search engine. I haven't found a way to disable this behavior.

And yet another question is why the new TBB comes configured to automatically check for search engine updates. It also places a search engine textbox next to the URL bar. I would think that it would be better to disable address line searches. I know that at least google says they don't use those for tracking people, but they certainly could if they wanted to. I always customize those away.

Thanks for an overall great product!

Jerry

"a misspelled URL will launch TB off to a search engine."

My guess is that this was the behavior of a DNS provider, such as OpenDNS, that your node at the time happened to be using.

The other (and decidedly more sinister) possibility I can think of is that you were the victim of a MITM attack.

k239

December 19, 2013

Permalink

Give us a bundle with Vidalia back, or a tutorial about how to bring it back...
Right now what I had to do is to download both 2.x and this 3.5 and just merge the
newer TorBrowser to the old package

The TBB 3.5 FAQ, linked above, tells you how to fetch a standalone Vidalia and run it with your TBB 3.5.

(Unless you're on OS X, in which case, either sit tight and be patient, or help us make it work.)

The TBB 3.5 FAQ, linked above, tells you how to fetch a standalone Vidalia and run it with your TBB 3.5."

The FAQ linked above says nothing about how to get TBB 3.5 _working_ with Vidalia.

For Windows, if you follow the instructions and run "Start Vidalia.exe", then Vidalia will not connect since it can find tor. So, after adding the path to tor in the settings, Vidalia starts tor and sets up a connection. But Firefox from TBB 3.5 refuses to use that connection. So, what do I do next?

(Nor does the FAQ mention that you need to disable the new Tor Firefox Add-on to be able to start the TBB 3.5 bundle when running Vidalia.)

Yeah, don't do it that way. Let TBB start, and then after that run Vidalia. Your Vidalia should try to connect to Tor's control port, realize that it needs to authenticate, and do so.

At least, that's how it works on Linux. Hopefully it does the same on Windows.

How can we ensure if the TBB is really connected to 3 nodes? Sometimes the previous bundles used to connect to one node and I had to change the identity by closing the circuit to ensure that 3 nodes are really working.

A) You're welcome to hook up a Vidalia to your TBB 3.5. See the FAQ linked above for directions.

B) You are confused about how Tor works. Tor does indeed create one-hop circuits sometimes, to do directory fetches in a way that they benefit from encryption. But your Tor does not use those one-hop circuits for attaching actual streams. In short, this sounds like another case where if you'd left it alone it would have been safer.

Thank you for putting together a stand-alone Vidalia. Sure, it means that I have to run TBB 3.5 and then run the Start Vidalia thing as well, but that is not a major annoyance.

It will even allow me to 'refresh my identity' using Vidalia, which was the biggest annoyance with TBB 3.5, the fact that getting a new identity closed the browser totally and then reopened it.

Great!

In the future hopefully we'll have some of the more key features of Vidalia built in to Tor launcher, such as triggering a newnym without closing all tabs, and being able to see what relays are in your circuits.

One way to save having to start Vidalia up is to 'fix' the 'New Identity' button in TorButton to work the way people who actually use it think it should work. Pretty simple.

  • Go to the 'Data\Browser\profile.default\extensions' directory.

  • Rename 'torbutton@torproject.org.xpi' to 'torbutton@torproject.org.zip'.

  • Unzip this file in the extensions directory. Using the file name as the directory name might be necessary for this to work. Your zip program will probably do this automatically.

  • Go to the 'torbutton@torproject.org\chrome\content' directory.

  • Open the 'torbutton.js' file, and search for 'function torbutton_do_new_identity()'. A '{' follows this text. Add the text '/*' after the '{'.

  • Search for 'torbutton_log(3, "New Identity: Sending NEWNYM");'. Add the text '*/' just prior to this text.

  • Search for 'torbutton_log(3, "Ending any remaining private browsing sessions.");'. Add the text '/*' just prior to this text.

  • A little bit further on in the file there will be the text '// Close the current window for added safety' then 'window.close();' Add the text '*/' just after 'window.close();'.

  • Save the file and launch the TBB. You're done.

Suggest using Notepad++ rather than Windows Notepad for this, as it makes it a lot easier to see what you're doing.. but even without using Notepad++ it's just a couple minutes work all up.

Bring the old format back as I want to ensure that all nodes are working properly.

Thanks.

See the first question in the TBB 3.5 FAQ linked above.

is there any way to check bandwidth used when as there was on Vidalia? It was useful and pleasant to check how much I sent and how much i received.

See the first question in the TBB 3.5 FAQ linked above.

Now that Vidalia is gone, is there any graphical way to configure relaying? I saw the TorLauncher in add-ons but it has no "Preferences".

You've got three options.

First, if you're on Linux, you can install the system Tor package (e.g. apt-get install tor) and then set it up to be a relay. You can then use TBB independent of that.

Second, if you're on Windows, you can fetch the separate "Vidalia relay bundle" from the download page and then use that (again you can use TBB independent of it).

Third, you can either hook your Vidalia up to TBB (as described in the FAQ above) or edit your torrc file directly. This option is pretty klunky right now, e.g.
https://trac.torproject.org/projects/tor/ticket/10449
but I'm hoping it will become an easy option in the future.

Thanks!

QUOTE:

"First, if you're on Linux, you can install the system Tor package (e.g. apt-get install tor) and then set it up to be a relay. You can then use TBB independent of that."

Pretty please with a cherry on top provide a 'step by step' tutorial for that for us newb Linux converts :)

https://www.torproject.org/docs/tor-relay-debian (works on Ubuntu too)

If you have further questions, I suggest either asking on irc ( https://www.torproject.org/about/contact#irc ) or asking for specific help on the tor-relays list ( https://www.torproject.org/docs/documentation#MailingLists ).

Thanks for wanting to run a relay!

Actually, the better answer is probably to point you at the FAQ:
https://trac.torproject.org/projects/tor/wiki/doc/TorBrowserBundle3FAQ#…

I want to start only TorBrowser, without Tor. I alredy have to running on my machine. How do I do that?

thank you tor devs.

Advice to those launching the Start Tor Browser.exe of TBB 3.5 FINAL for the first time.

You will have to wait at least 10 minutes for the loading of the relay circuits, something that never happened with TBB 2.x series.

At first I thought TBB 3.5 FINAL was still buggy and was about to revert to using TBB tor-browser-2.3.25-15_en-US.exe when after about 10 minutes, the former launched successfully.

Now whenever I launched TBB 3.5 FINAL, it starts up way faster than tor-browser-2.3.25-15_en-US.exe ever did.

Thanks to Tor developers for this software. We users certainly hope that it will provide greater anonymity and be more robust than the deprecated software.

Actually, it's not supposed to take 10 minutes. I assume you had a hiccup on one of your directory fetching circuits or something. Sorry for the troubles.

You could try blowing away your current TBB and unpacking a new one, and see how the second attempt fares?

Mine does this every time. It doesn't seem to be creating any data in my data directory either. What is it supposed to be doing and why doesn't it save the result?

Did you unpack your Tor Browser into a directory that you don't have write permissions for?

Suggestion to Tor developers of TBB 3.5 and above series

Could you please state clearly on the appropriate web pages who sign(s) the TBB bundle?

For TBB 2.x series, it was stated clearly that Erinn was the only signer.

As for TBB 3.5 and above series, who is the signer? Is it still Erinn?

Erinn still signs the .asc files that you're used to checking.

But there's actually a smarter way to check the signatures as of TBB 3.5, which resists a few subtle attacks that probably don't matter currently but might matter in the future.

See the "How do I verify the download (sha256sums.txt)?" question in the FAQ linked above.

"Manage cookie protection" don't work (windows version). How can I see and delete cookies? In old version all cookies was there and I saw them.

Hi all I want to link Vidalia to the new 3.5 TBB, I downloaded & extracted the stand alone package to a seperate folder, now how/where do I put the start script in so the open and are linked, I want map and abillity to new ID without browser refresh ass I use many tabs, Thanks

Step one, start TBB. Step two, start your Vidalia.

Sounds fishy to me, for some reason they want you to run the browser naked first, easier for the browser to phone home through some backdoor bypassing tor maybe?

Sorry, but the idea doesn't fit with the facts. Vidalia isn't some magic thing that lets you check whether your browser is making connections that bypass Tor. You can use some other tool for that (and you should!), whether you are attaching a Vidalia to your TBB or not.

bring back vidalia this is total bullshit version

why dosint the browser start trough vidalialia like it used when i use it to start 3.5 trough that standalone bundle , it greenlights but no browser

Step one, start TBB. Step two, start your Vidalia.

The startup time improvements in 3.5 are massive but there is some work to do. In TBB 2.3.x I used Vidalia to reconfigure and run as a Relay. Now TBB by default is running as Client-Only that is less secure (IMHO because it does not obfuscate the traffic I generate by mixing it into relay traffic). I also want to torrify other apps such as Bitcoin. I know about editing Torcc but I want to do it "in proper way".

Vidalia Standalone Bundle is not a real solution. TBB 3.5 uses cookie as control port auth, Vidalia wants to use random password. The Vidalia also now throws out uncensored .onion addresses in it's log claiming it is not supported.

I think I will need to run Vidalia Relay Bundle for all my other apps together with TBB for browsing. If they don't attempt to interfere with each others instance.

The new Tor is great with its fast circuits. The rest is meh as usual.

Give me Vidalia or give me death!

(I know about the FAQ but I had to say that.)

* With all due respect: Without Vevida it really sucks *

- Unable to see network connections. or if any connections are established in the first place.
- Unable to instantly check to which countries or nodes you are connected.
- Firefox’s preferences content is dramatically reduced until pretty unusable.

I’m losing my trust rapidly. What are you doing?
From now on Tor is for kids and foolish people only?

Download page says: "This package requires no installation. Just extract it and run." but I get an .exe file that I must install. If I extract and try to run I always get an error message. What am I doing wrong?

You say "This package requires no installation. Just extract it and run." but download is an .exe ...wft?

I opened https://trac.torproject.org/projects/tor/ticket/10452 for the issue -- please help!

Using the 63 Bit Linux version...I go into settings and cannot locate where to disable JAVA...option is gone in this new release...