Tor Browser Bundle 3.5 is released

Update 12/20: Test builds of Pluggable Transport bundles are now available. See inline and see the FAQ link for more details.

The 2.x stable series of the Tor Browser Bundle has officially been deprecated, and all users are encouraged to upgrade to the 3.5 series.

Packages are now available from the Tor download page as well as the Tor Package archive.

For now, the Pluggable Transports-capable TBB is still a separate package, maintained by David Fifield. Download them here: https://people.torproject.org/~dcf/pt-bundle/3.5-pt20131217/. We hope to have combined packages available in a beta soon.

For people already using TBB 3.5rc1, the changes are not substantial, and are included below.

However, for users of TBB 2.x and 3.0, this release includes important security updates to Firefox. All users are strongly encouraged to update immediately, as we will not be making further releases in the 2.x or 3.0 series.

In terms of user-facing changes from TBB 2.x, the 3.x series primarily features the replacement of Vidalia with a Firefox-based Tor controller called Tor Launcher. This has resulted in a vast decrease in startup times, and a vast increase in usability. We have also begun work on an FAQ page to handle common questions arising from this transition -- where Vidalia went, how to disable JavaScript, how to check signatures, etc.

The complete changelog for the 3.x series describes the changes since 2.x.

The set of changes since the 3.5rc1 release is:

  • All Platforms
    • Update Tor to 0.2.4.19
    • Update Tor Launcher to 0.2.4.2
      • Bug 10382: Fix a Tor Launcher hang on TBB exit
    • Update Torbutton to 1.6.5.2
      • Misc: Switch update download URL back to download-easy
Anonymous

January 02, 2014

Permalink

Tell me why is the new 3.5 bundle making directory's out side of the tor working dir's? Found it in the roaming dir, and then a key folder in the tor folder, that was found in the roaming dir.
This is still done when you tell it to install some place other then the default, and what are those key files for. Other versions never did this. I now see Tor as nothing more then a virus.

Anonymous

January 03, 2014

Permalink

After a short moment of irritation, thank you for the new version! Works fine here.
And good job in answering so patiently to all the (sometimes pretty embarassing) rage-questions of people who didn't spend 5 minutes doing research or at least reading the FAQ.

Anonymous

January 04, 2014

Permalink

The new tor bundle for mac does not even give me an option to disable javascript, which is the whole point of using TOR, to browse with anonymity. Or am I slow and cannot find it? or is tor now playing along with our fearless security leaders. I just want the switch, javascript ON, javascript OFF. my trust has just melted away in TOR

1. JavaScript is disabled by default 'cuz it is very insecure - users are advised not to enable it.
2. JavaScript is enabled by default 'cuz most site would not work and people would not use TOR any longer.
3. The nsa exploit with the help of JS enabling.
4. Url trimmed in the address bar so you can oversee it's not an SSL/https site.
5. TBB with no vidalia and JS enabled to make users feel more comfortable - they do not need to know what routers they are connected to, JS will do the job.

Did I miss anything ?

Anonymous

January 04, 2014

Permalink

It's impossible to download stuff with TOR, lots of "wrong ip" messages. It used to be cool, now it's useless

Anonymous

January 05, 2014

Permalink

A Vidalia that can only be opened after the browser is already started isn't very useful for seeing if my addons are doing anything when the browser starts...

Anonymous

January 05, 2014

Permalink

What would be the fingerprinting implications of using an extension like Fasterfox with TBB?

Anonymous

January 06, 2014

Permalink

Hi, I don't understand :

#1 TBB 3.5 for windows has Firefox ESR version 24.2 and can be downloaded from here :
https://archive.torproject.org/tor-package-archive/torbrowser/3.5/torbr…

#2 Tor Pluggable TBB for windows has Firefox ESR version 17.0.11 & can be downloaded from here :
https://www.torproject.org/docs/pluggable-transports.html.en

#2 has obfsproxy activated by default

Questions :

1) Does #1 have obfsproxy activated by default with the same features as #2 if I add this to its torrc file? (see below)

2) If not, how can I have TBB 3.5 with obfsproxy activated?

3) Is #2 deprecated?

Thanks

------------------------------------------------------------------------------------
# This file was generated by Tor; if you edit it, comments will not be preserved
# The old torrc file was renamed to torrc.orig.1 or similar, and Tor will ignore it

Bridge 176.9.42.X:9001
Bridge 41.135.78.X:443
Bridge 54.241.168.X:443
DataDirectory C:\Tor Browser\Data\Tor
DirReqStatistics 0
GeoIPFile C:\Tor Browser\Data\Tor\geoip
UseBridges 1

Anonymous

January 06, 2014

Permalink

Help! Where has the yellow onion tab gone down the bottom of my screen with the new 3.5 bundle? It used to accompany the globe and allowed us to view the network and change exit nodes etc. How do I change exit nodes now? Thanks :)

Anonymous

January 07, 2014

Permalink

I discovered a bug in the "start-tor-bundle" file. defines the HOME variable that causes conflict with the system (ubuntu 13.10). You have to rename the HOME variable to HOME_TOR or another name.

Anonymous

January 09, 2014

Permalink

New bundle does not work on Mac Mavericks. Date of browser bundle shows as the year 2000; timestamps in the log are wrong; and it will not connect to any website. I had to revert to version TorBrowser-2.3.25-12-osx-x86_64-en-US, which works fine, proving no problem on my end: the problem is in 3.5. I downloaded 3.5 multiple times, in user and admin accounts, rebooted, gave it time. The console log shows it has trouble establishing connection, but claimed it did connect when it did not connect to any site, any search engine, your own website, etc: just a blank page, even tried New Identity several times, and tried each combination for hours.
Tor 3.5 is unusable.
Log:

1/9/14, 23:46:04.523 [NOTICE] Tor has successfully opened a circuit. Looks like client functionality is working.
1/9/14, 23:46:04.523 [NOTICE] Bootstrapped 100%: Done.
1/9/14, 23:48:08.830 [NOTICE] Tried for 120 seconds to get a connection to [scrubbed]:0. Giving up. (waiting for socks info)

Exact same thing occurred with both TBB 3.5 and TBB-PT 3.5 under Snow Leopard, so problem likely affects Mac OS X 10.6–10.9. Had to revert to v2.x. Too bad, because I really like some of the Mac-like improvements the developers made to v3.5.

Apparently, Sophos anti-virus blocks Tor from making connections. To use TBB 3.5 with Mac OS, users running Sophos must disable the two options found under Preferences>Web Protection:
-"Block access to malicious websites..."
-"Block malicious downloads from websites..."
Previous versions of the TBB are unaffected by the incompatibility.

Anonymous

January 12, 2014

Permalink

This new version of TBB, 3.5, does indeed load much faster than the previous versions. But after double-clicking the 'start-tor-browser' icon, until the browser actually opens, there is no feedback that TBB is, in fact, starting.
(The only thing I see: some window that appears blank flashes for what seems like a split second, only to vanish.)

Thus, there is a period of at least several seconds (on my admittedly relatively slow hardware, at least) during which I cannot even be sure that:
a) I properly double-clicked the icon , and,
b) that I did so effectively

This, as should be needless to say, is rather unnerving. Worse, it can lead to user's re-clicking the start-tor-browser icon, resulting in "Firefox is already running" messages.

Since posting the above, the Tor status window has displayed for me until the browser opens.

Odd. Wonder what could have changed, as I've been using the same hardware and OS.

Anonymous

January 16, 2014

Permalink

Please, ship the vidalia. It is very comfortable to use : I usually separate tor + vidalia and firefox and use them separately: use ff for daily web surfing and tor only when I need it.

Anonymous

January 16, 2014

Permalink

TBB v3.5 running under Mac OS X Snow Leopard (as another poster running Mavericks also found) cannot establish a connection to any website, although it indicates Tor has successfully opened a circuit. Also affects TBB-PT v3.5. Reversion to v2.x restores normal functionality.

Anonymous

January 16, 2014

Permalink

Hello,
i use Tor in some ways. TBB,arm,tails etc..Recently i noticed Expert tor(standalone) isn't working on old windows anymore(something like error with vscprintf...).
Can you compile for old windows again? I know......security,but... .
Would be really nice.Please.

Anonymous

January 18, 2014

Permalink

It is amazing how many people are ticked off about vidalia being removed! Seems like the folks at torproject should pay attention to their users no?

To build vidalia back into the tor bundle follow these steps. You will need a pre-3.5 copy of the tbb to complete these instructions and the latest Vidalia source code.

Extract the old and new bundles to seperate directories. Replace the new start-tor-browser script or exe program with the old one.

Copy the old Data/Vidalia folder into the new Data folder.

Copy the old Lib folder into the new tbb root folder.

Move the Tor/*.so or *.dll files into the copied Lib folder, overwrite existing files.

Open the copied Data/Vidalia/vidalia.conf with your favorite text editor and replace the following options:
BrowserDirectory=./Browser
ProfileDirectory=../../Data/Browser/profile.default
PluginsDirectory=../../Data/Browser/profile.default/extensions
TorExecutable=../Tor/tor

Delete the following file from the new bundle: Data/Browser/profile.default/extensions/tor-launcher@torproject.org.xpi

Here is where you become a programmer, extract the vidalia source code and open the vidalia-0.2.21/src/vidalia/MainWindow.cpp file with a text editor.

Go to line 1125 and add the following lines of code:

QString expDef = QDir(expand_filename(dataDirectory + "/torrc-defaults")).canonicalPath();
if (!expDef.isEmpty())
args << "--defaults-torrc" << expDef;

QString expGeoip = QDir(expand_filename(dataDirectory + "/geoip")).canonicalPath();
if (!expGeoip.isEmpty())
args << "GeoIPFile" << expGeoip;

Save the file and follow the directions to build vidalia in the INSTALL file included with the source.

If you are building on Ubuntu you may need to install the following packages: gcc make libevent-dev cmake libssl build-essential qt4-qmake libqt4-dev libx11-dev libcv-dev libcvaux-dev libhighgui-dev checkinstall

Copy the new build/src/vidalia/vidalia binary into the new App folder, you should see the new Browser folder in there also.

Now run the copied start-tor-browser and you should be up and running with vidalia and the latest tor bundle!

That was easy right?

As far as I see there is no fault in your description and in may work, but WHY?

If you like Vidalia (I do!) simply download the standalone Vidalia and run it after starting Tor. You get the same result without the need to mess around your Tor installation.

Anonymous

January 19, 2014

Permalink

On my Debian Linux I start the new TBB and wait till it connects to my home page. Then I start the previous TBB and minimize it. I found I can use the green onion to change my identity in the new TBB. Haven't played around much with it to see if it works 100%.

Anonymous

January 22, 2014

Permalink

When I download 3.5 for Mac, GetInfo says it is 1.0, and it is dated 1999. Is this correct?

Anonymous

January 22, 2014

Permalink

I have a problem with TBB 3.5 for windows. (torbrowser-install-3.5_en-US.exe)
I downloaded and extract it with 7zip to a directory.
The unpacked directory structure looks like:

torbrowser-install-3.5_en-US
- $_OUTDIR
- $PLUGINSDIR

The 'Start Tor Browser.exe' is in the root directory. After clicking it I get the error message 'Unable to start Tor Browser'.
The strange '$'-directories seems to be the culprit. What to do? Thanks.

Anonymous

January 24, 2014

Permalink

arma-
This is my summary of Torproject's status..in the eyes of users. For reference, I am not a programmer but I build my own Linux boxes and have been watching the growth of Onion/Torproject closely for a decade. User concerns:

1) The Project has adopted the Ubuntu model, ignoring user wishes.
2) Torproject declines to address a major issue: what, specifically, have you given the Federal agencies in return for the ~$15 million they have given the Project over the last decade (exact amt irrelevant). If you are unable to disclose this, the open-source argument goes down the drain.
3) The notion that you are being "forced" by Mozilla to use their newer versions. The last usable, fast and relatively configurable release of Firefox/Iceweasel was version 3.
4) The seeming inability of folks at the Project to accept that simpler is better. Older and patched is better than the changes you are making. The fact is that addons such as NoScript and HTTPS Everywhere are worse than unneeded vs: a simple, tested browser..no Java and no Javascript by default. They add massive potential for vulnerability. No loose config settings or Mozilla "Services" enabled unnecessarily in the browser.
5) Vidalia is wanted. Period.
6) torrc should work, allowing reliable exclusion of certain Country Exit Nodes (Strict). It has never worked in this regard.

Thanks, arma. Don't embarrass Chomsky. Do what users want.

I recognize that some of the blog commenters here believe some of these things. From talking to many Tor users (remember we have many hundreds of thousands), I don't think they're as representative as you think.

As for your conspiracy theory in #2... what have we given our funders? Everything we've given you. Nothing more. Really.

And I agree that Firefox/Iceweasel version 3 had some advantages in usability. But I don't think you fully understand how hard it is to keep browser code secure once it's abandoned by its upstream.

Oh, and for "Vidalia is wanted", yes, it sure it -- but actually, some of its features are wanted. I bet nobody actually wants the horrible Qt backend that doesn't work on various platforms -- they want the things that it let them do. And I want those too. Please help make them happen in Tor Launcher.

Man, here I am disagreeing with you at basically every turn. You should join the Tor project and make things into what you want them to be. Otherwise you'll just remain a complaining user on page 2 of some blog comments. :/

Anonymous

January 27, 2014

Permalink

Am thinking of buying a new computer.

As operating system I am tending towards Windows 8.1. Are there any issues I should be aware of?
Will TBB work OK with this system?

It works great with XP.

Thanks for help.

Just a humble opinion. There is no point in using Tor with any Windows installation. It would only give a false sense of security. Use Windows for all your everyday stuff, games, writing a note to your sweetie, and so on. For your hardnosed political opinions requiring care in countries such as UK, US, NZ and Aus, use a separate harddrive with Debian. Cheapest way is get a bunch of old HD's from abandoned laptops and connect one to your tower ribbon-cable with a handy little $4 adapter avail at Amazon. I have a dozen harddrives, each with a different version Linux, all installed with whole-disk-encryption, with bootloader (GRUB) passphrase encrypted/locked. It has cost me maybe $30 dollars in total and I just plug-in any drive I feel like playing around with that day. Any OS used with Tor S/B barebones and have almost all of the egress Ports blocked by the firewall, as well as all incoming. Of course, a hardware router is required for any internet-connected machine; w/icmp ping, UPnP and remote-updates all disabled.

Anonymous

February 01, 2014

Permalink

WTF now tor finally became covered by the same NSA and corporate industry server alliance putting out AngloSaxon fascist AS World Gov server controls. No more Videlia working so only a nerd can find out how to block their suspicious servers...