Tor Browser

[Carding 4 Carders]

A significant release of the specialized browser Tor Browser 13.0 has been formed, in which the transition to the ESR branch of Firefox 115 has been made.

Tor Browser builds are prepared for Linux, Android, Windows, and macOS.

In the new version:

* The transition to the Firefox 115 ESR codebase and the tor 0.4.8.7 stable branch was made. During the transition to the new version of Firefox, changes made since the introduction of the Firefox 102 ESR branch were audited, and patches that are questionable from the point of view of security and privacy were disabled. Among other things, the string-to-double conversion code has been replaced, the recent link exchange function has been disabled, the PDF saving API has been disabled, the service and the Cookie confirmation banner auto-opening interface have been removed, and the text recognition interface has been removed.

* Updated icons and refined the app's logo, while maintaining overall recognition.

* A new implementation of the home page ("about:tor") is proposed, which is notable for adding a logo, simplifying the design, and leaving only the search bar and the "onionize" switch for accessing DuckDuckGo via the onion service. When rendering the home page, support for screen readers and tools for people with disabilities has been improved. The bookmarks bar is enabled. Fixed an issue with the display of the "red screen of death" that occurred due to a failure when checking the connection to the Tor network.

* Increased the size of new windows, for which the default aspect ratio is now selected, which is more convenient for users of large-format screens. To prevent information about the screen size and window size from leaking, Tor Browser uses the letterboxing mechanism, which adds padding around the content of web pages. In previous versions, as the window size changed, the hotspot size changed in increments of 200x100 pixels, but was limited to a maximum resolution of 1000x1000, which caused problems with some sites that displayed a horizontal scroll bar or displayed the version for tablets and mobile devices due to insufficient width. To solve this problem, the maximum resolution has been increased to 1400x900 and the logic of step-by-step resizing has been changed.

* We switched to a new package naming scheme that matches the template " ${ARTIFACT}-${OS} - ${ARCH}-${VERSION}.${EXT}". For example, the build for macOS was previously delivered as "TorBrowser-12.5-macos_ALL.dmg", and now it looks like"tor-browser-macos-13.0.dmg".

* When you select the "Safest" mode for DuckDuckGo search, you can now refer to the non-JavaScript version of the site.

* Enhanced protection against leaks via WebRTC.

* Enabled URL cleaning of parameters used for tracking movements (for example, the mc_eid and fbclid parameters used when clicking on links from Facebook pages are removed).

* The javascript.options.large_arraybuffers setting has been removed.

* The browser.tabs.searchclipboardfor.middleclick setting is disabled on the Linux platform.

 

[Brother]

Tor Browser 13.0.6

The new version fixes a bug that causes a crash when running in environments based on the Wayland protocol when trying to access add-ons through the buttons attached to the panel. On the Linux platform, the shader cache for NVIDIA graphics cards is disabled, as it leaves potentially sensitive information on the disk.

A version of the Tor toolkit 0.4.8.10 has also been published, which fixes a vulnerability (TROVE-2023-007), details of which have not yet been disclosed (it is only reported that the problem has a high level of danger and affects exit nodes that support the Conflux traffic sharing protocol).

 

[Teacher]

The Tor Project has introduced a new tool called WebTunnel, designed to combat censorship and blocking of the Tor network by disguising traffic as regular HTTPS connections. The feature is particularly relevant for users from countries with a restrictive Internet regime, where governments have learned to detect and block connections via traditional Tor bridges.

Tor bridges are relays that are not included in the Tor public directory and hide the fact that users are using the network from surveillance. To enhance privacy, obfsproxy bridges were previously used, adding an additional layer of masking. Unlike obfsproxy, WebTunnel uses a technology that forces traffic to merge with regular HTTPS traffic, making it virtually impossible to block Tor connections without simultaneously blocking most other connections to web servers.

WebTunnel turns the connection into a WebSocket-like HTTPS connection, which looks like a normal HTTPS connection to network observers, the Tor Project explains.

To use WebTunnel, users will need to manually add the received bridge addresses to the Tor browser on computers and mobile devices, following the instructions on the official website of the project.

WebTunnel was first introduced in December 2022 as a test integration and is already available to bridge operators from June 2023 as part of a pilot launch. Since October, the project has been calling for testing more users, especially in regions with limited access to the Tor network. Currently, there are 60 WebTunnel bridges operating in the world, which are used by more than 700 active users daily.

• Source: https://blog.torproject.org/introducing-webtunnel-evading-censorship-by-hiding-in-plain-sight/