[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #30388 [Applications/Tor Browser]: NoScript and all user-installed add-ons got deactivated! (armagadd-on-2.0)
#30388: NoScript and all user-installed add-ons got deactivated! (armagadd-on-2.0)
-------------------------------------------------+-------------------------
Reporter: cypherpunks | Owner: tbb-
| team
Type: task | Status:
| needs_review
Priority: Immediate | Milestone:
Component: Applications/Tor Browser | Version:
Severity: Blocker | Resolution:
Keywords: AffectsTails, TorBrowserTeam201905R | Actual Points:
Parent ID: | Points:
Reviewer: | Sponsor:
-------------------------------------------------+-------------------------
Comment (by Crissy2):
> "fail safe" is better than "fail dangerous"
But what mean fail safe and fail dangerous? It is `double epic_fail[]`!
if certs are disabled, the add-on can't be checked... (security fail!)
If certs are enabled and add-on becomes invalid, NoScript is disabled and
additional user data is transmitted. Disabling JS also is not a full
solution (`javascript.enable`). <MEDIA>, ForeShadow, Spectree and Meltdown
can be used here (security fail).
Only one correct long term solution is: **we must have our version of
NoScript fingerprinted by TorProject!**
It looks like biggest TorBrowser fail.
More: #30402
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/30388#comment:44>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs