SecBrowser: A Security-hardened, Non-anonymous Browser - DEPRECATED

Patrick · July 9, 2019, 10:40am

Yes, we can always edit original posts add thread titles for improved expression, more up to date related to latest developments.

0brand · July 9, 2019, 6:22pm

Configuring lock_pref() , lockPref() might be a workaround for these two issues. I think thats’ what TBB devs use to keep users from changing prefs such as the security slider default. it will likely break Tor Browser but cant hurt to try.

Another idea to block JavaScript by default at SecBrowser start might be QuickJS. Its mentioned in the Tor Project docs/FAQ. Not sure how easy it would be to install QuickJs by scipt when SecBrowser is configured the first time by tb-updater tb-starter.

There is also a very simple addon available at addons.mozilla.org called QuickJS, which provides a toolbar toggle for the javascript.enabled about:config control. There are no configuration options for the addon, it just switches the javascript.enabled entry between true and false and provides a button for it.

Actually it was originally GitHub - sleutho/QuickJS: Firefox extension to enable/disable JavaScript from the toolbar but its name was changed to JavaScript Switcher – Get this Extension for 🦊 Firefox (en-US)

Patrick · July 10, 2019, 6:55am

Yes but we yet have to post document prefs / settings to set security slider level

(this exact posting of mine: SecBrowser: A Security-hardened, Non-anonymous Browser - DEPRECATED - #99 by Patrick)

Also:

These two interactions with upstream need to be next.

0brand · July 11, 2019, 5:43pm

From: gk
Why is it not enough to just set the desired slider level in a prefs file that you ship in the browser profile (anyway)?

I think using the prefs approach is the one you should pursue right now. Shipping an own profile with customizations won’t go away in the forseeable future.

If the above is true, maybe the security slider not honoring the custom profile pref is a bug? Or perhaps we are missing something (not setting the correct pref?).

Regardless thats’ the solution imo. Lets lead off by asking why the security slider is not honoring the pref that we set. No reason to say anything about Whonix or SecBrowser.

Patrick · July 11, 2019, 6:12pm

Yes. We need to ask for how to set the pref. We can say that we know
there will be no environment variable and have to go the profile route.
It could be in form of a bug report “setting this pref does not work as
expected” or as enhancement request “please document how to do…” or it
could be asked on the mailing list as a question. Dunno what’s best but
anything can work, I guess.

0brand · July 12, 2019, 3:14am

Not necessary. I got it!

I was using either to many user_prefs (
extensions.torbutton.security_custom) or they were in the wrong order when setting the security slider, which was breaking SecBrowser.
It looked sane but I should have added one at a time.

These prefs set the security slider to “Safest”

user_pref("extensions.torbutton.inserted_security_level", true);
user_pref("extensions.torbutton.security_slider", 1);

Patrick · July 12, 2019, 8:17am

It might set the slider to highest but does it also do the action that
slider would apply when it is manually being set to highest? I.e. would
it actually disable scripts globally when started in this configuration?

0brand · July 12, 2019, 10:25am

Guess not. AFAICT there is no way to sync the slider with a pref. Bug report.

madaidan · July 12, 2019, 11:33am

I’ve messed around with this before, and yes it does. You can test by looking to see if some of these about:config settings are set The Design and Implementation of the Tor Browser [DRAFT]

Patrick · July 12, 2019, 4:09pm

High … and disables SVG images ( svg.in-content.enabled ).

Does not work.

svg.in-content.enabled;true

I speculate that

using the security slider in an interactive (manual) way makes it do things. However,
starting with security slider pref set to high does not make the security slider do things. The pref only tells the security slider how it should visually appear but it does not seem to (fully) call the function which does things.

madaidan · July 12, 2019, 4:15pm

I think svg.in-content.enabled isn’t used anymore. Setting the security slider to high manually doesn’t change that pref for me but it does change svg.disabled to true.

Patrick · July 12, 2019, 4:18pm

Confirmed.

svg.disabled;true

Patrick · July 12, 2019, 4:27pm

Merged.

File location moved.

new file location:

https://github.com/Whonix/tb-starter/blob/master/usr/share/secbrowser/user.js

0brand · July 12, 2019, 4:32pm

I stand corrected. Looks like setting the slider to Safest “after” first start can cause prefs not to sync properly. When adding prefs to /usr/share/tb-updater/tb_without_tor_settings.js (setting prefs at first boot) NoScript and about:config “visually appear” to work as expected. Meaning NoScript sycs with security slider and about:config prefs are togled as expected.

0brand · July 13, 2019, 9:57am

environment variable to skip TorButton control port verification (#13079) · Issues · Legacy / Trac · GitLab
From: gk
Fixed by commit 38a59e819604de5018db5db54fb08fd9e1581d1f. Please open a new ticket for the Tor Launcher issue if you wish.

Is this essentially a revisit of the same issue or would fixing Tor Launcher work as well?

Patrick · July 13, 2019, 10:44am

Almost since environment variable to skip TorButton control port verification environment variable to skip TorButton control port verification (#13079) · Issues · Legacy / Trac · GitLab was an enhancement request which was implemented. Please reference this ticket when writing a bug report. Now this feature broke, so I think it’s correct to create a bug report?

~~The bug could also be a big different. If I remember fight, previously~~

~~I think this is still a torbutton, not tor-launcher feature.~~

Upstream will require instructions how to reproduce this issue on Debian, i.e. which environment variables set. This presupposes packages tb-updater / tb-starter not being installed and reproduced on plain Debian.

~~Please open a new ticket for the Tor Launcher issue if you wish.~~

~~Just a minor code style issue: checking existence of environment variable vs checking the value of an environment variable. Not worth a report.~~

No bug report needed. I found a solution. Will post soon.

Patrick · July 13, 2019, 10:50am

Patrick · July 13, 2019, 3:41pm

Patrick · July 13, 2019, 3:54pm

Since editing Qubes documented is rather cumbersome(?), what about leaving wiki page SecBrowser ™ has been deprecated! at Whonix wiki where each of us can edit easily and only submitting a stub to Qubes documentation?

0brand · July 14, 2019, 5:59pm

Patrick via Whonix Forum:

Since editing Qubes documented is rather cumbersome(?), what about
leaving wiki page SecBrowser™ has been deprecated! at Whonix wiki
where each of us can edit easily and only submitting a stub to Qubes
documentation?

Thats a great idea. I can put together SecBrowser basics and the
benefits of using SecBrowser as per The Design and Implementation of the Tor Browser [DRAFT], Security Slider etc. Gather fingerprint stats from https://browserprint.info/ and https://panopticlick.eff.org/ . The former because Redirecting… uses that test and mentions that the w3w browser has a fingerprint that stands out from Tor Browser i.e stands out in a crowd. I just tested SecBrowser default settings. Much better than expected

Within our dataset of several hundred thousand visitors tested in the
past 45 days, one in 76.46 browsers have the same fingerprint as yours.

Currently, we estimate that your browser has a fingerprint that conveys
6.26 bits of identifying information.

Just to be clear, no configuration instructions?