[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #22089 [Applications/Tor Browser]: Add Decentraleyes to slighten off a bit Exit traffic and work around some CDNs blocking of Tor
#22089: Add Decentraleyes to slighten off a bit Exit traffic and work around some
CDNs blocking of Tor
-------------------------------------------------+-------------------------
Reporter: imageverif | Owner: tbb-
| team
Type: enhancement | Status:
| needs_review
Priority: Medium | Milestone:
Component: Applications/Tor Browser | Version:
Severity: Normal | Resolution:
Keywords: tbb-usability-website, tbb- | Actual Points:
performance |
Parent ID: | Points:
Reviewer: | Sponsor:
-------------------------------------------------+-------------------------
Comment (by cypherpunks):
> analyze the proposed privacy, security, and performance gains adding
$extension to Tor Browser, especially compared to the privacy, security,
etc. means Tor Browser *already* offers. Please, include the downsides of
adding $extension to the browser as well (our design document might help).
gk will take some time before adding that into the TB design document so
I'll go ahead now:
---------
# Compatibility
The proposed extension is a WebExtension that is compatible with the FF60
ESR release.
# Gains
## Privacy gains
There are no crucial privacy gains compared to what the Tor Browser
already offers.
## Security gains
Since the proposed extension will fetch libraries locally, this helps in
rare cases in which CDN providers are hacked and used to serve
malicious/junk/cryptojacking code (see [1] for a recent example that
doesn't apply in this case, but just to illustrate the point).
Some CDN endpoints don't support HTTPS[2], and some website operators user
them. With the proposed extension this problem will be addressed since the
fetch won't happen and libraries will be served locally.
## Performance gains
Since the proposed extension will fetch libraries locally, this will help
significantly in time load to fetch said libraries from the known CDN
endpoints, especially in mobile devices with TBA.
This performance gain will apply to the Tor network itself, though it will
be very small and limited.
## Usability gains
Some CDN endpoints block Tor exit nodes, with this extension this problem
can be solved since the resources will be fetched locally.
-------
# Downsides
## Usability downsides
Some redirects by the proposed extension fail when a website assigns the
"crossorigin" attribute to a script element that references an injectable
resource. The relevant issue is not fixed on FF60, but has received a
design approval from Mozilla developers.[3][4] That said the extension has
a whitelist of such domains to prevent the said issue from occurring in
the first place,[5] and there are proposed methods to detect sufficiently
enough of these domains.[6] The developer of the extension further adds:
The plan is to completely get rid of the list of tainted domains. That
said, since older versions of Firefox will not magically disappear, and
vendors of other web browsers might not approve the necessary API changes,
being able to detect tainted domains will likely stay relevant.[6]
## Security downsides
There are no known security downsides.
## Performance downsides
There are no known performance downsides.
Moreover, there is no significant memory footprint since only a list of
dozens of URLs[5][7] is cached, unlike HTTPS Everywhere for instance.
## Privacy downsides
Decentraleyes usage may be detected with JS but that will be harmless if
everyone already has it, so no privacy concerns to note.
----------
[1] : https://scotthelme.co.uk/protect-site-from-cryptojacking-csp-sri/
[2] : Such as
https://git.synz.io/Synzvato/decentraleyes/blob/master/core/mappings.js#L268
[3] : https://git.synz.io/Synzvato/decentraleyes/issues/16#note_3620
[4] : https://bugzilla.mozilla.org/show_bug.cgi?id=1419459
[5] :
https://git.synz.io/Synzvato/decentraleyes/blob/master/core/interceptor.js#L53
[6] : https://git.synz.io/Synzvato/decentraleyes/issues/294
[7] :
https://git.synz.io/Synzvato/decentraleyes/blob/master/core/mappings.js
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/22089#comment:18>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs