Whonix Welcome Page: Startpage Search Privacy Fix / removed Search Box

unconventional · August 24, 2015, 7:57am

Since the Tor Browser recently replaced Startpage to Disconnect as the default search engine on the Tor Browser homepage, the old Startpage submission URL and POST parameters have also since changed.

Currently the Whonix Welcome Page is sending an old unique search fingerprint that is no longer in use to Startpage.

This can be confirmed by looking at the Request URL and the Params in the Network Monitor of Tor Browser’s Developer Tools as you submit such queries.

Here is the fix for the Whonix Welcome Page HTML source code…

Changed:

New URL: https://startpage.com/rto/search
Removed: name=“b” parameter

Old and out of date:

	<form action="https://startpage.com/rth/search" method="post" autocomplete="off">
		<input tabindex="2" type="submit" name="b" value="" />
		<input tabindex="1" type="search" name="q" value="" placeholder="Search with Startpage.com" required="required" autocomplete="off" autofocus="autofocus" />

New and up to date:

	<form action="https://startpage.com/rto/search" method="post" autocomplete="off">
		<input tabindex="2" type="submit" value="" />
		<input tabindex="1" type="search" name="q" value="" placeholder="Search with Startpage.com" required="required" autocomplete="off" autofocus="autofocus" />

This will make the search query to Startpage now be the exact same as searches submitted via the current upper-right search bar of Tor Browser, so that they look no different and can’t be profiled as coming from Whonix Welcome Page.

Edit by Patrick:
extended title ’ / removed Search Box’

Patrick · August 24, 2015, 11:50am

Thanks!

https://github.com/Whonix/whonix-welcome-page has no maintainer anymore. I think the safest path for the future would be to remove the search box. Keeping up with what The Tor Project changes to next seems hard anyhow. Could you send a pull request or provide the changes required for that please?

unconventional · August 24, 2015, 10:51pm

Sure.

If wanting to keep the Startpage search box, then those were the changes I provided to whonix.html before.

If wanting to remove the Startpage search box, here are the changes to do that…

Removal of Startpage search box:

Changes to whonix.html:

Remove this code:

<div id="search">
	<form action="https://startpage.com/rth/search" method="post" autocomplete="off">
		<input tabindex="2" type="submit" name="b" value="" />
		<input tabindex="1" type="search" name="q" value="" placeholder="Search with Startpage.com" required="required" autocomplete="off" autofocus="autofocus" />
		<span>&raquo;</span>
	</form>
</div>

Changes to stylesheet.css:

Remove this code:

#search {
	width: 460px;
	margin: 35px auto 0px auto;
	padding-left: 55px;
}

#search input[type="search"] {
	float: left;
	position: relative;
	left: 0px;
	width: 350px;
	line-height: 40px;
	font-size: 18px;
	font-weight: bold;
	padding: 0px 45px 0px 12px;
	border: 2px solid #ccc;
	border-radius: 20px 20px 20px 20px;
	color: #333;
}

#search input[type="search"]::-moz-placeholder {
	color: #aaa;
}

#search input[type="submit"] {
	position: relative;
	top: -2px;
	left: -44px;
	z-index: 1;
	height: 40px;
	width: 40px;
	margin: 0px;
	padding: 0px;
	border: none;
	border-radius: 0px 20px 20px 0px;
	background-color: transparent;
	cursor: pointer;
}

#search span {
	display: inline-block;
	position: relative;
	top: 2px;
	z-index: 0;
	height: 38px;
	width: 36px;
	margin-left: -89px;
	padding-top: 2px;
	padding-right: 3px;
	border-radius: 0px 20px 20px 0px;
	font-size: 28px;
	font-weight: bold;
	text-align: center;
	background-color: #fff;
	color: #888;
}

If removing Startpage search, it would also make sense to remove the redundant linking of the logo to the Whonix Welcome Page, since all the links already open in new windows.

To do that, also make this one line change in whonix.html:

From this:

	<a href="" target="_blank"><img src="logo.png" /></a>

To this:

	<img src="logo.png" />

HulaHoop · August 25, 2015, 12:36pm

Please don’t remove the search box completely just update it instead. I find it handy. TPO doesn’t change their search provider frequently anyhow.

Patrick · August 25, 2015, 12:58pm

For the time being until,

someone notices
the fix being invented
the fix being deployed
Whonix users have a unique search fingerprint.

I don’t think I can maintain this box. Causes too much maintenance effort. Too many other tasks.

Patrick · August 31, 2015, 6:02pm

Thanks!

Removed search box due to fingerprinting issues due to outdated, Whonix specific POST parameters. The Tor Project changed away from startpage.com. (Old Startpage submission URL and POST parameters have also since changed.) Thanks to unconventional for reporting this issue and explaining how to disable the search box. https://www.whonix.org/forum/index.php/topic,1564.0.html

https://github.com/Whonix/whonix-welcome-page/commit/8e500c449f1515d0ae2e6be6b92bda83f6788283

gh9-z · September 9, 2015, 9:29am

The real question is why still use Startpage on Welcome page when Tor has already moved on to Disconnect.

Patrick · September 9, 2015, 4:01pm

Because this change - https://www.whonix.org/forum/index.php/topic,1564.msg9890.html#msg9890 [different!] - has not appeared yet. Will first appear in Whonix 12.