various issues with Tor Browser documentation chapter Local Connections

[phabricator-migrator]

Information

ID: 455
PHID: PHID-TASK-3hplfmcrtpozkcxsmybu
Author: Patrick
Status at Migration Time: resolved
Priority at Migration Time: Normal

Description

Tor Browser Essentials

---

1:

You could set to transparent torification, but then you would be vulnerable to fingerprinting issues.

What is the source of that? I would like to add a footnote.

---

2:

the green onion icon in your toolbar → Preferences… → Use custom proxy settings → No Proxies for: AND there enter “127.0.0.1”. Then, click on “OK”

Won’t work anymore. Because that menu was removed from Tor Browser.

---

3:

Split a) “best way to use Tor Browser with local connections” from b) “fingerprint threat analysis”. Because

• a) is interesting for users
• b) for is interesting for design, reasoning, auditors advanced users.
• a ) can stay where it is.
• b) can moved down to advanced topics.

---

4:

If 1: is true, then it should also be mentioned at the Tor_Browser#Remove_Proxy_Settings instructions.

---

Could you work on this please, @HulaHoop?

Comments

---

HulaHoop

2015-12-16 22:04:20 UTC

You could set to transparent torification, but then you would be vulnerable to fingerprinting issues.

There is a misunderstanding. I was talking about application of settings in Tor Browser Essentials not transproxying.

Won’t work anymore. Because that menu was removed from Tor Browser.

These settings still exist but the menu names have changed I will update them or replace them with FoxyProxy settings that can mitigate the fingerprinting threat.

Split a) “best way to use Tor Browser with local connections” from b) “fingerprint threat analysis”…

I don’t know what you mean. Please tell me specifics

---

Patrick

2015-12-17 16:43:29 UTC

You could set to transparent torification, but then you would be vulnerable to fingerprinting issues.

There is a misunderstanding. I was talking about application of settings in Tor Browser Essentials not transproxying.

Why was transparent torification added in the first place?

Transparent torification allows local connections?

Transparent torification also sets “no proxies to 127.0.0.1”?

I don’t know what you mean. Please tell me specifics

part a)

Note, accessing 127.0.0.1 using Tor Browser is no longer possible due to a change in Tor Browser by The Tor Project. You could set to transparent torification, but then you would be vulnerable to fingerprinting issues. See Tor Browser, Local Connections for more information and a workaround.

…

---

part b)

Threat Details

According to this Firefox ticket, JavaScript can be abused to scan internal networks, fingerprint devices, and make malicious commands to those devices if they have a web interface.

…

---

HulaHoop

2015-12-18 04:22:37 UTC

I see the confusion. Fingerprinting would happen because scanning of locally listening programs if the default TBB proxy settings were changed/disabled and it was left to use the Transproxy like any other software. Its not because of the transproxy…

Anyway I will phrase this better.

---

HulaHoop

2015-12-18 04:43:26 UTC

Done. Please check and close the ticket if you’re happy with it.

---

Patrick

2015-12-18 05:05:03 UTC

TOR_TRANSPROXY=1 ./start-tor-browser.desktop results in allowing local connections, therefore to the scanning issue, therefore to the fingerprinting issue?

---

Patrick

2015-12-18 05:09:02 UTC

That reference to https://phabricator.whonix.org/T291#5252 is bogus, because https://phabricator.whonix.org/T291#5252 does not mention Tor Browser’s TOR_TRANSPROXY=1 feature. Ideally, we would reference an official confirmation of this issue or alternatively come up with an argument why that is so.

---

HulaHoop

2015-12-18 05:42:11 UTC

Tor Browser’s TOR_TRANSPROXY=1 feature

I meant to ay that by disabling Tor Browsers Torrified proxy settings you end up being torrfed by the gateway like anything else running on the ws. I am not saying Tor’s transproxy is causing the fingerprinting. The sentence was needlessly verbose so I removed it.

---

Patrick

2015-12-18 12:16:35 UTC

This Tor Browser “transparent proxying” feature causes lots of confusion. It was a bad decision by TPO to call it “transparent proxying”. What it actually does, is “set to no proxy settings”, i.e “set to system default”. Then Tor Browser works network wise just as a unconfigured Firefox / Iceweasel. If the person using this Tor Browser “transparent proxying” feature, happens to not use a gateway with transparent torification features such as Whonix-Gateway, traffic would go through clearnet. If the person using this Tor Browser “transparent proxying” feature, happens to use a torifying gateway such as Whonix-Gateway, traffic happens to go through Tor. If the person using this Tor Browser “transparent proxying” feature, happens to have a JonDo-Gateway, traffic happens to go through JonDo.

Not to be confused with Tor’s setting TransPort [address:]port|auto [isolation flags] setting. Not to be confused with TransparentProxy, which is different from an IsolatingProxy.

You can disable Tor Browser’s proxy settings, but then you would be vulnerable to fingerprinting issues.https://bugzilla.mozilla.org/show_bug.cgi?id=354493

How can the reader understand the causality between “disable Tor Browser’s proxy settings”, or in other words “no proxy settings” and “fingerprinting issues”?

Would the following…

You can disable Tor Browser’s proxy settings, but then you would be vulnerable to fingerprinting issues.This is because my removing proxy settings from Tor Browser, also local connections will be allowed. These can be abused for fingerprinting issues as described in https://bugzilla.mozilla.org/show_bug.cgi?id=354493

…be correct?

---

HulaHoop

2015-12-18 16:29:35 UTC

Would the following be correct?

Yes.

This Tor Browser “transparent proxying” feature causes lots of confusion.

Tell me about it. I had trouble understanding whats going on at first. Can you add this terminology info under advanced topics on the page?

---

Patrick

2015-12-19 18:23:43 UTC

Just now hidden “You can disable Tor Browser’s proxy settings” in a footnote. It’s not all that important. It was the only workaround, before you added this improved workaround.

Made lots of changes. I am happy with the local connections instructions now. As good as we can get them in the absence of the underlying issues of third parties fixing these bugs.

Documented terminology:
Tor Browser Essentials