[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-bugs] #10963 [Tor bundles/installation]: Bypassing proxy settings?
#10963: Bypassing proxy settings?
--------------------------------------+-----------------------
Reporter: cypherpunks | Owner: erinn
Type: defect | Status: new
Priority: normal | Milestone:
Component: Tor bundles/installation | Version:
Keywords: | Actual Points:
Parent ID: | Points:
--------------------------------------+-----------------------
[https://blog.torproject.org/blog/tor-browser-3521-released#comment-47234
Post] was posted to blog's comments:
One TBB behaviour that continues to trouble me is that Firefox continues
to try to connect to the internet. I use standard install on ubuntu with
no add-ons (tor-browser-linux32-3.5.2.1_en-US.tar) and with js disabled in
both NoScript and about:config.
I see additional changes with each update that improve browser isolation
by disabling / blocking more auto-connect threats like blacklist updates,
rule-set updates, safebrowsing reporting...etc...etc...
So with every new TBB release, I have renewed hope that Firefox will not
go outside of the tor process with an internet connection attempt. Each
release I allow tor to access the internet and firefox to access tor via
127.0.0.1. Each release I am either immediately or later disappointed when
Firefox attempts its own internet connection.
My concerns...
1) Why does TBB continue to be released with default settings that allow
Firefox automatically seek an internet connection? I can not imagine this
not being noted in testing. What is trying to connect and what information
is trying to be shared?
2) How many people trust any connections from TBB and allow both tor and
TBB Firefox connections to outside world? Why is this not a significant
security flaw? Tor works fine when I block these Firefox external
connection attempts. I run a minimal ubuntu box with standard Forefox
gutted to the best of my ability. I have a process connection map running
and see that the Firexoz attempting to connect is from the TBB package.
3) If this behaviour is known and accepted, how do we know that
connections are not being made and information being sent to unknown
locations by Firefox through tor? This is something that I would never
catch even with my layers of application and port level firewalls...
Sorry that I do not have Wireshark capabilities, but can not imagine that
this behaviour is not seen on all installations.
Thanks for your efforts.
inside
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/10963>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs