Finally figured it out! The culprit is Tor Browser VERSION.
I tested using a dispVM with a fresh installation of Tor Browser, a regular appVM, and a Virtualbox VM - all of them running TB 6.0.5. They all showed domain:0 for socks user:pass. Even after clicking New Identity, the password continued to be 0.
6.5a3 and 6.5a3-hardened both showed random strings for the password, which changed after pressing New Identity. Closing and restarting the browser does indeed generate a new password - so the submitted ticket should be updated to differentiate between Tor Browser versions.
I can’t tell if this is a bug with 6.0.5 or a feature of the alpha browsers. I can’t find my way around trac.torproject so if someone wants to take a look, here are some relevant links:
Tor Browser design doc: 4.5. Cross-Origin Identifier Unlinkability
The Design and Implementation of the Tor Browser [DRAFT]
Issue Tracker:
Tor Browser should set SOCKS username for a request based on first party domain (#3455) · Issues · Legacy / Trac · GitLab
Code:
The Tor Project / Organization · GitLab
Now, I’d like to continue my rant
Am I the only schmuck running 6.0.5 around here?