Tor at the Heart: Firefox

[tlrobinson]

Why doesn't Tor browser just automagically run a read-only lightweight Linux VM who's only program is Firefox, and only network connection is proxied through Tor? Seems like that would solve almost every fingerprinting and sandbox escape vulnerability.

[moondev]

https://github.com/paulczar/docker-torbrowser

[orf]

Seems OK until you want to upload a file somewhere.

[BuuQu9hu]

See Qubes, Whonix, Tails, Subgraph etc.

[noja]

I'd like to see the canvas fingerprinting dealt with in Firefox mainline, it's used everywhere.

[bifurcation]

Fingerprinting (in general) is the next thing on the agenda after First Party Isolation. Addressing canvas fingerprinting is in the plan:

https://wiki.mozilla.org/Security/Fingerprinting

https://bugzilla.mozilla.org/show_bug.cgi?id=1041818

[SamBam]

How accurate is canvas fingerprinting? And could it be used in the courts (which would seem a pertinent question for many Tor users)?

[HappyTypist]

How do you fix it without disabling canvas?

[nmy]

It will increase security and privacy in Firefox, that's great.

[tinus_hn]

Note that Google is not only in the browser business but also the fingerprinting business. They want a future where everything is on the web and where they have an acceptable way of seeing everything everyone is doing.

Realistically, most users use off the shelf hardware so for every machine there are millions that are specced exactly the same. That's not very useful for fingerprinting. It would be a good idea though to stop adding more discriminating features to browsers but as you imagine, that is not the direction Google wants to go to.

For every fingerprinting trick there is an obfuscation trick though. People just need to keep checking the fingerprinting scripts. A great advantage of the web is that you can in fact see the source code.

Also, we expect publishers to embrace the post-ad world. Why would it be easy to block ads so much they stop being viable, but impossible to stop fingerprinting?

[cupantae]

I'm getting HTTPS errors on two platforms (and two internet connections) for this website. It seems fairly ironic, but I guess it's just me. Am I doing something wrong?

IIDRN says it's up: http://www.isitdownrightnow.com/torproject.org.html

[tlack]

I hate to be that guy but considering the subject of the site.. perhaps tampering? Might be worth collecting some info to understand the problem.

[icebraining]

Seems fine: https://www.ssllabs.com/ssltest/analyze.html?d=blog.torproje...

[cupantae]

Yeah, it's just me. Didn't work on wifi at work or 4G, but does at home. Maybe they're lagging behind a CA update....

[saurik]

Why did they make up this term "uplift" instead of just saying "upstream"?

[mburns]

https://wiki.mozilla.org/Release_Management/Uplift_rules

[belorn]

The article describes it as upstream patch that is disabled by default which allow Firefox to be less discriminative when it comes to accepting patches.

[kebolio]

"uplift" in this context seemed to mean to me that they were not upstreaming the patches verbatim but neutering them for Firefox.

[swiley]

Why use firefox at all? why not something based on libcurl that absolutely does not talk back to the server after reciving the document unless the user clicks on a link or submits a form?

[TazeTSchnitzel]

Writing a web browser is non-trivial.

[cobbzilla]

that's the Richard Stallman approach: https://stallman.org/stallman-computing.html

he has a script that he can poke to download the content and email it to himself. then he reads it with emacs or maybe lynx with no networking enabled.

[cryptarch]

I wish you good luck doing online banking that way :')