[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

[or-cvs] [torbutton/master] Build design doc.



Author: Mike Perry <mikeperry-git@xxxxxxxxxx>
Date: Wed, 16 Dec 2009 20:58:53 -0800
Subject: Build design doc.
Commit: 4211876e55e772aca42abeef105e8f6cdc9a3969

---
 website/design/build.sh      |    2 +-
 website/design/index.html.en |  446 +++++++++++++++++++++++-------------------
 2 files changed, 250 insertions(+), 198 deletions(-)

diff --git a/website/design/build.sh b/website/design/build.sh
index 1f8483c..6531077 100644
--- a/website/design/build.sh
+++ b/website/design/build.sh
@@ -1 +1 @@
-xsltproc  --output index.html.en  --stringparam section.autolabel.max.depth 2 --stringparam  section.autolabel 1 /usr/share/sgml/docbook/xsl-stylesheets-1.74.0/xhtml/docbook.xsl design.xml 
+xsltproc  --output index.html.en  --stringparam section.autolabel.max.depth 2 --stringparam  section.autolabel 1 /usr/share/sgml/docbook/xsl-stylesheets-1.75.2/xhtml/docbook.xsl design.xml 
diff --git a/website/design/index.html.en b/website/design/index.html.en
index 64abc04..c49922b 100644
--- a/website/design/index.html.en
+++ b/website/design/index.html.en
@@ -1,70 +1,70 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd";>
-<html xmlns="http://www.w3.org/1999/xhtml";><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Torbutton Design Documentation</title><meta name="generator" content="DocBook XSL Stylesheets V1.74.0" /></head><body><div class="article" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title"><a id="design"></a>Torbutton Design Documentation</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Mike</span> <span class="surname">Perry</span></h3><div class="affiliation"><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:mikeperry.fscked/org";>mikeperry.fscked/org</a>&gt;</code></p></div></div></div></div><div><p class="pubdate">Sep 2 2009</p></div></div><hr /></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="#id2514815">1. Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="#adversary">1.1. Adversary Model</a></span></dt><dt><span class="sect2"><a href="#requirements">1.2. Torbutton Requirements</a></span></dt><dt><span class="sect2"><a href="#layout">1.3. Extension Layout</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2532634">2. Components</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2537349">2.1. Hooked Components</a></span></dt><dt><span class="sect2"><a href="#id2523758">2.2. New Components</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2526366">3. Chrome</a></span></dt><dd><dl><dt><span class="sect2"><a href="#browseroverlay">3.1. Browser Overlay - torbutton.xul</a></span></dt><dt><span class="sect2"><a href="#id2531208">3.2. Preferences Window - preferences.xul</a></span></dt><dt><span class="sect2"><a href="#id2517777">3.3. Other Windows</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2530453">4. Toggle Code Path</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2527298">4.1. Button Click</a></span></dt><dt><span class="sect2"><a href="#id2530183">4.2. Proxy Update</a></span></dt><dt><span class="sect2"><a href="#id2520686">4.3. Settings Update</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2536355">5. Description of Options</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2533703">5.1. Test Settings</a></span></dt><dt><span class="sect2"><a href="#plugins">5.2. Disable plugins on Tor Usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2520603">5.3. Isolate Dynamic Content to Tor State (crucial)</a></span></dt><dt><span class="sect2"><a href="#jshooks">5.4. Hook Dangerous Javascript</a></span></dt><dt><span class="sect2"><a href="#id2521148">5.5. Resize windows to multiples of 50px during Tor usage (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2533829">5.6. Disable Updates During Tor</a></span></dt><dt><span class="sect2"><a href="#id2534724">5.7. Disable Search Suggestions during Tor (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2510788">5.8. Block Tor/Non-Tor access to network from file:// urls (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2496594">5.9. Close all Tor/Non-Tor tabs and windows on toggle (optional)</a></span></dt><dt><span class="sect2"><a href="#id2496675">5.10. Isolate Access to History navigation to Tor state (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2496760">5.11. History Access Settings</a></span></dt><dt><span class="sect2"><a href="#id2496873">5.12. Clear History During Tor Toggle (optional)</a></span></dt><dt><span class="sect2"><a href="#id2496919">5.13. Block Password+Form saving during Tor/Non-Tor</a></span></dt><dt><span class="sect2"><a href="#id2496986">5.14. Block Tor disk cache and clear all cache on Tor Toggle</a></span></dt><dt><span class="sect2"><a href="#id2497040">5.15. Block disk and memory cache during Tor</a></span></dt><dt><span class="sect2"><a href="#id2497098">5.16. Clear Cookies on Tor Toggle</a></span></dt><dt><span class="sect2"><a href="#id2497153">5.17. Store Non-Tor cookies in a protected jar</a></span></dt><dt><span class="sect2"><a href="#id2538692">5.18. Store both Non-Tor and Tor cookies in a protected jar (dangerous)</a></span></dt><dt><span class="sect2"><a href="#id2538731">5.19. Manage My Own Cookies (dangerous)</a></span></dt><dt><span class="sect2"><a href="#id2538746">5.20. Disable DOM Storage during Tor usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2538850">5.21. Clear HTTP Auth on Tor Toggle (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2538887">5.22. Clear cookies on Tor/Non-Tor shutdown</a></span></dt><dt><span class="sect2"><a href="#id2538941">5.23. Reload cookie jar/clear cookies on Firefox crash</a></span></dt><dt><span class="sect2"><a href="#id2539016">5.24. On crash recovery or session restored startup, restore via: Tor, Non-Tor</a></span></dt><dt><span class="sect2"><a href="#id2539088">5.25. On normal startup, set state to: Tor, Non-Tor, Shutdown State</a></span></dt><dt><span class="sect2"><a href="#id2539147">5.26. Prevent session store from saving Non-Tor/Tor-loaded tabs</a></span></dt><dt><span class="sect2"><a href="#id2539212">5.27. Set user agent during Tor usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2539386">5.28. Spoof US English Browser</a></span></dt><dt><span class="sect2"><a href="#id2539479">5.29. Don't send referrer during Tor Usage</a></span></dt><dt><span class="sect2"><a href="#id2539520">5.30. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)</a></span></dt></dl></dd><dt><span class="sect1"><a href="#FirefoxBugs">6. Relevant Firefox Bugs</a></span></dt><dd><dl><dt><span class="sect2"><a href="#FirefoxSecurity">6.1. Bugs impacting security</a></span></dt><dt><span class="sect2"><a href="#FirefoxWishlist">6.2. Bugs blocking functionality</a></span></dt><dt><span class="sect2"><a href="#FirefoxMiscBugs">6.3. Low Priority Bugs</a></span></dt></dl></dd><dt><span class="sect1"><a href="#TestPlan">7. Testing</a></span></dt><dd><dl><dt><span class="sect2"><a href="#SingleStateTesting">7.1. Single state testing</a></span></dt><dt><span class="sect2"><a href="#id2540533">7.2. Multi-state testing</a></span></dt><dt><span class="sect2"><a href="#HackTorbutton">7.3. Active testing (aka How to Hack Torbutton)</a></span></dt></dl></dd></dl></div><div class="sect1" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2514815"></a>1. Introduction</h2></div></div></div><p>
+<html xmlns="http://www.w3.org/1999/xhtml";><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Torbutton Design Documentation</title><meta name="generator" content="DocBook XSL Stylesheets V1.75.2" /></head><body><div class="article" title="Torbutton Design Documentation"><div class="titlepage"><div><div><h2 class="title"><a id="design"></a>Torbutton Design Documentation</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Mike</span> <span class="surname">Perry</span></h3><div class="affiliation"><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:mikeperry.fscked/org";>mikeperry.fscked/org</a>&gt;</code></p></div></div></div></div><div><p class="pubdate">Dec 15 2009</p></div></div><hr /></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="#id2510984">1. Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="#adversary">1.1. Adversary Model</a></span></dt><dt><span class="sect2"><a href="#requirements">1.2. Torbutton Requirements</a></span></dt><dt><span class="sect2"><a href="#layout">1.3. Extension Layout</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2541734">2. Components</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2509118">2.1. Hooked Components</a></span></dt><dt><span class="sect2"><a href="#id2513073">2.2. New Components</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2511168">3. Chrome</a></span></dt><dd><dl><dt><span class="sect2"><a href="#browseroverlay">3.1. Browser Overlay - torbutton.xul</a></span></dt><dt><span class="sect2"><a href="#id2521151">3.2. Preferences Window - preferences.xul</a></span></dt><dt><span class="sect2"><a href="#id2524897">3.3. Other Windows</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2538737">4. Toggle Code Path</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2519814">4.1. Button Click</a></span></dt><dt><span class="sect2"><a href="#id2519526">4.2. Proxy Update</a></span></dt><dt><span class="sect2"><a href="#id2504564">4.3. Settings Update</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2519462">5. Description of Options</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2542642">5.1. Test Settings</a></span></dt><dt><span class="sect2"><a href="#plugins">5.2. Disable plugins on Tor Usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2536168">5.3. Isolate Dynamic Content to Tor State (crucial)</a></span></dt><dt><span class="sect2"><a href="#jshooks">5.4. Hook Dangerous Javascript</a></span></dt><dt><span class="sect2"><a href="#id2530601">5.5. Resize windows to multiples of 50px during Tor usage (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2513266">5.6. Disable Updates During Tor</a></span></dt><dt><span class="sect2"><a href="#id2505201">5.7. Disable Search Suggestions during Tor (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2505239">5.8. Disable livemarks updates during Tor usage (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2505311">5.9. Block Tor/Non-Tor access to network from file:// urls (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2505383">5.10. Close all Tor/Non-Tor tabs and windows on toggle (optional)</a></span></dt><dt><span class="sect2"><a href="#id2505464">5.11. Isolate Access to History navigation to Tor state (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2505548">5.12. History Access Settings</a></span></dt><dt><span class="sect2"><a href="#id2505661">5.13. Clear History During Tor Toggle (optional)</a></span></dt><dt><span class="sect2"><a href="#id2505706">5.14. Block Password+Form saving during Tor/Non-Tor</a></span></dt><dt><span class="sect2"><a href="#id2547259">5.15. Block Tor disk cache and clear all cache on Tor Toggle</a></span></dt><dt><span class="sect2"><a href="#id2547309">5.16. Block disk and memory cache during Tor</a></span></dt><dt><span class="sect2"><a href="#id2547362">5.17. Clear Cookies on Tor Toggle</a></span></dt><dt><span class="sect2"><a href="#id2547413">5.18. Store Non-Tor cookies in a protected jar</a></span></dt><dt><span class="sect2"><a href="#id2547469">5.19. Store both Non-Tor and Tor cookies in a protected jar (dangerous)</a></span></dt><dt><span class="sect2"><a href="#id2547508">5.20. Manage My Own Cookies (dangerous)</a></span></dt><dt><span class="sect2"><a href="#id2547523">5.21. Disable DOM Storage during Tor usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2547627">5.22. Clear HTTP Auth on Tor Toggle (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2547664">5.23. Clear cookies on Tor/Non-Tor shutdown</a></span></dt><dt><span class="sect2"><a href="#id2547718">5.24. Reload cookie jar/clear cookies on Firefox crash</a></span></dt><dt><span class="sect2"><a href="#id2547794">5.25. On crash recovery or session restored startup, restore via: Tor, Non-Tor</a></span></dt><dt><span class="sect2"><a href="#id2547866">5.26. On normal startup, set state to: Tor, Non-Tor, Shutdown State</a></span></dt><dt><span class="sect2"><a href="#id2547925">5.27. Prevent session store from saving Non-Tor/Tor-loaded tabs</a></span></dt><dt><span class="sect2"><a href="#id2547990">5.28. Set user agent during Tor usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2548164">5.29. Spoof US English Browser</a></span></dt><dt><span class="sect2"><a href="#id2548257">5.30. Don't send referrer during Tor Usage</a></span></dt><dt><span class="sect2"><a href="#id2548297">5.31. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)</a></span></dt></dl></dd><dt><span class="sect1"><a href="#FirefoxBugs">6. Relevant Firefox Bugs</a></span></dt><dd><dl><dt><span class="sect2"><a href="#FirefoxSecurity">6.1. Bugs impacting security</a></span></dt><dt><span class="sect2"><a href="#FirefoxWishlist">6.2. Bugs blocking functionality</a></span></dt><dt><span class="sect2"><a href="#FirefoxMiscBugs">6.3. Low Priority Bugs</a></span></dt></dl></dd><dt><span class="sect1"><a href="#TestPlan">7. Testing</a></span></dt><dd><dl><dt><span class="sect2"><a href="#SingleStateTesting">7.1. Single state testing</a></span></dt><dt><span class="sect2"><a href="#id2549304">7.2. Multi-state testing</a></span></dt><dt><span class="sect2"><a href="#HackTorbutton">7.3. Active testing (aka How to Hack Torbutton)</a></span></dt></dl></dd></dl></div><div class="sect1" title="1. Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2510984"></a>1. Introduction</h2></div></div></div><p>
 
 This document describes the goals, operation, and testing procedures of the
-Torbutton Firefox extension. It is current as of Torbutton 1.2.2.
+Torbutton Firefox extension. It is current as of Torbutton 1.2.4.
 
-  </p><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="adversary"></a>1.1. Adversary Model</h3></div></div></div><p>
+  </p><div class="sect2" title="1.1. Adversary Model"><div class="titlepage"><div><div><h3 class="title"><a id="adversary"></a>1.1. Adversary Model</h3></div></div></div><p>
 
 A Tor web browser adversary has a number of goals, capabilities, and attack
 types that can be used to guide us towards a set of requirements for the
 Torbutton extension. Let's start with the goals.
 
-   </p><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="adversarygoals"></a>Adversary Goals</h4></div></div></div><div class="orderedlist"><ol type="1"><li><span class="command"><strong>Bypassing proxy settings</strong></span><p>The adversary's primary goal is direct compromise and bypass of 
+   </p><div class="sect3" title="Adversary Goals"><div class="titlepage"><div><div><h4 class="title"><a id="adversarygoals"></a>Adversary Goals</h4></div></div></div><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><span class="command"><strong>Bypassing proxy settings</strong></span><p>The adversary's primary goal is direct compromise and bypass of 
 Tor, causing the user to directly connect to an IP of the adversary's
-choosing.</p></li><li><span class="command"><strong>Correlation of Tor vs Non-Tor Activity</strong></span><p>If direct proxy bypass is not possible, the adversary will likely
+choosing.</p></li><li class="listitem"><span class="command"><strong>Correlation of Tor vs Non-Tor Activity</strong></span><p>If direct proxy bypass is not possible, the adversary will likely
 happily settle for the ability to correlate something a user did via Tor with
 their non-Tor activity. This can be done with cookies, cache identifiers,
 javascript events, and even CSS. Sometimes the fact that a user uses Tor may
-be enough for some authorities.</p></li><li><span class="command"><strong>History disclosure</strong></span><p>
+be enough for some authorities.</p></li><li class="listitem"><span class="command"><strong>History disclosure</strong></span><p>
 The adversary may also be interested in history disclosure: the ability to
 query a user's history to see if they have issued certain censored search
 queries, or visited censored sites.
-     </p></li><li><span class="command"><strong>Location information</strong></span><p>
+     </p></li><li class="listitem"><span class="command"><strong>Location information</strong></span><p>
 
 Location information such as timezone and locality can be useful for the
 adversary to determine if a user is in fact originating from one of the
 regions they are attempting to control, or to zero-in on the geographical
 location of a particular dissident or whistleblower.
 
-     </p></li><li><span class="command"><strong>Miscellaneous anonymity set reduction</strong></span><p>
+     </p></li><li class="listitem"><span class="command"><strong>Miscellaneous anonymity set reduction</strong></span><p>
 
 Anonymity set reduction is also useful in attempting to zero in on a
 particular individual. If the dissident or whistleblower is using a rare build
 of Firefox for an obscure operating system, this can be very useful
 information for tracking them down, or at least <a class="link" href="#fingerprinting">tracking their activities</a>.
 
-     </p></li><li><span class="command"><strong>History records and other on-disk
+     </p></li><li class="listitem"><span class="command"><strong>History records and other on-disk
 information</strong></span><p>
 In some cases, the adversary may opt for a heavy-handed approach, such as
 seizing the computers of all Tor users in an area (especially after narrowing
 the field by the above two pieces of information). History records and cache
 data are the primary goals here.
-     </p></li></ol></div></div><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="adversarypositioning"></a>Adversary Capabilities - Positioning</h4></div></div></div><p>
+     </p></li></ol></div></div><div class="sect3" title="Adversary Capabilities - Positioning"><div class="titlepage"><div><div><h4 class="title"><a id="adversarypositioning"></a>Adversary Capabilities - Positioning</h4></div></div></div><p>
 The adversary can position themselves at a number of different locations in
 order to execute their attacks.
-    </p><div class="orderedlist"><ol type="1"><li><span class="command"><strong>Exit Node or Upstream Router</strong></span><p>
+    </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><span class="command"><strong>Exit Node or Upstream Router</strong></span><p>
 The adversary can run exit nodes, or alternatively, they may control routers
 upstream of exit nodes. Both of these scenarios have been observed in the
 wild.
-     </p></li><li><span class="command"><strong>Adservers and/or Malicious Websites</strong></span><p>
+     </p></li><li class="listitem"><span class="command"><strong>Adservers and/or Malicious Websites</strong></span><p>
 The adversary can also run websites, or more likely, they can contract out
 ad space from a number of different adservers and inject content that way. For
 some users, the adversary may be the adservers themselves. It is not
 inconceivable that adservers may try to subvert or reduce a user's anonymity 
 through Tor for marketing purposes.
-     </p></li><li><span class="command"><strong>Local Network/ISP/Upstream Router</strong></span><p>
+     </p></li><li class="listitem"><span class="command"><strong>Local Network/ISP/Upstream Router</strong></span><p>
 The adversary can also inject malicious content at the user's upstream router
 when they have Tor disabled, in an attempt to correlate their Tor and Non-Tor
 activity.
-     </p></li><li><span class="command"><strong>Physical Access</strong></span><p>
+     </p></li><li class="listitem"><span class="command"><strong>Physical Access</strong></span><p>
 Some users face adversaries with intermittent or constant physical access.
 Users in Internet cafes, for example, face such a threat. In addition, in
 countries where simply using tools like Tor is illegal, users may face
 confiscation of their computer equipment for excessive Tor usage or just
 general suspicion.
-     </p></li></ol></div></div><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="attacks"></a>Adversary Capabilities - Attacks</h4></div></div></div><p>
+     </p></li></ol></div></div><div class="sect3" title="Adversary Capabilities - Attacks"><div class="titlepage"><div><div><h4 class="title"><a id="attacks"></a>Adversary Capabilities - Attacks</h4></div></div></div><p>
 
 The adversary can perform the following attacks from a number of different 
 positions to accomplish various aspects of their goals. It should be noted
@@ -74,7 +74,7 @@ CSS elements, and plugins. Others are performed by adservers seeking to
 correlate users' activity across different IP addresses, and still others are
 performed by malicious agents on the Tor network and at national firewalls.
 
-    </p><div class="orderedlist"><ol type="1"><li><span class="command"><strong>Inserting Javascript</strong></span><p>
+    </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><span class="command"><strong>Inserting Javascript</strong></span><p>
 If not properly disabled, Javascript event handlers and timers
 can cause the browser to perform network activity after Tor has been disabled,
 thus allowing the adversary to correlate Tor and Non-Tor activity and reveal
@@ -87,7 +87,7 @@ Javascript can be used to query the user's timezone via the
 <code class="function">Date()</code> object, and to reduce the anonymity set by querying
 the <code class="function">navigator</code> object for operating system, CPU, locale, 
 and user agent information.
-     </p></li><li><span class="command"><strong>Inserting Plugins</strong></span><p>
+     </p></li><li class="listitem"><span class="command"><strong>Inserting Plugins</strong></span><p>
 
 Plugins are abysmal at obeying the proxy settings of the browser. Every plugin
 capable of performing network activity that the author has
@@ -102,7 +102,7 @@ difficult to clear than standard cookies.
 cookies</a> fall into this category, but there are likely numerous other
 examples.
 
-     </p></li><li><span class="command"><strong>Inserting CSS</strong></span><p>
+     </p></li><li class="listitem"><span class="command"><strong>Inserting CSS</strong></span><p>
 
 CSS can also be used to correlate Tor and Non-Tor activity and reveal a user's
 Non-Tor IP address, via the usage of
@@ -113,7 +113,7 @@ activity in a different Tor state than they were loaded in, they can easily
 correlate Tor and Non-Tor activity and reveal a user's IP address. In
 addition, CSS can also be used without Javascript to perform <a class="ulink" href="http://ha.ckers.org/weird/CSS-history.cgi"; target="_top">CSS-only history disclosure
 attacks</a>.
-     </p></li><li><span class="command"><strong>Read and insert cookies</strong></span><p>
+     </p></li><li class="listitem"><span class="command"><strong>Read and insert cookies</strong></span><p>
 
 An adversary in a position to perform MITM content alteration can inject
 document content elements to both read and inject cookies for
@@ -121,14 +121,14 @@ arbitrary domains. In fact, many "SSL secured" websites are vulnerable to this
 sort of <a class="ulink" href="http://seclists.org/bugtraq/2007/Aug/0070.html"; target="_top">active
 sidejacking</a>.
 
-     </p></li><li><span class="command"><strong>Create arbitrary cached content</strong></span><p>
+     </p></li><li class="listitem"><span class="command"><strong>Create arbitrary cached content</strong></span><p>
 
 Likewise, the browser cache can also be used to <a class="ulink" href="http://crypto.stanford.edu/sameorigin/safecachetest.html"; target="_top">store unique
 identifiers</a>. Since by default the cache has no same-origin policy,
 these identifiers can be read by any domain, making them an ideal target for
 adserver-class adversaries.
 
-     </p></li><li><a id="fingerprinting"></a><span class="command"><strong>Fingerprint users based on browser
+     </p></li><li class="listitem"><a id="fingerprinting"></a><span class="command"><strong>Fingerprint users based on browser
 attributes</strong></span><p>
 
 There is an absurd amount of information available to websites via attributes
@@ -172,7 +172,7 @@ competent and determined adversary such as an ad network.  Again, a
 nearest-neighbor bit vector space approach here would also gracefully handle
 incremental changes to installed extensions.
 
-</p></li><li><span class="command"><strong>Remotely or locally exploit browser and/or
+</p></li><li class="listitem"><span class="command"><strong>Remotely or locally exploit browser and/or
 OS</strong></span><p>
 Last, but definitely not least, the adversary can exploit either general 
 browser vulnerabilities, plugin vulnerabilities, or OS vulnerabilities to
@@ -180,7 +180,7 @@ install malware and surveillance software. An adversary with physical access
 can perform similar actions. Regrettably, this last attack capability is
 outside of Torbutton's ability to defend against, but it is worth mentioning
 for completeness.
-     </p></li></ol></div></div></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="requirements"></a>1.2. Torbutton Requirements</h3></div></div></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3>
+     </p></li></ol></div></div></div><div class="sect2" title="1.2. Torbutton Requirements"><div class="titlepage"><div><div><h3 class="title"><a id="requirements"></a>1.2. Torbutton Requirements</h3></div></div></div><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3>
 
 Since many settings satisfy multiple requirements, this design document is
 organized primarily by Torbutton components and settings. However, if you are
@@ -193,27 +193,27 @@ that requirement.
 
 From the above Adversary Model, a number of requirements become clear. 
 
-   </p><div class="orderedlist"><ol type="1"><li><a id="proxy"></a><span class="command"><strong>Proxy Obedience</strong></span><p>The browser
-MUST NOT bypass Tor proxy settings for any content.</p></li><li><a id="isolation"></a><span class="command"><strong>Network Isolation</strong></span><p>Pages MUST NOT perform any network activity in a Tor state different
- from the state they were originally loaded in.</p></li><li><a id="state"></a><span class="command"><strong>State Separation</strong></span><p>Browser state (cookies, cache, history, 'DOM storage'), accumulated in
+   </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><a id="proxy"></a><span class="command"><strong>Proxy Obedience</strong></span><p>The browser
+MUST NOT bypass Tor proxy settings for any content.</p></li><li class="listitem"><a id="isolation"></a><span class="command"><strong>Network Isolation</strong></span><p>Pages MUST NOT perform any network activity in a Tor state different
+ from the state they were originally loaded in.</p></li><li class="listitem"><a id="state"></a><span class="command"><strong>State Separation</strong></span><p>Browser state (cookies, cache, history, 'DOM storage'), accumulated in
  one Tor state MUST NOT be accessible via the network in
- another Tor state.</p></li><li><a id="undiscoverability"></a><span class="command"><strong>Tor Undiscoverability</strong></span><p>With
+ another Tor state.</p></li><li class="listitem"><a id="undiscoverability"></a><span class="command"><strong>Tor Undiscoverability</strong></span><p>With
 the advent of bridge support in Tor 0.2.0.x, there are now a class of Tor
 users whose network fingerprint does not obviously betray the fact that they
 are using Tor. This should extend to the browser as well - Torbutton MUST NOT 
-reveal its presence while Tor is disabled.</p></li><li><a id="disk"></a><span class="command"><strong>Disk Avoidance</strong></span><p>The browser SHOULD NOT write any Tor-related state to disk, or store it
- in memory beyond the duration of one Tor toggle.</p></li><li><a id="location"></a><span class="command"><strong>Location Neutrality</strong></span><p>The browser SHOULD NOT leak location-specific information, such as
- timezone or locale via Tor.</p></li><li><a id="setpreservation"></a><span class="command"><strong>Anonymity Set
+reveal its presence while Tor is disabled.</p></li><li class="listitem"><a id="disk"></a><span class="command"><strong>Disk Avoidance</strong></span><p>The browser SHOULD NOT write any Tor-related state to disk, or store it
+ in memory beyond the duration of one Tor toggle.</p></li><li class="listitem"><a id="location"></a><span class="command"><strong>Location Neutrality</strong></span><p>The browser SHOULD NOT leak location-specific information, such as
+ timezone or locale via Tor.</p></li><li class="listitem"><a id="setpreservation"></a><span class="command"><strong>Anonymity Set
 Preservation</strong></span><p>The browser SHOULD NOT leak any other anonymity set reducing information 
  (such as user agent, extension presence, and resolution information)
 automatically via Tor. The assessment of the attacks above should make it clear
 that anonymity set reduction is a very powerful method of tracking and
 eventually identifying anonymous users.
-</p></li><li><a id="updates"></a><span class="command"><strong>Update Safety</strong></span><p>The browser
-SHOULD NOT perform unauthenticated updates or upgrades via Tor.</p></li><li><a id="interoperate"></a><span class="command"><strong>Interoperability</strong></span><p>Torbutton SHOULD interoperate with third-party proxy switchers that
+</p></li><li class="listitem"><a id="updates"></a><span class="command"><strong>Update Safety</strong></span><p>The browser
+SHOULD NOT perform unauthenticated updates or upgrades via Tor.</p></li><li class="listitem"><a id="interoperate"></a><span class="command"><strong>Interoperability</strong></span><p>Torbutton SHOULD interoperate with third-party proxy switchers that
  enable the user to switch between a number of different proxies. It MUST
  provide full Tor protection in the event a third-party proxy switcher has
- enabled the Tor proxy settings.</p></li></ol></div></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="layout"></a>1.3. Extension Layout</h3></div></div></div><p>Firefox extensions consist of two main categories of code: 'Components' and
+ enabled the Tor proxy settings.</p></li></ol></div></div><div class="sect2" title="1.3. Extension Layout"><div class="titlepage"><div><div><h3 class="title"><a id="layout"></a>1.3. Extension Layout</h3></div></div></div><p>Firefox extensions consist of two main categories of code: 'Components' and
 'Chrome'. Components are a fancy name for classes that implement a given
 interface or interfaces. In Firefox, components <a class="ulink" href="https://developer.mozilla.org/en/XPCOM"; target="_top">can be
 written</a> in C++,
@@ -231,17 +231,16 @@ obsolete and deprecated interfaces and has proved to be less than
 stable.</p><p>'Chrome' is a combination of XML and Javascript used to describe a window.
 Extensions are allowed to create 'overlays' that are 'bound' to existing XML
 window definitions, or they can create their own windows. The DTD for this XML
-is called <a class="ulink" href="http://developer.mozilla.org/en/docs/XUL_Reference"; target="_top">XUL</a>.</p></div></div><div class="sect1" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2532634"></a>2. Components</h2></div></div></div><p>
+is called <a class="ulink" href="http://developer.mozilla.org/en/docs/XUL_Reference"; target="_top">XUL</a>.</p></div></div><div class="sect1" title="2. Components"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2541734"></a>2. Components</h2></div></div></div><p>
 
 Torbutton installs components for two purposes: hooking existing components to
 reimplement their interfaces; and creating new components that provide
 services to other pieces of the extension.
 
-  </p><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2537349"></a>2.1. Hooked Components</h3></div></div></div><p>Torbutton makes extensive use of Contract ID hooking, and implements some
+  </p><div class="sect2" title="2.1. Hooked Components"><div class="titlepage"><div><div><h3 class="title"><a id="id2509118"></a>2.1. Hooked Components</h3></div></div></div><p>Torbutton makes extensive use of Contract ID hooking, and implements some
 of its own standalone components as well.  Let's discuss the hooked components
-first.</p><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="sessionstore"></a><a class="ulink" href="http://developer.mozilla.org/en/docs/nsISessionStore"; target="_top">@mozilla.org/browser/sessionstore;1</a> -
-<a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/nsSessionStore2.js"; target="_top">components/nsSessionStore2.js</a>
-and <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/nsSessionStore3.js"; target="_top">components/nsSessionStore3.js</a></h4></div></div></div><p>These components address the <a class="link" href="#disk">Disk Avoidance</a>
+first.</p><div class="sect3" title="@mozilla.org/browser/sessionstore;1 - components/nsSessionStore36.js"><div class="titlepage"><div><div><h4 class="title"><a id="sessionstore"></a><a class="ulink" href="http://developer.mozilla.org/en/docs/nsISessionStore"; target="_top">@mozilla.org/browser/sessionstore;1</a> -
+<a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/nsSessionStore36.js"; target="_top">components/nsSessionStore36.js</a></h4></div></div></div><p>These components address the <a class="link" href="#disk">Disk Avoidance</a>
 requirements of Torbutton. As stated in the requirements, Torbutton needs to
 prevent Tor tabs from being written to disk by the Firefox session store for a
 number of reasons, primary among them is the fact that Firefox can crash at
@@ -251,23 +250,24 @@ only hook member functions of a class if they are published in an
 interface that the class implements. Unfortunately, the sessionstore has no
 published interface that is amenable to disabling the writing out of Tor tabs
 in specific. As such, Torbutton had to include the <span class="emphasis"><em>entire</em></span>
-nsSessionStore from both Firefox 2 and Firefox 3, 
+nsSessionStore from both Firefox 2.0, 3.0, 3.5 and 3.6
 with a couple of modifications to prevent tabs that were loaded with Tor
 enabled from being written to disk, and some version detection code to
-determine which component to load. The <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/nsSessionStore3.diff"; target="_top">diff against the original session
-store</a> is included in the SVN repository.</p></div><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="appblocker"></a><a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/uriloader/external-protocol-service%3B1"; target="_top">@mozilla.org/uriloader/external-protocol-service;1
-</a> and <a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/uriloader/external-helper-app-service%3B1"; target="_top">@mozilla.org/uriloader/external-helper-app-service;1</a>
-- <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/external-app-blocker.js"; target="_top">components/external-app-blocker.js</a></h4></div></div></div><p>
+determine which component to load. The <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/nsSessionStore36.diff"; target="_top">diff against the original session
+store</a> is included in the git repository.</p></div><div class="sect3" title="@mozilla.org/uriloader/external-protocol-service;1 , @mozilla.org/uriloader/external-helper-app-service;1, and @mozilla.org/mime;1 - components/external-app-blocker.js"><div class="titlepage"><div><div><h4 class="title"><a id="appblocker"></a><a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/uriloader/external-protocol-service%3B1"; target="_top">@mozilla.org/uriloader/external-protocol-service;1
+</a>, <a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/uriloader/external-helper-app-service%3B1"; target="_top">@mozilla.org/uriloader/external-helper-app-service;1</a>,
+and <a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/mime%3B1"; target="_top">@mozilla.org/mime;1</a>
+- <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/external-app-blocker.js"; target="_top">components/external-app-blocker.js</a></h4></div></div></div><p>
 Due to <a class="link" href="#FirefoxBugs" title="6. Relevant Firefox Bugs">Firefox Bug</a> <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=440892"; target="_top">440892</a> allowing Firefox 3.x to automatically launch some
-applications without user intervention, Torbutton had to wrap the two
+applications without user intervention, Torbutton had to wrap the three
 components involved in launching external applications to provide user
 confirmation before doing so while Tor is enabled. Since external applications
 do not obey proxy settings, they can be manipulated to automatically connect
 back to arbitrary servers outside of Tor with no user intervention. Fixing
 this issue helps to satisfy Torbutton's <a class="link" href="#proxy">Proxy
 Obedience</a> Requirement.
- </p></div><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id2536160"></a><a class="ulink" href="http://lxr.mozilla.org/seamonkey/source/browser/components/sessionstore/src/nsSessionStartup.js"; target="_top">@mozilla.org/browser/sessionstartup;1</a> -
-    <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/crash-observer.js"; target="_top">components/crash-observer.js</a></h4></div></div></div><p>This component wraps the Firefox Session Startup component that is in
+ </p></div><div class="sect3" title="@mozilla.org/browser/sessionstartup;1 - components/crash-observer.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2523615"></a><a class="ulink" href="http://lxr.mozilla.org/seamonkey/source/browser/components/sessionstore/src/nsSessionStartup.js"; target="_top">@mozilla.org/browser/sessionstartup;1</a> -
+    <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/crash-observer.js"; target="_top">components/crash-observer.js</a></h4></div></div></div><p>This component wraps the Firefox Session Startup component that is in
 charge of <a class="ulink" href="http://developer.mozilla.org/en/docs/Session_store_API"; target="_top">restoring saved
 sessions</a>. The wrapper's only job is to intercept the
 <code class="function">doRestore()</code> function, which is called by Firefox if it is determined that the
@@ -280,8 +280,8 @@ includes setting the Tor state to the one the user selected for crash recovery
 in the preferences window (<span class="command"><strong>extensions.torbutton.restore_tor</strong></span>), and
 restoring cookies for the corresponding cookie jar, if it exists.</p><p>By performing this notification, this component assists in the 
 <a class="link" href="#proxy">Proxy Obedience</a>, and <a class="link" href="#isolation">Network Isolation</a> requirements.
-</p></div><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id2530963"></a><a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/browser/global-history;2"; target="_top">@mozilla.org/browser/global-history;2</a>
-- <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/ignore-history.js"; target="_top">components/ignore-history.js</a></h4></div></div></div><p>This component was contributed by <a class="ulink" href="http://www.collinjackson.com/"; target="_top">Collin Jackson</a> as a method for defeating
+</p></div><div class="sect3" title="@mozilla.org/browser/global-history;2 - components/ignore-history.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2535078"></a><a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/browser/global-history;2"; target="_top">@mozilla.org/browser/global-history;2</a>
+- <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/ignore-history.js"; target="_top">components/ignore-history.js</a></h4></div></div></div><p>This component was contributed by <a class="ulink" href="http://www.collinjackson.com/"; target="_top">Collin Jackson</a> as a method for defeating
 CSS and Javascript-based methods of history disclosure. The global-history
 component is what is used by Firefox to determine if a link was visited or not
 (to apply the appropriate style to the link). By hooking the <a class="ulink" href="https://developer.mozilla.org/en/nsIGlobalHistory2#isVisited.28.29"; target="_top">isVisited</a>
@@ -292,9 +292,22 @@ preferences.
 </p><p>
 This component helps satisfy the <a class="link" href="#state">State Separation</a>
 and <a class="link" href="#disk">Disk Avoidance</a> requirements of Torbutton.
-</p></div></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2523758"></a>2.2. New Components</h3></div></div></div><p>Torbutton creates four new components that are used throughout the
+</p></div><div class="sect3" title="@mozilla.org/browser/livemark-service;2 - components/block-livemarks.js"><div class="titlepage"><div><div><h4 class="title"><a id="livemarks"></a><a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/browser/livemark-service;2"; target="_top">@mozilla.org/browser/livemark-service;2</a>
+- <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/block-livemarks.js"; target="_top">components/block-livemarks.js</a></h4></div></div></div><p>
+
+The <a class="ulink" href="http://www.mozilla.com/en-US/firefox/livebookmarks.html"; target="_top">livemark</a> service
+is started by a timer that runs 5 seconds after Firefox
+startup. As a result, we cannot simply call the stopUpdateLivemarks() method to
+disable it. We must wrap the component to prevent this start() call from
+firing in the event the browser starts in Tor mode.
+
+</p><p>
+This component helps satisfy the <a class="link" href="#isolation">Network
+Isolation</a> and <a class="link" href="#setpreservation">Anonymity Set
+Preservation</a> requirements.
+</p></div></div><div class="sect2" title="2.2. New Components"><div class="titlepage"><div><div><h3 class="title"><a id="id2513073"></a>2.2. New Components</h3></div></div></div><p>Torbutton creates four new components that are used throughout the
 extension. These components do not hook any interfaces, nor are they used
-anywhere besides Torbutton itself.</p><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id2536032"></a><a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/cookie-jar-selector.js"; target="_top">@stanford.edu/cookie-jar-selector;2
+anywhere besides Torbutton itself.</p><div class="sect3" title="@torproject.org/cookie-jar-selector;2 - components/cookie-jar-selector.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2541606"></a><a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-jar-selector.js"; target="_top">@torproject.org/cookie-jar-selector;2
 - components/cookie-jar-selector.js</a></h4></div></div></div><p>The cookie jar selector (also based on code from <a class="ulink" href="http://www.collinjackson.com/"; target="_top">Collin
 Jackson</a>) is used by the Torbutton chrome to switch between
 Tor and Non-Tor cookies. Its operations are simple: sync cookies to disk, then
@@ -303,7 +316,7 @@ move the current cookies.txt file to the appropriate backup location
 into place.</p><p>
 This component helps to address the <a class="link" href="#state">State
 Isolation</a> requirement of Torbutton.
-</p></div><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id2511960"></a><a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/torbutton-logger.js"; target="_top">@torproject.org/torbutton-logger;1
+</p></div><div class="sect3" title="@torproject.org/torbutton-logger;1 - components/torbutton-logger.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2528340"></a><a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/torbutton-logger.js"; target="_top">@torproject.org/torbutton-logger;1
 - components/torbutton-logger.js</a></h4></div></div></div><p>The torbutton logger component allows on-the-fly redirection of torbutton
 logging messages to either Firefox stderr
 (<span class="command"><strong>extensions.torbutton.logmethod=0</strong></span>), the Javascript error console
@@ -311,7 +324,7 @@ logging messages to either Firefox stderr
 available - <span class="command"><strong>extensions.torbutton.logmethod=2</strong></span>). It also allows you to
 change the loglevel on the fly by changing
 <span class="command"><strong>extensions.torbutton.loglevel</strong></span> (1-5, 1 is most verbose).
-</p></div><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="windowmapper"></a><a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/window-mapper.js"; target="_top">@torproject.org/content-window-mapper;1
+</p></div><div class="sect3" title="@torproject.org/content-window-mapper;1 - components/window-mapper.js"><div class="titlepage"><div><div><h4 class="title"><a id="windowmapper"></a><a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/window-mapper.js"; target="_top">@torproject.org/content-window-mapper;1
 - components/window-mapper.js</a></h4></div></div></div><p>Torbutton tags Firefox <a class="ulink" href="https://developer.mozilla.org/en/XUL_Tutorial/Tabboxes"; target="_top">tabs</a> with a special variable that indicates the Tor
 state the tab was most recently used under to fetch a page. The problem is
 that for many Firefox events, it is not possible to determine the tab that is
@@ -322,7 +335,7 @@ window</a>. It does this by traversing all windows and all browsers, until it
 finds the browser with the requested <a class="ulink" href="https://developer.mozilla.org/en/XUL/tabbrowser#p-contentWindow"; target="_top">contentWindow</a> element. Since the content policy
 and page loading in general can generate hundreds of these lookups, this
 result is cached inside the component.
-</p></div><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="contentpolicy"></a><a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/cssblocker.js"; target="_top">@torproject.org/cssblocker;1
+</p></div><div class="sect3" title="@torproject.org/cssblocker;1 - components/cssblocker.js"><div class="titlepage"><div><div><h4 class="title"><a id="contentpolicy"></a><a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cssblocker.js"; target="_top">@torproject.org/cssblocker;1
 - components/cssblocker.js</a></h4></div></div></div><p>This is a key component to Torbutton's security measures. When Tor is
 toggled, Javascript is disabled, and pages are instructed to stop loading.
 However, CSS is still able to perform network operations by loading styles for
@@ -346,7 +359,7 @@ disabled. </p><p>
 
 Finally, some of the work that logically belongs to the content policy is
 instead handled by the <span class="command"><strong>torbutton_http_observer</strong></span> and
-<span class="command"><strong>torbutton_weblistener</strong></span> in <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/chrome/content/torbutton.js"; target="_top">torbutton.js</a>. These two objects handle blocking of
+<span class="command"><strong>torbutton_weblistener</strong></span> in <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/torbutton.js"; target="_top">torbutton.js</a>. These two objects handle blocking of
 Firefox 3 favicon loads, popups, and full page plugins, which for whatever
 reason are not passed to the Firefox content policy itself (see Firefox Bugs 
 <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=437014"; target="_top">437014</a> and 
@@ -355,11 +368,11 @@ reason are not passed to the Firefox content policy itself (see Firefox Bugs
 </p><p>
 
 This helps to fulfill both the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> and the <a class="link" href="#undiscoverability">Tor Undiscoverability</a> requirements of
-Torbutton.</p></div></div></div><div class="sect1" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2526366"></a>3. Chrome</h2></div></div></div><p>The chrome is where all the torbutton graphical elements and windows are
+Torbutton.</p></div></div></div><div class="sect1" title="3. Chrome"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2511168"></a>3. Chrome</h2></div></div></div><p>The chrome is where all the torbutton graphical elements and windows are
 located. Each window is described as an <a class="ulink" href="http://developer.mozilla.org/en/docs/XUL_Reference"; target="_top">XML file</a>, with zero or more Javascript
 files attached. The scope of these Javascript files is their containing
-window.</p><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="browseroverlay"></a>3.1. Browser Overlay - <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/chrome/content/torbutton.xul"; target="_top">torbutton.xul</a></h3></div></div></div><p>The browser overlay, torbutton.xul, defines the toolbar button, the status
-bar, and events for toggling the button. The overlay code is in <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/chrome/content/torbutton.js"; target="_top">chrome/content/torbutton.js</a>.
+window.</p><div class="sect2" title="3.1. Browser Overlay - torbutton.xul"><div class="titlepage"><div><div><h3 class="title"><a id="browseroverlay"></a>3.1. Browser Overlay - <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/torbutton.xul"; target="_top">torbutton.xul</a></h3></div></div></div><p>The browser overlay, torbutton.xul, defines the toolbar button, the status
+bar, and events for toggling the button. The overlay code is in <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/torbutton.js"; target="_top">chrome/content/torbutton.js</a>.
 It contains event handlers for preference update, shutdown, upgrade, and
 location change events.</p><p>The <a class="ulink" href="https://developer.mozilla.org/en/nsIWebProgressListener#onLocationChange"; target="_top">location
 change</a> <a class="ulink" href="https://developer.mozilla.org/en/nsIWebProgress"; target="_top">webprogress
@@ -379,42 +392,32 @@ are better enumerated in each of the Torbutton preferences below. However,
 there are also a number of Firefox preferences set in
 <code class="function">torbutton_update_status()</code> that aren't governed by any
 Torbutton setting. These are:
-</p><div class="orderedlist"><ol type="1"><li><a class="ulink" href="http://kb.mozillazine.org/Browser.bookmarks.livemark_refresh_seconds"; target="_top">browser.bookmarks.livemark_refresh_seconds</a><p>
-This pref is set in an attempt to disable the fetching of LiveBookmarks via
-Tor. Since users can potentially collect a large amount of live bookmarks to
-very personal sites (blogs of friends, wikipedia articles they maintain,
-comment feeds of their own blog), it is not possible to cleanly isolate these
-fetches and they are simply disabled during Tor usage.
-This helps to address the <a class="link" href="#state">State Separation</a> requirement.
-Unfortunately <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=436250"; target="_top">Firefox Bug
-436250</a> prevents this from
-functioning completely correctly.
-</p></li><li><a class="ulink" href="http://kb.mozillazine.org/Network.security.ports.banned"; target="_top">network.security.ports.banned</a><p>
+</p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><a class="ulink" href="http://kb.mozillazine.org/Network.security.ports.banned"; target="_top">network.security.ports.banned</a><p>
 Torbutton sets this setting to add ports 8123, 8118, 9050 and 9051 (which it
 reads from <span class="command"><strong>extensions.torbutton.banned_ports</strong></span>) to the list
 of ports Firefox is forbidden to access. These ports are Polipo, Privoxy, Tor,
 and the Tor control port, respectively. This is set for both Tor and Non-Tor
 usage, and prevents websites from attempting to do http fetches from these
 ports to see if they are open, which addresses the <a class="link" href="#undiscoverability">Tor Undiscoverability</a> requirement.
- </p></li><li><a class="ulink" href="http://kb.mozillazine.org/Browser.send_pings"; target="_top">browser.send_pings</a><p>
+ </p></li><li class="listitem"><a class="ulink" href="http://kb.mozillazine.org/Browser.send_pings"; target="_top">browser.send_pings</a><p>
 This setting is currently always disabled. If anyone ever complains saying
 that they *want* their browser to be able to send ping notifications to a
 page or arbitrary link, I'll make this a pref or Tor-only. But I'm not holding
 my breath. I haven't checked if the content policy is called for pings, but if
 not, this setting helps with meeting the <a class="link" href="#isolation">Network
 Isolation</a> requirement.
- </p></li><li><a class="ulink" href="http://kb.mozillazine.org/Browser.safebrowsing.remoteLookups"; target="_top">browser.safebrowsing.remoteLookups</a><p>
+ </p></li><li class="listitem"><a class="ulink" href="http://kb.mozillazine.org/Browser.safebrowsing.remoteLookups"; target="_top">browser.safebrowsing.remoteLookups</a><p>
 Likewise for this setting. I find it hard to imagine anyone who wants to ask
 Google in real time if each URL they visit is safe, especially when the list
 of unsafe URLs is downloaded anyway. This helps fulfill the <a class="link" href="#disk">Disk Avoidance</a> requirement, by preventing your entire
 browsing history from ending up on Google's disks.
- </p></li><li><a class="ulink" href="http://kb.mozillazine.org/Browser.safebrowsing.enabled"; target="_top">browser.safebrowsing.enabled</a><p>
+ </p></li><li class="listitem"><a class="ulink" href="http://kb.mozillazine.org/Browser.safebrowsing.enabled"; target="_top">browser.safebrowsing.enabled</a><p>
 Safebrowsing does <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=360387"; target="_top">unauthenticated
 updates under Firefox 2</a>, so it is disabled during Tor usage. 
 This helps fulfill the <a class="link" href="#updates">Update
 Safety</a> requirement. Firefox 3 has the fix for that bug, and so
 safebrowsing updates are enabled during Tor usage.
- </p></li><li><a class="ulink" href="http://kb.mozillazine.org/Network.protocol-handler.warn-external.%28protocol%29"; target="_top">network.protocol-handler.warn-external.(protocol)</a><p>
+ </p></li><li class="listitem"><a class="ulink" href="http://kb.mozillazine.org/Network.protocol-handler.warn-external.%28protocol%29"; target="_top">network.protocol-handler.warn-external.(protocol)</a><p>
 If Tor is enabled, we need to prevent random external applications from
 launching without at least warning the user. This group of settings only
 partially accomplishes this, however. Applications can still be launched via
@@ -425,7 +428,7 @@ pages. Unfortunately, due to <a class="link" href="#FirefoxBugs" title="6. Rele
 <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=440892"; target="_top">440892</a>,
 these prefs are no longer obeyed. They are set still anyway out of respect for
 the dead.
- </p></li><li><a class="ulink" href="http://kb.mozillazine.org/Browser.sessionstore.max_tabs_undo"; target="_top">browser.sessionstore.max_tabs_undo</a><p>
+ </p></li><li class="listitem"><a class="ulink" href="http://kb.mozillazine.org/Browser.sessionstore.max_tabs_undo"; target="_top">browser.sessionstore.max_tabs_undo</a><p>
 
 To help satisfy the Torbutton <a class="link" href="#state">State Separation</a>
 and <a class="link" href="#isolation">Network Isolation</a> requirements,
@@ -434,7 +437,7 @@ Torbutton needs to purge the Undo Tab history on toggle to prevent repeat
 State. This purge is accomplished by setting this preference to 0 and then
 restoring it to the previous user value upon toggle.
 
-   </p></li><li><span class="command"><strong>security.enable_ssl2</strong></span><p>
+   </p></li><li class="listitem"><span class="command"><strong>security.enable_ssl2</strong></span><p>
 TLS Session IDs can persist for an indefinite duration, providing an
 identifier that is sent to TLS sites that can be used to link activity. This
 is particularly troublesome now that we have certificate verification in place
@@ -450,14 +453,56 @@ better if there were a more standard interface for accomplishing the same
 thing. <a class="link" href="#FirefoxBugs" title="6. Relevant Firefox Bugs">Firefox Bug</a> <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=448747"; target="_top">448747</a> has
 been filed for this.
 
-   </p></li></ol></div></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2531208"></a>3.2. Preferences Window - <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/chrome/content/preferences.xul"; target="_top">preferences.xul</a></h3></div></div></div><p>The preferences window of course lays out the Torbutton preferences, with
-handlers located in <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/chrome/content/preferences.js"; target="_top">chrome/content/preferences.js</a>.</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2517777"></a>3.3. Other Windows</h3></div></div></div><p>There are additional windows that describe popups for right clicking on
-the status bar, the toolbutton, and the about page.</p></div></div><div class="sect1" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2530453"></a>4. Toggle Code Path</h2></div></div></div><p>
+   </p></li><li class="listitem"><span class="command"><strong><a class="ulink" href="http://www.mozilla.com/en-US/firefox/geolocation/"; target="_top">geo.enabled</a></strong></span><p>
+
+Torbutton disables Geolocation support in Firefox 3.5 and above whenever tor
+is enabled. This helps Torbutton maintain its
+<a class="link" href="#location">Location Neutrality</a> requirement.
+While Firefox does prompt before divulging geolocational information,
+the assumption is that Tor users will never want to give their
+location away during Tor usage, and even allowing websites to prompt
+them to do so will only cause confusion and accidents to happen. Moreover,
+just because users may approve a site to know their location in non-Tor mode
+does not mean they want it divulged during Tor mode.
+
+   </p></li><li class="listitem"><span class="command"><strong><a class="ulink" href="http://kb.mozillazine.org/Browser.zoom.siteSpecific"; target="_top">browser.zoom.siteSpecific</a></strong></span><p>
+
+Firefox actually remembers your zoom settings for certain sites. CSS
+and Javascript rule can use this to recognize previous visitors to a site.
+This helps Torbutton fulfill its <a class="link" href="#state">State Separation</a>
+requirement.
+
+   </p></li><li class="listitem"><span class="command"><strong><a class="ulink" href="https://developer.mozilla.org/en/controlling_dns_prefetching"; target="_top">network.dns.disablePrefetch</a></strong></span><p>
+
+Firefox 3.5 and above implement prefetching of DNS resolution for hostnames in
+links on a page to decrease page load latency. While Firefox does typically
+disable this behavior when proxies are enabled, we set this pref for added
+safety during Tor usage. Additionally, to prevent Tor-loaded tabs from having
+their links prefetched after a toggle to Non-Tor mode occurs,
+we also set the docShell attribute
+<a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsIDocShell"; target="_top">
+allowDNSPrefetch</a> to false on Tor loaded tabs. This happens in the same
+positions in the code as those for disabling plugins via the allowPlugins
+docShell attribute. This helps Torbutton fulfill its <a class="link" href="#isolation">Network Isolation</a> requirement.
+
+   </p></li><li class="listitem"><span class="command"><strong><a class="ulink" href="http://kb.mozillazine.org/Browser.cache.offline.enable"; target="_top">browser.cache.offline.enable</a></strong></span><p>
+
+Firefox has the ability to store web applications in a special cache to allow
+them to continue to operate while the user is offline. Since this subsystem
+is actually different than the normal disk cache, it must be dealt with
+separately. Thus, Torbutton sets this preference to false whenever Tor is
+enabled. This helps Torbutton fulfill its <a class="link" href="#disk">Disk
+Avoidance</a> and <a class="link" href="#state">State Separation</a>
+requirements.
+
+   </p></li></ol></div></div><div class="sect2" title="3.2. Preferences Window - preferences.xul"><div class="titlepage"><div><div><h3 class="title"><a id="id2521151"></a>3.2. Preferences Window - <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/preferences.xul"; target="_top">preferences.xul</a></h3></div></div></div><p>The preferences window of course lays out the Torbutton preferences, with
+handlers located in <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/preferences.js"; target="_top">chrome/content/preferences.js</a>.</p></div><div class="sect2" title="3.3. Other Windows"><div class="titlepage"><div><div><h3 class="title"><a id="id2524897"></a>3.3. Other Windows</h3></div></div></div><p>There are additional windows that describe popups for right clicking on
+the status bar, the toolbutton, and the about page.</p></div></div><div class="sect1" title="4. Toggle Code Path"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2538737"></a>4. Toggle Code Path</h2></div></div></div><p>
 
 The act of toggling is connected to <code class="function">torbutton_toggle()</code>
-via the <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/chrome/content/torbutton.xul"; target="_top">torbutton.xul</a>
-and <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/chrome/content/popup.xul"; target="_top">popup.xul</a>
-overlay files. Most of the work in the toggling process is present in <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/chrome/content/torbutton.js"; target="_top">torbutton.js</a> 
+via the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/torbutton.xul"; target="_top">torbutton.xul</a>
+and <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/popup.xul"; target="_top">popup.xul</a>
+overlay files. Most of the work in the toggling process is present in <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/torbutton.js"; target="_top">torbutton.js</a> 
 
 </p><p>
 
@@ -473,7 +518,7 @@ conditions and leakage, especially with <a class="ulink" href="https://bugzilla.
 409737</a> unfixed. The content policy does not allow any network activity
 whatsoever during this three stage transition.
 
- </p><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2527298"></a>4.1. Button Click</h3></div></div></div><p>
+ </p><div class="sect2" title="4.1. Button Click"><div class="titlepage"><div><div><h3 class="title"><a id="id2519814"></a>4.1. Button Click</h3></div></div></div><p>
 
 This is the first step in the toggling process. When the user clicks the
 toggle button or the toolbar, <code class="function">torbutton_toggle()</code> is
@@ -486,7 +531,7 @@ observer</a>
 <span class="command"><strong>torbutton_unique_pref_observer</strong></span> to perform the rest of the
 toggle.
 
-  </p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2530183"></a>4.2. Proxy Update</h3></div></div></div><p>
+  </p></div><div class="sect2" title="4.2. Proxy Update"><div class="titlepage"><div><div><h3 class="title"><a id="id2519526"></a>4.2. Proxy Update</h3></div></div></div><p>
 
 When Torbutton receives any proxy change notifications via its
 <span class="command"><strong>torbutton_unique_pref_observer</strong></span>, it calls
@@ -501,7 +546,7 @@ value. This is decoupled from the button click functionalty via the pref
 observer so that other addons (such as SwitchProxy) can switch the proxy
 settings between multiple proxies.
 
-  </p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2520686"></a>4.3. Settings Update</h3></div></div></div><p>
+  </p></div><div class="sect2" title="4.3. Settings Update"><div class="titlepage"><div><div><h3 class="title"><a id="id2504564"></a>4.3. Settings Update</h3></div></div></div><p>
 
 The next stage is also handled by
 <code class="function">torbutton_update_status()</code>. This function sets scores of
@@ -512,10 +557,10 @@ end of its work, it sets
 <span class="command"><strong>extensions.torbutton.settings_applied</strong></span>, which signifies the
 completion of the toggle operation to the <a class="link" href="#contentpolicy" title="@torproject.org/cssblocker;1 - components/cssblocker.js">content policy</a>.
 
-  </p></div></div><div class="sect1" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2536355"></a>5. Description of Options</h2></div></div></div><p>This section provides a detailed description of Torbutton's options. Each
+  </p></div></div><div class="sect1" title="5. Description of Options"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2519462"></a>5. Description of Options</h2></div></div></div><p>This section provides a detailed description of Torbutton's options. Each
 option is presented as the string from the preferences window, a summary, the
 preferences it touches, and the effect this has on the components, chrome, and
-browser properties.</p><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2533703"></a>5.1. Test Settings</h3></div></div></div><p>
+browser properties.</p><div class="sect2" title="5.1. Test Settings"><div class="titlepage"><div><div><h3 class="title"><a id="id2542642"></a>5.1. Test Settings</h3></div></div></div><p>
 This button under the Proxy Settings tab provides a way to verify that the 
 proxy settings are correct, and actually do route through the Tor network. It
 performs this check by issuing an <a class="ulink" href="http://developer.mozilla.org/en/docs/XMLHttpRequest"; target="_top">XMLHTTPRequest</a>
@@ -525,12 +570,12 @@ Torbutton can easily inspect for a hidden link with an id of
 <span class="command"><strong>TorCheckResult</strong></span> and a target of <span class="command"><strong>success</strong></span>
 or <span class="command"><strong>failure</strong></span> to indicate if the
 user hit the page from a Tor IP, a non-Tor IP. This check is handled in
-<code class="function">torbutton_test_settings()</code> in <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/chrome/content/torbutton.js"; target="_top">torbutton.js</a>.
-Presenting the results to the user is handled by the <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/chrome/content/preferences.xul"; target="_top">preferences
+<code class="function">torbutton_test_settings()</code> in <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/torbutton.js"; target="_top">torbutton.js</a>.
+Presenting the results to the user is handled by the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/preferences.xul"; target="_top">preferences
 window</a>
-callback <code class="function">torbutton_prefs_test_settings()</code> in <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/chrome/content/preferences.js"; target="_top">preferences.js</a>.  
+callback <code class="function">torbutton_prefs_test_settings()</code> in <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/preferences.js"; target="_top">preferences.js</a>.  
 
-  </p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="plugins"></a>5.2. Disable plugins on Tor Usage (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_tor_plugins</strong></span></p><p>Java and plugins <a class="ulink" href="http://java.sun.com/j2se/1.5.0/docs/api/java/net/class-use/NetworkInterface.html"; target="_top">can query</a> the <a class="ulink" href="http://www.rgagnon.com/javadetails/java-0095.html"; target="_top">local IP
+  </p></div><div class="sect2" title="5.2. Disable plugins on Tor Usage (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="plugins"></a>5.2. Disable plugins on Tor Usage (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_tor_plugins</strong></span></p><p>Java and plugins <a class="ulink" href="http://java.sun.com/j2se/1.5.0/docs/api/java/net/class-use/NetworkInterface.html"; target="_top">can query</a> the <a class="ulink" href="http://www.rgagnon.com/javadetails/java-0095.html"; target="_top">local IP
 address</a> and report it back to the
 remote site. They can also <a class="ulink" href="http://decloak.net"; target="_top">bypass proxy settings</a> and directly connect to a
 remote site without Tor. Every browser plugin we have tested with Firefox has
@@ -549,7 +594,7 @@ load
 event occurs
  (<code class="function">torbutton_update_tags()</code>), and every time the tor state is changed
  (<code class="function">torbutton_update_status()</code>). As a backup measure, plugins are also
- prevented from loading by the content policy in <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/cssblocker.js"; target="_top">@torproject.org/cssblocker;1</a> if Tor is
+ prevented from loading by the content policy in <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cssblocker.js"; target="_top">@torproject.org/cssblocker;1</a> if Tor is
  enabled and this option is set.
  </p><p>All of this turns out to be insufficient if the user directly clicks
 on a plugin-handled mime-type. <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=401296"; target="_top">In this case</a>,
@@ -574,7 +619,7 @@ all this and the plugin managed to find some way to load.
 Since most plugins completely ignore browser proxy settings, the actions
 performed by this setting are crucial to satisfying the <a class="link" href="#proxy">Proxy Obedience</a> requirement.
 
- </p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2520603"></a>5.3. Isolate Dynamic Content to Tor State (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.isolate_content</strong></span></p><p>Enabling this preference is what enables the <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/cssblocker.js"; target="_top">@torproject.org/cssblocker;1</a> content policy
+ </p></div><div class="sect2" title="5.3. Isolate Dynamic Content to Tor State (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2536168"></a>5.3. Isolate Dynamic Content to Tor State (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.isolate_content</strong></span></p><p>Enabling this preference is what enables the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cssblocker.js"; target="_top">@torproject.org/cssblocker;1</a> content policy
 mentioned above, and causes it to block content load attempts in pages an
 opposite Tor state from the current state. Freshly loaded <a class="ulink" href="https://developer.mozilla.org/en/XUL/tabbrowser"; target="_top">browser
 tabs</a> are tagged
@@ -601,7 +646,7 @@ from a page loaded in an opposite Tor state.
 
 </p><p>
 This setting is responsible for satisfying the <a class="link" href="#isolation">Network Isolation</a> requirement.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="jshooks"></a>5.4. Hook Dangerous Javascript</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.kill_bad_js</strong></span></p><p>This setting enables injection of the <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/chrome/content/jshooks.js"; target="_top">Javascript
+</p></div><div class="sect2" title="5.4. Hook Dangerous Javascript"><div class="titlepage"><div><div><h3 class="title"><a id="jshooks"></a>5.4. Hook Dangerous Javascript</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.kill_bad_js</strong></span></p><p>This setting enables injection of the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/jshooks.js"; target="_top">Javascript
 hooking code</a>. This is done in the chrome in
 <code class="function">torbutton_hookdoc()</code>, which is called ultimately by both the 
 <a class="ulink" href="https://developer.mozilla.org/en/nsIWebProgressListener"; target="_top">webprogress
@@ -622,11 +667,11 @@ meet the <a class="link" href="#setpreservation">Anonymity Set Preservation</a>
 requirements. Unfortunately, Gregory Fleischer discovered it is still possible
 to retrieve the original screen values by using <a class="ulink" href="http://pseudo-flaw.net/tor/torbutton/unmask-sandbox-xpcnativewrapper.html"; target="_top">XPCNativeWrapper</a>
 or <a class="ulink" href="http://pseudo-flaw.net/tor/torbutton/unmask-components-lookupmethod.html"; target="_top">Components.lookupMethod</a>.
-We are still looking for a workaround as of Torbutton 1.2.2.
+We are still looking for a workaround as of Torbutton 1.2.4.
 
 
 
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2521148"></a>5.5. Resize windows to multiples of 50px during Tor usage (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.resize_windows</strong></span></p><p>
+</p></div><div class="sect2" title="5.5. Resize windows to multiples of 50px during Tor usage (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2530601"></a>5.5. Resize windows to multiples of 50px during Tor usage (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.resize_windows</strong></span></p><p>
 
 This option drastically cuts down on the number of distinct anonymity sets
 that divide the Tor web userbase. Without this setting, the dimensions for a
@@ -661,7 +706,7 @@ infer toolbar size/presence by the distance to the nearest 50 pixel roundoff).
 
 </p><p>
 This setting helps to meet the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> requirements.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2533829"></a>5.6. Disable Updates During Tor</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_updates</strong></span></p><p>This setting causes Torbutton to disable the four <a class="ulink" href="http://wiki.mozilla.org/Update:Users/Checking_For_Updates#Preference_Controls_and_State"; target="_top">Firefox
+</p></div><div class="sect2" title="5.6. Disable Updates During Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2513266"></a>5.6. Disable Updates During Tor</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_updates</strong></span></p><p>This setting causes Torbutton to disable the four <a class="ulink" href="http://wiki.mozilla.org/Update:Users/Checking_For_Updates#Preference_Controls_and_State"; target="_top">Firefox
 update settings</a> during Tor
   usage: <span class="command"><strong>extensions.update.enabled</strong></span>,
 <span class="command"><strong>app.update.enabled</strong></span>,
@@ -671,7 +716,7 @@ update settings</a> during Tor
   checking for search plugin updates while Tor is enabled.
   </p><p>
 This setting satisfies the <a class="link" href="#updates">Update Safety</a> requirement.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2534724"></a>5.7. Disable Search Suggestions during Tor (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_search</strong></span></p><p>
+</p></div><div class="sect2" title="5.7. Disable Search Suggestions during Tor (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2505201"></a>5.7. Disable Search Suggestions during Tor (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_search</strong></span></p><p>
 This setting causes Torbutton to disable <a class="ulink" href="http://kb.mozillazine.org/Browser.search.suggest.enabled"; target="_top"><span class="command"><strong>browser.search.suggest.enabled</strong></span></a>
 during Tor usage.
 This governs if you get Google search suggestions during Tor
@@ -682,8 +727,22 @@ this is recommended to be disabled.
 While this setting doesn't satisfy any Torbutton requirements, the fact that
 cookies are transmitted for partially typed queries does not seem desirable
 for Tor usage.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2510788"></a>5.8. Block Tor/Non-Tor access to network from file:// urls (recommended)</h3></div></div></div><p>Option:
-   </p><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="command"><strong>extensions.torbutton.block_tor_file_net</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_nontor_file_net</strong></span></td></tr></table><p>
+</p></div><div class="sect2" title="5.8. Disable livemarks updates during Tor usage (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2505239"></a>5.8. Disable livemarks updates during Tor usage (recommended)</h3></div></div></div><p>Option:
+   </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.disable_livemarks</strong></span></td></tr></table><p>
+  </p><p>
+This option causes Torbutton to prevent Firefox from loading <a class="ulink" href="http://www.mozilla.com/firefox/livebookmarks.html"; target="_top">Livemarks</a> during
+Tor usage. Because people often have very personalized Livemarks (such as RSS
+feeds of Wikipedia articles they maintain, etc). This is accomplished both by
+<a class="link" href="#livemarks" title="@mozilla.org/browser/livemark-service;2 - components/block-livemarks.js">wrapping the livemark-service component</a> and
+by calling stopUpdateLivemarks() on the <a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/browser/livemark-service;2"; target="_top">Livemark
+service</a> when Tor is enabled.
+
+</p><p>
+This helps satisfy the <a class="link" href="#isolation">Network
+Isolation</a> and <a class="link" href="#setpreservation">Anonymity Set
+Preservation</a> requirements.
+</p></div><div class="sect2" title="5.9. Block Tor/Non-Tor access to network from file:// urls (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2505311"></a>5.9. Block Tor/Non-Tor access to network from file:// urls (recommended)</h3></div></div></div><p>Options:
+   </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.block_tor_file_net</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_nontor_file_net</strong></span></td></tr></table><p>
   </p><p>
 
 These settings prevent file urls from performing network operations during the
@@ -701,9 +760,9 @@ This preference helps to ensure Tor's <a class="link" href="#isolation">Network
 Isolation</a> requirement, by preventing file urls from executing network
 operations in opposite Tor states. Also, allowing pages to submit arbitrary
 files to arbitrary sites just generally seems like a bad idea.
- 
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2496594"></a>5.9. Close all Tor/Non-Tor tabs and windows on toggle (optional)</h3></div></div></div><p>Options: 
-   </p><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="command"><strong>extensions.torbutton.close_nontor</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.close_tor</strong></span></td></tr></table><p>
+
+</p></div><div class="sect2" title="5.10. Close all Tor/Non-Tor tabs and windows on toggle (optional)"><div class="titlepage"><div><div><h3 class="title"><a id="id2505383"></a>5.10. Close all Tor/Non-Tor tabs and windows on toggle (optional)</h3></div></div></div><p>Options:
+   </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.close_nontor</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.close_tor</strong></span></td></tr></table><p>
   </p><p>
 
 These settings cause Torbutton to enumerate through all windows and close all
@@ -726,7 +785,7 @@ out longer than necessary.
 While this setting doesn't satisfy any Torbutton requirements, the fact that
 cookies are transmitted for partially typed queries does not seem desirable
 for Tor usage.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2496675"></a>5.10. Isolate Access to History navigation to Tor state (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.block_js_history</strong></span></p><p>
+</p></div><div class="sect2" title="5.11. Isolate Access to History navigation to Tor state (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2505464"></a>5.11. Isolate Access to History navigation to Tor state (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.block_js_history</strong></span></p><p>
 This setting determines if Torbutton installs an <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsISHistoryListener"; target="_top">nsISHistoryListener</a>
 attached to the <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsISHistory"; target="_top">sessionHistory</a> of 
 of each browser's <a class="ulink" href="https://developer.mozilla.org/en/XUL%3aProperty%3awebNavigation"; target="_top">webNavigatator</a>.
@@ -754,9 +813,9 @@ This setting helps to fulfill Torbutton's <a class="link" href="#state">State
 Separation</a> and (until Bug 409737 is fixed) <a class="link" href="#isolation">Network Isolation</a>
 requirements.
 
-   </p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2496760"></a>5.11. History Access Settings</h3></div></div></div><p>Options:
-  </p><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="command"><strong>extensions.torbutton.block_thread</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_nthread</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_thwrite</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_nthwrite</strong></span></td></tr></table><p>
-  </p><p>These four settings govern the behavior of the <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/ignore-history.js"; target="_top">components/ignore-history.js</a>
+   </p></div><div class="sect2" title="5.12. History Access Settings"><div class="titlepage"><div><div><h3 class="title"><a id="id2505548"></a>5.12. History Access Settings</h3></div></div></div><p>Options:
+  </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.block_thread</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_nthread</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_thwrite</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_nthwrite</strong></span></td></tr></table><p>
+  </p><p>These four settings govern the behavior of the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/ignore-history.js"; target="_top">components/ignore-history.js</a>
 history blocker component mentioned above. By hooking the browser's view of
 the history itself via the <a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/browser/global-history;2"; target="_top">@mozilla.org/browser/global-history;2</a>
 and <a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/browser/nav-history-service;1"; target="_top">@mozilla.org/browser/nav-history-service;1</a>
@@ -769,13 +828,13 @@ Database</a> and the older Firefox 2 mechanisms.
 
 </p><p>
 This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2496873"></a>5.12. Clear History During Tor Toggle (optional)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_history</strong></span></p><p>This setting governs if Torbutton calls
+</p></div><div class="sect2" title="5.13. Clear History During Tor Toggle (optional)"><div class="titlepage"><div><div><h3 class="title"><a id="id2505661"></a>5.13. Clear History During Tor Toggle (optional)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_history</strong></span></p><p>This setting governs if Torbutton calls
 <a class="ulink" href="https://developer.mozilla.org/en/nsIBrowserHistory#removeAllPages.28.29"; target="_top">nsIBrowserHistory.removeAllPages</a>
 and <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsISHistory"; target="_top">nsISHistory.PurgeHistory</a>
 for each tab on Tor toggle.</p><p>
 This setting is an optional way to help satisfy the <a class="link" href="#state">State Separation</a> requirement.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2496919"></a>5.13. Block Password+Form saving during Tor/Non-Tor</h3></div></div></div><p>Options:
-  </p><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="command"><strong>extensions.torbutton.block_tforms</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_ntforms</strong></span></td></tr></table><p>
+</p></div><div class="sect2" title="5.14. Block Password+Form saving during Tor/Non-Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2505706"></a>5.14. Block Password+Form saving during Tor/Non-Tor</h3></div></div></div><p>Options:
+  </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.block_tforms</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_ntforms</strong></span></td></tr></table><p>
   </p><p>These settings govern if Torbutton disables
 <span class="command"><strong>browser.formfill.enable</strong></span>
 and <span class="command"><strong>signon.rememberSignons</strong></span> during Tor and Non-Tor usage.
@@ -783,19 +842,19 @@ Since form fields can be read at any time by Javascript, this setting is a lot
 more important than it seems.
 </p><p>
 This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2496986"></a>5.14. Block Tor disk cache and clear all cache on Tor Toggle</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_cache</strong></span>
+</p></div><div class="sect2" title="5.15. Block Tor disk cache and clear all cache on Tor Toggle"><div class="titlepage"><div><div><h3 class="title"><a id="id2547259"></a>5.15. Block Tor disk cache and clear all cache on Tor Toggle</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_cache</strong></span>
   </p><p>This option causes Torbutton to call <a class="ulink" href="https://developer.mozilla.org/en/nsICacheService#evictEntries.28.29"; target="_top">nsICacheService.evictEntries(0)</a>
 on Tor toggle to remove all entries from the cache. In addition, this setting
 causes Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Browser.cache.disk.enable"; target="_top">browser.cache.disk.enable</a> to false.
 </p><p>
 This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2497040"></a>5.15. Block disk and memory cache during Tor</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.block_cache</strong></span></p><p>This setting
+</p></div><div class="sect2" title="5.16. Block disk and memory cache during Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2547309"></a>5.16. Block disk and memory cache during Tor</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.block_cache</strong></span></p><p>This setting
 causes Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Browser.cache.memory.enable"; target="_top">browser.cache.memory.enable</a>,
 <a class="ulink" href="http://kb.mozillazine.org/Browser.cache.disk.enable"; target="_top">browser.cache.disk.enable</a> and
 <a class="ulink" href="http://kb.mozillazine.org/Network.http.use-cache"; target="_top">network.http.use-cache</a> to false during tor usage.
 </p><p>
 This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2497098"></a>5.16. Clear Cookies on Tor Toggle</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_cookies</strong></span>
+</p></div><div class="sect2" title="5.17. Clear Cookies on Tor Toggle"><div class="titlepage"><div><div><h3 class="title"><a id="id2547362"></a>5.17. Clear Cookies on Tor Toggle</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_cookies</strong></span>
   </p><p>
 
 This setting causes Torbutton to call <a class="ulink" href="https://developer.mozilla.org/en/nsICookieManager#removeAll.28.29"; target="_top">nsICookieManager.removeAll()</a> on
@@ -805,10 +864,10 @@ which prevents them from being written to disk.
 
 </p><p>
 This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2497153"></a>5.17. Store Non-Tor cookies in a protected jar</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.cookie_jars</strong></span>
+</p></div><div class="sect2" title="5.18. Store Non-Tor cookies in a protected jar"><div class="titlepage"><div><div><h3 class="title"><a id="id2547413"></a>5.18. Store Non-Tor cookies in a protected jar</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.cookie_jars</strong></span>
   </p><p>
 
-This setting causes Torbutton to use <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/cookie-jar-selector.js"; target="_top">@stanford.edu/cookie-jar-selector;2</a> to store
+This setting causes Torbutton to use <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-jar-selector.js"; target="_top">@torproject.org/cookie-jar-selector;2</a> to store
 non-tor cookies in a cookie jar during Tor usage, and clear the Tor cookies
 before restoring the jar.
 </p><p>
@@ -818,16 +877,16 @@ which prevents them from being written to disk.
 
 </p><p>
 This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2538692"></a>5.18. Store both Non-Tor and Tor cookies in a protected jar (dangerous)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.dual_cookie_jars</strong></span>
+</p></div><div class="sect2" title="5.19. Store both Non-Tor and Tor cookies in a protected jar (dangerous)"><div class="titlepage"><div><div><h3 class="title"><a id="id2547469"></a>5.19. Store both Non-Tor and Tor cookies in a protected jar (dangerous)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.dual_cookie_jars</strong></span>
   </p><p>
 
-This setting causes Torbutton to use <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/cookie-jar-selector.js"; target="_top">@stanford.edu/cookie-jar-selector;2</a> to store
+This setting causes Torbutton to use <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-jar-selector.js"; target="_top">@torproject.org/cookie-jar-selector;2</a> to store
 both Tor and Non-Tor cookies into protected jars.
 </p><p>
 This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2538731"></a>5.19. Manage My Own Cookies (dangerous)</h3></div></div></div><p>Options: None</p><p>This setting disables all Torbutton cookie handling by setting the above
-cookie prefs all to false.</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2538746"></a>5.20. Disable DOM Storage during Tor usage (crucial)</h3></div></div></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2538748"></a>5.20.1. Do not write Tor/Non-Tor cookies to disk</h3></div></div></div><p>Options:
-  </p><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="command"><strong>extensions.torbutton.tor_memory_jar</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.nontor_memory_jar</strong></span></td></tr></table><p>
+</p></div><div class="sect2" title="5.20. Manage My Own Cookies (dangerous)"><div class="titlepage"><div><div><h3 class="title"><a id="id2547508"></a>5.20. Manage My Own Cookies (dangerous)</h3></div></div></div><p>Options: None</p><p>This setting disables all Torbutton cookie handling by setting the above
+cookie prefs all to false.</p></div><div class="sect2" title="5.21. Disable DOM Storage during Tor usage (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2547523"></a>5.21. Disable DOM Storage during Tor usage (crucial)</h3></div></div></div><div class="sect2" title="5.21.1. Do not write Tor/Non-Tor cookies to disk"><div class="titlepage"><div><div><h3 class="title"><a id="id2547525"></a>5.21.1. Do not write Tor/Non-Tor cookies to disk</h3></div></div></div><p>Options:
+  </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.tor_memory_jar</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.nontor_memory_jar</strong></span></td></tr></table><p>
   </p><p>
 These settings (contributed by arno) cause Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Network.cookie.lifetimePolicy"; target="_top">network.cookie.lifetimePolicy</a>
 to 2 during the appropriate Tor state, and to store cookies acquired in that
@@ -846,35 +905,35 @@ usage to prevent
 <a class="ulink" href="http://developer.mozilla.org/en/docs/DOM:Storage"; target="_top">DOM Storage</a> from
   being used to store persistent information across Tor states.</p><p>
 This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2538850"></a>5.21. Clear HTTP Auth on Tor Toggle (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_http_auth</strong></span>
+</p></div><div class="sect2" title="5.22. Clear HTTP Auth on Tor Toggle (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2547627"></a>5.22. Clear HTTP Auth on Tor Toggle (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_http_auth</strong></span>
   </p><p>
 This setting causes Torbutton to call <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsIHttpAuthManager"; target="_top">nsIHttpAuthManager.clearAll()</a>
 every time Tor is toggled.
 </p><p>
 This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2538887"></a>5.22. Clear cookies on Tor/Non-Tor shutdown</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.shutdown_method</strong></span>
+</p></div><div class="sect2" title="5.23. Clear cookies on Tor/Non-Tor shutdown"><div class="titlepage"><div><div><h3 class="title"><a id="id2547664"></a>5.23. Clear cookies on Tor/Non-Tor shutdown</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.shutdown_method</strong></span>
   </p><p> This option variable can actually take 3 values: 0, 1, and 2. 0 means no
 cookie clearing, 1 means clear only during Tor-enabled shutdown, and 2 means
 clear for both Tor and Non-Tor shutdown. When set to 1 or 2, Torbutton listens
 for the <a class="ulink" href="http://developer.mozilla.org/en/docs/Observer_Notifications#Application_shutdown"; target="_top">quit-application-granted</a> event in
-<code class="function">torbutton_uninstall_observer()</code> and use <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/cookie-jar-selector.js"; target="_top">@stanford.edu/cookie-jar-selector;2</a>
+<code class="function">torbutton_uninstall_observer()</code> and use <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-jar-selector.js"; target="_top">@torproject.org/cookie-jar-selector;2</a>
 to clear out all cookies and all cookie jars upon shutdown.  </p><p>
 This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2538941"></a>5.23. Reload cookie jar/clear cookies on Firefox crash</h3></div></div></div><p>Options:
-  </p><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="command"><strong>extensions.torbutton.reload_crashed_jar</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.crashed</strong></span></td></tr></table><p>
+</p></div><div class="sect2" title="5.24. Reload cookie jar/clear cookies on Firefox crash"><div class="titlepage"><div><div><h3 class="title"><a id="id2547718"></a>5.24. Reload cookie jar/clear cookies on Firefox crash</h3></div></div></div><p>Options:
+  </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.reload_crashed_jar</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.crashed</strong></span></td></tr></table><p>
   </p><p>This is no longer a user visible option, and is enabled by default. In
-the event of a crash, the Torbutton <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/crash-observer.js"; target="_top">components/crash-observer.js</a> 
+the event of a crash, the Torbutton <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/crash-observer.js"; target="_top">components/crash-observer.js</a> 
   component will notify the Chrome (via the
   <span class="command"><strong>extensions.torbutton.crashed</strong></span> pref and a <a class="ulink" href="https://developer.mozilla.org/en/NsIPrefBranch2#addObserver.28.29"; target="_top">pref
 observer</a> in
 the chrome that listens for this update), and Torbutton will load the
-  correct jar for the current Tor state via the <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/cookie-jar-selector.js"; target="_top">@stanford.edu/cookie-jar-selector;2</a>
+  correct jar for the current Tor state via the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-jar-selector.js"; target="_top">@torproject.org/cookie-jar-selector;2</a>
   component.</p><p>
 This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement in the event of Firefox
 crashes.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2539016"></a>5.24. On crash recovery or session restored startup, restore via: Tor, Non-Tor</h3></div></div></div><p>Options:
-  </p><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="command"><strong>extensions.torbutton.restore_tor</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.crashed</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.normal_exit</strong></span></td></tr></table><p>
-  </p><p>This option works with the Torbutton <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/crash-observer.js"; target="_top">crash-observer.js</a> 
+</p></div><div class="sect2" title="5.25. On crash recovery or session restored startup, restore via: Tor, Non-Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2547794"></a>5.25. On crash recovery or session restored startup, restore via: Tor, Non-Tor</h3></div></div></div><p>Options:
+  </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.restore_tor</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.crashed</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.normal_exit</strong></span></td></tr></table><p>
+  </p><p>This option works with the Torbutton <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/crash-observer.js"; target="_top">crash-observer.js</a> 
   to set the Tor state after a crash is detected (via the 
   <span class="command"><strong>extensions.torbutton.crashed</strong></span> pref). To confirm for
 false positives (such as session restore failures, upgrade, normal
@@ -888,9 +947,9 @@ setting helps to satisfy the <a class="link" href="#state">State Separation</a>
 requirement in the event of Firefox crashes by ensuring all cookies,
 settings and saved sessions are reloaded from a fixed Tor state.
  
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2539088"></a>5.25. On normal startup, set state to: Tor, Non-Tor, Shutdown State</h3></div></div></div><p>Options:
-  </p><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="command"><strong>extensions.torbutton.startup_state</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.noncrashed</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.normal_exit</strong></span></td></tr></table><p>
-  </p><p>This option also works with the Torbutton <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/crash-observer.js"; target="_top">crash-observer.js</a> 
+</p></div><div class="sect2" title="5.26. On normal startup, set state to: Tor, Non-Tor, Shutdown State"><div class="titlepage"><div><div><h3 class="title"><a id="id2547866"></a>5.26. On normal startup, set state to: Tor, Non-Tor, Shutdown State</h3></div></div></div><p>Options:
+  </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.startup_state</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.noncrashed</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.normal_exit</strong></span></td></tr></table><p>
+  </p><p>This option also works with the Torbutton <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/crash-observer.js"; target="_top">crash-observer.js</a> 
   to set the Tor state after a normal startup is detected (via the 
   <span class="command"><strong>extensions.torbutton.noncrashed</strong></span> pref). To confirm for
 false positives
@@ -898,9 +957,9 @@ false positives
 extensions.torbutton.normal_exit in torbutton_uninstall_observer() during
 Firefox exit and checks this value as well during startup.
   
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2539147"></a>5.26. Prevent session store from saving Non-Tor/Tor-loaded tabs</h3></div></div></div><p>Options: 
-  </p><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="command"><strong>extensions.torbutton.nonontor_sessionstore</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.notor_sessionstore</strong></span></td></tr></table><p>
-  </p><p>If these options are enabled, the <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/components/nsSessionStore3.js"; target="_top">replacement nsSessionStore.js</a>
+</p></div><div class="sect2" title="5.27. Prevent session store from saving Non-Tor/Tor-loaded tabs"><div class="titlepage"><div><div><h3 class="title"><a id="id2547925"></a>5.27. Prevent session store from saving Non-Tor/Tor-loaded tabs</h3></div></div></div><p>Options: 
+  </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.nonontor_sessionstore</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.notor_sessionstore</strong></span></td></tr></table><p>
+  </p><p>If these options are enabled, the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/nsSessionStore3.js"; target="_top">replacement nsSessionStore.js</a>
   component checks the <span class="command"><strong>__tb_tor_fetched</strong></span> tag of tabs before writing them
   out. If the tag is from a blocked Tor state, the tab is not written to disk.
   </p><p>
@@ -908,8 +967,8 @@ This setting helps to satisfy the <a class="link" href="#disk">Disk Avoidance</a
 requirement, and also helps to satisfy the <a class="link" href="#state">State Separation</a> requirement in the event of Firefox
 crashes.
 
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2539212"></a>5.27. Set user agent during Tor usage (crucial)</h3></div></div></div><p>Options:
-   </p><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="command"><strong>extensions.torbutton.set_uagent</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.platform_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.oscpu_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.buildID_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.productsub_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.appname_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.appversion_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.useragent_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.useragent_vendor</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.useragent_vendorSub</strong></span></td></tr></table><p>
+</p></div><div class="sect2" title="5.28. Set user agent during Tor usage (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2547990"></a>5.28. Set user agent during Tor usage (crucial)</h3></div></div></div><p>Options:
+   </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.set_uagent</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.platform_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.oscpu_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.buildID_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.productsub_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.appname_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.appversion_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.useragent_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.useragent_vendor</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.useragent_vendorSub</strong></span></td></tr></table><p>
    </p><p>On face, user agent switching appears to be straight-forward in Firefox.
 It provides several options for controlling the browser user agent string:
 <span class="command"><strong>general.appname.override</strong></span>,
@@ -932,8 +991,8 @@ certain resource:// files</a>. These cases are handled by Torbutton's
 
 </p><p>
 This setting helps to satisfy the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> requirement.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2539386"></a>5.28. Spoof US English Browser</h3></div></div></div><p>Options:
-</p><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="command"><strong>extensions.torbutton.spoof_english</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.spoof_charset</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.spoof_language</strong></span></td></tr></table><p>
+</p></div><div class="sect2" title="5.29. Spoof US English Browser"><div class="titlepage"><div><div><h3 class="title"><a id="id2548164"></a>5.29. Spoof US English Browser</h3></div></div></div><p>Options:
+</p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.spoof_english</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.spoof_charset</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.spoof_language</strong></span></td></tr></table><p>
 </p><p> This option causes Torbutton to set
 <span class="command"><strong>general.useragent.locale</strong></span>
 <span class="command"><strong>intl.accept_languages</strong></span> to the value specified in
@@ -943,19 +1002,19 @@ This setting helps to satisfy the <a class="link" href="#setpreservation">Anonym
 well as hooking <span class="command"><strong>navigator.language</strong></span> via its <a class="link" href="#jshooks" title="5.4. Hook Dangerous Javascript">javascript hooks</a>.
  </p><p>
 This setting helps to satisfy the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> and <a class="link" href="#location">Location Neutrality</a> requirements.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2539479"></a>5.29. Don't send referrer during Tor Usage</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.disable_referer</strong></span>
+</p></div><div class="sect2" title="5.30. Don't send referrer during Tor Usage"><div class="titlepage"><div><div><h3 class="title"><a id="id2548257"></a>5.30. Don't send referrer during Tor Usage</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.disable_referer</strong></span>
 </p><p> 
 This option causes Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Network.http.sendSecureXSiteReferrer"; target="_top">network.http.sendSecureXSiteReferrer</a> and
 <a class="ulink" href="http://kb.mozillazine.org/Network.http.sendRefererHeader"; target="_top">network.http.sendRefererHeader</a> during Tor usage.</p><p>
 This setting also does not directly satisfy any Torbutton requirement, but
 some may desire to mask their referrer for general privacy concerns.
-</p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2539520"></a>5.30. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)</h3></div></div></div><p>Options:
-</p><table class="simplelist" border="0" summary="Simple list"><tr><td><span class="command"><strong>extensions.torbutton.jar_certs</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.jar_ca_certs</strong></span></td></tr></table><p>
+</p></div><div class="sect2" title="5.31. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2548297"></a>5.31. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)</h3></div></div></div><p>Options:
+</p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.jar_certs</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.jar_ca_certs</strong></span></td></tr></table><p>
 </p><p>
 
 These settings govern if Torbutton attempts to isolate the user's SSL
 certificates into separate jars for each Tor state. This isolation is
-implemented in <code class="function">torbutton_jar_certs()</code> in <a class="ulink" href="https://tor-svn.freehaven.net/svn/torbutton/trunk/src/chrome/content/torbutton.js"; target="_top">chrome/content/torbutton.js</a>,
+implemented in <code class="function">torbutton_jar_certs()</code> in <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/torbutton.js"; target="_top">chrome/content/torbutton.js</a>,
 which calls <code class="function">torbutton_jar_cert_type()</code> and
 <code class="function">torbutton_unjar_cert_type()</code> for each certificate type in
 the <a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/security/nsscertcache;1"; target="_top">@mozilla.org/security/nsscertcache;1</a>.
@@ -974,9 +1033,9 @@ Separation</a> requirement of Torbutton. Unfortunately, <a class="ulink" href="h
 435159</a> prevents it from functioning correctly in the event of rapid Tor toggle, so it
 is currently not exposed via the preferences UI.
 
-</p></div></div><div class="sect1" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="FirefoxBugs"></a>6. Relevant Firefox Bugs</h2></div></div></div><p>
+</p></div></div><div class="sect1" title="6. Relevant Firefox Bugs"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="FirefoxBugs"></a>6. Relevant Firefox Bugs</h2></div></div></div><p>
 
-  </p><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="FirefoxSecurity"></a>6.1. Bugs impacting security</h3></div></div></div><p>
+  </p><div class="sect2" title="6.1. Bugs impacting security"><div class="titlepage"><div><div><h3 class="title"><a id="FirefoxSecurity"></a>6.1. Bugs impacting security</h3></div></div></div><p>
 
 Torbutton has to work around a number of Firefox bugs that impact its
 security. Most of these are mentioned elsewhere in this document, but they
@@ -984,7 +1043,7 @@ have also been gathered here for reference. Several of these have fixes in
 Firefox3.0/trunk, but are listed because they still have not been backported
 to FF2.0. In order of decreasing severity, they are:
 
-   </p><div class="orderedlist"><ol type="1"><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=392274"; target="_top">Bug 392274 - Timezone
+   </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=392274"; target="_top">Bug 392274 - Timezone
 config/chrome API</a><p>
 
 The lack of a config or API to configure the timezone requires Torbutton to
@@ -1001,7 +1060,7 @@ easy way to reliably spoof the timezone interferes with Torbutton's ability to
 fulfill its <a class="link" href="#location">Location Neutrality</a> requirement.
 
 
-   </p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=435159"; target="_top">Bug 435159 -
+   </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=435159"; target="_top">Bug 435159 -
 nsNSSCertificateDB::DeleteCertificate has race conditions</a><p>
 
 In Torbutton 1.2.0rc1, code was added to attempt to isolate SSL certificates
@@ -1015,7 +1074,7 @@ this functionality is considered a Torbutton security bug because cert
 isolation is considered a <a class="link" href="#state">State Separation</a>
 feature.
 
-      </p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=409737"; target="_top">Bug 409737 -
+      </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=409737"; target="_top">Bug 409737 -
 javascript.enabled and docShell.allowJavascript do not disable all event
 handlers</a><p>
 
@@ -1030,7 +1089,7 @@ ways to open popups or perform redirects such that Torbutton cannot block
 them, pages may still have free reign to break that requirement and reveal a
 user's original IP address.
 
-     </p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=448743"; target="_top">Bug 448743 -
+     </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=448743"; target="_top">Bug 448743 -
 Decouple general.useragent.locale from spoofing of navigator.language</a><p>
 
 Currently, Torbutton spoofs the <span class="command"><strong>navigator.language</strong></span>
@@ -1042,16 +1101,16 @@ to avoid fragmenting the anonymity set of users of foreign locales. This issue
 impedes Torbutton from fully meeting its <a class="link" href="#setpreservation">Anonymity Set Preservation</a>
 requirement on Firefox 3.
 
-     </p></li></ol></div></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="FirefoxWishlist"></a>6.2. Bugs blocking functionality</h3></div></div></div><p>
+     </p></li></ol></div></div><div class="sect2" title="6.2. Bugs blocking functionality"><div class="titlepage"><div><div><h3 class="title"><a id="FirefoxWishlist"></a>6.2. Bugs blocking functionality</h3></div></div></div><p>
 The following bugs impact Torbutton and similar extensions' functionality.
-   </p><div class="orderedlist"><ol type="1"><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=445696"; target="_top">Bug 445696 -
+   </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=445696"; target="_top">Bug 445696 -
 Extensions cannot determine if firefox is fullScreen</a><p>
 
 The windowState property of <a class="ulink" href="https://developer.mozilla.org/en/XUL/window"; target="_top">ChromeWindows</a> does not accurately reflect the true
 state of the window in some cases on Linux. This causes Torbutton to attempt
 to resize maximized and minimized windows when it should not.
 
-   </p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=290456"; target="_top">Bug 290456 -
+   </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=290456"; target="_top">Bug 290456 -
 Block/clear Flash MX "cookies" as well</a><p>
 
 Today, it is possible to allow plugins if you have a transparent proxy such as
@@ -1061,7 +1120,7 @@ that does so. This can be solved by manually removing your flash cookies (like
 <a class="ulink" href="https://addons.mozilla.org/en-US/firefox/addon/6623"; target="_top">BetterPrivacy</a> does), but
 it would be nice if there was a standard way to do this from a Firefox API.
 
-   </p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=417869"; target="_top">Bug 417869 -
+   </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=417869"; target="_top">Bug 417869 -
 Browser context is difficult to obtain from many XPCOM callbacks</a><p>
 
 It is difficult to determine which tabbrowser many XPCOM callbacks originate
@@ -1070,19 +1129,19 @@ While this doesn't have much of an effect on Torbutton, it does make writing
 extensions that would like to do per-tab settings and content filters (such as
 FoxyProxy) difficult to impossible to implement securely.
 
-   </p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=418321"; target="_top">Bug 418321 -
+   </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=418321"; target="_top">Bug 418321 -
 Components do not expose disk interfaces</a><p>
 
 Several components currently provide no way of reimplementing their disk
 access to easily satisfy Torbutton's <a class="link" href="#disk">Disk
-Avoidance</a> requirements. Workarounds exist, but they are <a class="link" href="#sessionstore" title="@mozilla.org/browser/sessionstore;1 - components/nsSessionStore2.js and components/nsSessionStore3.js">clunky</a>, and
+Avoidance</a> requirements. Workarounds exist, but they are <a class="link" href="#sessionstore" title="@mozilla.org/browser/sessionstore;1 - components/nsSessionStore36.js">clunky</a>, and
 some of them involve disabling functionality during Tor usage.
 
-   </p></li></ol></div></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="FirefoxMiscBugs"></a>6.3. Low Priority Bugs</h3></div></div></div><p>
+   </p></li></ol></div></div><div class="sect2" title="6.3. Low Priority Bugs"><div class="titlepage"><div><div><h3 class="title"><a id="FirefoxMiscBugs"></a>6.3. Low Priority Bugs</h3></div></div></div><p>
 The following bugs have an effect upon Torbutton, but are superseded by more
 practical and more easily fixable variant bugs above; or have stable, simple
 workarounds.
-  </p><div class="orderedlist"><ol type="1"><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=435151"; target="_top">Bug 435151 - XPCSafeJSObjectWrapper breaks evalInSandbox</a><p>
+  </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=435151"; target="_top">Bug 435151 - XPCSafeJSObjectWrapper breaks evalInSandbox</a><p>
 
 Under Firefox 3, the XPCSafeJSObjectWrapper breaks when you try to use
 constructors of classes defined from within the scope of the sandbox, among
@@ -1092,18 +1151,18 @@ would be a fix for the above mentioned Bug 392274. Of course, many more
 extensions may be interested in the sandbox hooking functionality working
 properly though.
 
-     </p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=440892"; target="_top">Bug 440892 -
+     </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=440892"; target="_top">Bug 440892 -
 network.protocol-handler.warn-external are ignored</a><p>
 
 Sometime in the Firefox 3 development cycle, the preferences that governed
 warning a user when external apps were launched got disconnected from the code
 that does the launching. Torbutton depended on these prefs to prevent websites
 from launching specially crafted documents and application arguments that
-caused Proxy Bypass. We currently work around this issue by <a class="link" href="#appblocker" title="@mozilla.org/uriloader/external-protocol-service;1 and @mozilla.org/uriloader/external-helper-app-service;1 - components/external-app-blocker.js">wrapping the app launching components</a> to present a
+caused Proxy Bypass. We currently work around this issue by <a class="link" href="#appblocker" title="@mozilla.org/uriloader/external-protocol-service;1 , @mozilla.org/uriloader/external-helper-app-service;1, and @mozilla.org/mime;1 - components/external-app-blocker.js">wrapping the app launching components</a> to present a
 popup before launching external apps while Tor is enabled. While this works,
 it would be nice if these prefs were either fixed or removed.
 
-     </p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=437014"; target="_top">Bug 437014 -
+     </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=437014"; target="_top">Bug 437014 -
 nsIContentPolicy::shouldLoad no longer called for favicons</a><p>
 
 Firefox 3.0 stopped calling the shouldLoad call of content policy for favicon
@@ -1113,14 +1172,7 @@ when it arrives in the <span class="command"><strong>torbutton_http_observer</st
 blocking full page plugin loads. This seems to work just fine, but is a bit
 dirty.
 
-    </p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=437016"; target="_top">Bug 437016 -
-nsIContentPolicy::shouldLoad not called for livemarks</a><p>
-
-An alternative fix for the livemarks bug above would be to block livemarks
-fetches from the content policy. Unfortunately shouldLoad is not called for
-livemarks fetches.
-
-    </p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=418986"; target="_top">Bug 418986 - window.screen
+    </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=418986"; target="_top">Bug 418986 - window.screen
 provides a large amount of identifiable information</a><p>
 
 As <a class="link" href="#fingerprinting">mentioned above</a>, a large amount of
@@ -1129,7 +1181,7 @@ Currently, there is no way to obscure this information without Javascript
 hooking. This bug is a feature request to provide some other method to change
 these values.
 
-   </p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=309524"; target="_top">Bug 309524</a>
+   </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=309524"; target="_top">Bug 309524</a>
 and <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=380556"; target="_top">Bug
 380556</a> - nsIContentPolicy::shouldProcess is not called.
      <p>
@@ -1140,7 +1192,7 @@ handed over to a plugin or helper app, it would make the workaround for the
 above allowPlugins bug a lot cleaner. Obviously this bug is not as severe as
 the others though, but it might be nice to have this API as a backup.
 
-     </p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=401296"; target="_top">Bug 401296 - docShell.allowPlugins
+     </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=401296"; target="_top">Bug 401296 - docShell.allowPlugins
 not honored for direct links</a> (Perhaps subset of <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=282106"; target="_top">Bug 282106</a>?)
      <p>
 
@@ -1155,7 +1207,7 @@ requirement and reveal a user's original IP address. Torbutton's code to
 perform this workaround has been subverted at least once already by Kyle
 Williams.
 
-     </p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=448747"; target="_top">Bug 448747 -
+     </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=448747"; target="_top">Bug 448747 -
 Provide Mechanism to clear TLS Session IDs</a><p>
 
 As <a class="link" href="#browseroverlay" title="3.1. Browser Overlay - torbutton.xul">mentioned above</a>, Torbutton currently
@@ -1165,7 +1217,7 @@ line 2134</a>. This is an arcane and potentially fragile fix. It would be
 better if there were a more standard interface for accomplishing the same
 thing.
 
-     </p></li><li><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=419598"; target="_top">Bug 419598 - 'var
+     </p></li><li class="listitem"><a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=419598"; target="_top">Bug 419598 - 'var
 Date' is deletable</a><p>
 
 Based on Page 62 of the <a class="ulink" href="http://www.ecma-international.org/publications/files/ECMA-ST/Ecma-262.pdf"; target="_top">ECMA-262
@@ -1207,7 +1259,7 @@ code, which currently relies on undocumented semantics of
 delete. This <span class="command"><strong>__proto__</strong></span> hack unfortunately does not work for
 the Date object though.
 
-     </p></li></ol></div></div></div><div class="sect1" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="TestPlan"></a>7. Testing</h2></div></div></div><p>
+     </p></li></ol></div></div></div><div class="sect1" title="7. Testing"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="TestPlan"></a>7. Testing</h2></div></div></div><p>
 
 The purpose of this section is to cover all the known ways that Tor browser
 security can be subverted from a penetration testing perspective. The hope
@@ -1216,7 +1268,7 @@ page, and for developing novel tests and actively attacking Torbutton with the
 goal of finding vulnerabilities in either it or the Mozilla components,
 interfaces and settings upon which it relies.
 
-  </p><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="SingleStateTesting"></a>7.1. Single state testing</h3></div></div></div><p>
+  </p><div class="sect2" title="7.1. Single state testing"><div class="titlepage"><div><div><h3 class="title"><a id="SingleStateTesting"></a>7.1. Single state testing</h3></div></div></div><p>
 
 Torbutton is a complicated piece of software. During development, changes to
 one component can affect a whole slough of unrelated features.  A number of
@@ -1228,20 +1280,20 @@ individually. They are provided here for reference and future regression
 testing, and also in the hope that some brave soul will one day decide to
 combine them into a comprehensive automated test suite.
 
-     </p><div class="orderedlist"><ol type="1"><li><a class="ulink" href="http://decloak.net/"; target="_top">Decloak.net</a><p>
+     </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><a class="ulink" href="http://decloak.net/"; target="_top">Decloak.net</a><p>
 
 Decloak.net is the canonical source of plugin and external-application based
 proxy-bypass exploits. It is a fully automated test suite maintained by <a class="ulink" href="http://digitaloffense.net/"; target="_top">HD Moore</a> as a service for people to
 use to test their anonymity systems.
 
-       </p></li><li><a class="ulink" href="http://deanonymizer.com/"; target="_top">Deanonymizer.com</a><p>
+       </p></li><li class="listitem"><a class="ulink" href="http://deanonymizer.com/"; target="_top">Deanonymizer.com</a><p>
 
 Deanonymizer.com is another automated test suite that tests for proxy bypass
 and other information disclosure vulnerabilities. It is maintained by Kyle
 Williams, the author of <a class="ulink" href="http://www.janusvm.com/"; target="_top">JanusVM</a>
 and <a class="ulink" href="http://www.januspa.com/"; target="_top">JanusPA</a>.
 
-       </p></li><li><a class="ulink" href="https://www.jondos.de/en/anontest"; target="_top">JonDos
+       </p></li><li class="listitem"><a class="ulink" href="https://www.jondos.de/en/anontest"; target="_top">JonDos
 AnonTest</a><p>
 
 The <a class="ulink" href="https://www.jondos.de"; target="_top">JonDos people</a> also provide an
@@ -1249,14 +1301,14 @@ anonymity tester. It is more focused on HTTP headers than plugin bypass, and
 points out a couple of headers Torbutton could do a better job with
 obfuscating.
 
-       </p></li><li><a class="ulink" href="http://browserspy.dk"; target="_top">Browserspy.dk</a><p>
+       </p></li><li class="listitem"><a class="ulink" href="http://browserspy.dk"; target="_top">Browserspy.dk</a><p>
 
 Browserspy.dk provides a tremendous collection of browser fingerprinting and
 general privacy tests. Unfortunately they are only available one page at a
 time, and there is not really solid feedback on good vs bad behavior in
 the test results.
 
-       </p></li><li><a class="ulink" href="http://analyze.privacy.net/"; target="_top">Privacy
+       </p></li><li class="listitem"><a class="ulink" href="http://analyze.privacy.net/"; target="_top">Privacy
 Analyzer</a><p>
 
 The Privacy Analyzer provides a dump of all sorts of browser attributes and
@@ -1265,14 +1317,14 @@ address. Its page layout and lack of good vs bad test result feedback makes it
 not as useful as a user-facing testing tool, but it does provide some
 interesting checks in a single page.
 
-       </p></li><li><a class="ulink" href="http://ha.ckers.org/mr-t/"; target="_top">Mr. T</a><p>
+       </p></li><li class="listitem"><a class="ulink" href="http://ha.ckers.org/mr-t/"; target="_top">Mr. T</a><p>
 
 Mr. T is a collection of browser fingerprinting and deanonymization exploits
 discovered by the <a class="ulink" href="http://ha.ckers.org"; target="_top">ha.ckers.org</a> crew
 and others. It is also not as user friendly as some of the above tests, but it
 is a useful collection.
 
-       </p></li><li>Gregory Fleischer's <a class="ulink" href="http://pseudo-flaw.net/content/tor/torbutton/"; target="_top">Torbutton</a> and
+       </p></li><li class="listitem">Gregory Fleischer's <a class="ulink" href="http://pseudo-flaw.net/content/tor/torbutton/"; target="_top">Torbutton</a> and
 <a class="ulink" href="http://pseudo-flaw.net/content/defcon/dc-17-demos/d.html"; target="_top">Defcon
 17</a> Test Cases
        <p>
@@ -1284,7 +1336,7 @@ demonstrates ways to infer Firefox version based on arcane browser properties.
 We are still trying to determine the best way to address some of those test
 cases.
 
-       </p></li><li><a class="ulink" href="https://torcheck.xenobite.eu/index.php"; target="_top">Xenobite's
+       </p></li><li class="listitem"><a class="ulink" href="https://torcheck.xenobite.eu/index.php"; target="_top">Xenobite's
 TorCheck Page</a><p>
 
 This page checks to ensure you are using a valid Tor exit node and checks for
@@ -1293,13 +1345,13 @@ or complete, but it is automated and could be turned into something useful
 with a bit of work.
 
        </p></li></ol></div><p>
-    </p></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2540533"></a>7.2. Multi-state testing</h3></div></div></div><p>
+    </p></div><div class="sect2" title="7.2. Multi-state testing"><div class="titlepage"><div><div><h3 class="title"><a id="id2549304"></a>7.2. Multi-state testing</h3></div></div></div><p>
 
 The tests in this section are geared towards a page that would instruct the
 user to toggle their Tor state after the fetch and perform some operations:
 mouseovers, stray clicks, and potentially reloads.
 
-   </p><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id2540545"></a>Cookies and Cache Correlation</h4></div></div></div><p>
+   </p><div class="sect3" title="Cookies and Cache Correlation"><div class="titlepage"><div><div><h4 class="title"><a id="id2549316"></a>Cookies and Cache Correlation</h4></div></div></div><p>
 The most obvious test is to set a cookie, ask the user to toggle tor, and then
 have them reload the page. The cookie should no longer be set if they are
 using the default Torbutton settings. In addition, it is possible to leverage
@@ -1307,11 +1359,11 @@ the cache to <a class="ulink" href="http://crypto.stanford.edu/sameorigin/safeca
 identifiers</a>. The default settings of Torbutton should also protect
 against these from persisting across Tor Toggle.
 
-    </p></div><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id2540568"></a>Javascript timers and event handlers</h4></div></div></div><p>
+    </p></div><div class="sect3" title="Javascript timers and event handlers"><div class="titlepage"><div><div><h4 class="title"><a id="id2549339"></a>Javascript timers and event handlers</h4></div></div></div><p>
 
 Javascript can set timers and register event handlers in the hopes of fetching
 URLs after the user has toggled Torbutton. 
-    </p></div><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id2540580"></a>CSS Popups and non-script Dynamic Content</h4></div></div></div><p>
+    </p></div><div class="sect3" title="CSS Popups and non-script Dynamic Content"><div class="titlepage"><div><div><h4 class="title"><a id="id2549351"></a>CSS Popups and non-script Dynamic Content</h4></div></div></div><p>
 
 Even if Javascript is disabled, CSS is still able to 
 <a class="ulink" href="http://www.tjkdesign.com/articles/css%20pop%20ups/"; target="_top">create popup-like
@@ -1321,7 +1373,7 @@ activity as soon as the mouse enters into the content window. It is also
 possible for meta-refresh tags to set timers long enough to make it likely
 that the user has toggled Tor before fetching content.
 
-    </p></div></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="HackTorbutton"></a>7.3. Active testing (aka How to Hack Torbutton)</h3></div></div></div><p>
+    </p></div></div><div class="sect2" title="7.3. Active testing (aka How to Hack Torbutton)"><div class="titlepage"><div><div><h3 class="title"><a id="HackTorbutton"></a>7.3. Active testing (aka How to Hack Torbutton)</h3></div></div></div><p>
 
 The idea behind active testing is to discover vulnerabilities in Torbutton to
 bypass proxy settings, run script in an opposite Tor state, store unique
@@ -1336,25 +1388,25 @@ these attacks, playing with them, and reporting what you find (and potentially
 submitting the test cases back to be run in the standard batch of Torbutton
 tests.
 
-   </p><div class="sect3" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id2540635"></a>Some suggested vectors to investigate</h4></div></div></div><p>
-    </p><div class="itemizedlist"><ul type="disc"><li>Strange ways to register Javascript <a class="ulink" href="http://en.wikipedia.org/wiki/DOM_Events"; target="_top">events</a> and <a class="ulink" href="http://www.devshed.com/c/a/JavaScript/Using-Timers-in-JavaScript/"; target="_top">timeouts</a> should
-be verified to actually be ineffective after Tor has been toggled.</li><li>Other ways to cause Javascript to be executed after
-<span class="command"><strong>javascript.enabled</strong></span> has been toggled off.</li><li>Odd ways to attempt to load plugins. Kyle Williams has had
-some success with direct loads/meta-refreshes of plugin-handled URLs.</li><li>The Date and Timezone hooks should be verified to work with
+   </p><div class="sect3" title="Some suggested vectors to investigate"><div class="titlepage"><div><div><h4 class="title"><a id="id2549406"></a>Some suggested vectors to investigate</h4></div></div></div><p>
+    </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">Strange ways to register Javascript <a class="ulink" href="http://en.wikipedia.org/wiki/DOM_Events"; target="_top">events</a> and <a class="ulink" href="http://www.devshed.com/c/a/JavaScript/Using-Timers-in-JavaScript/"; target="_top">timeouts</a> should
+be verified to actually be ineffective after Tor has been toggled.</li><li class="listitem">Other ways to cause Javascript to be executed after
+<span class="command"><strong>javascript.enabled</strong></span> has been toggled off.</li><li class="listitem">Odd ways to attempt to load plugins. Kyle Williams has had
+some success with direct loads/meta-refreshes of plugin-handled URLs.</li><li class="listitem">The Date and Timezone hooks should be verified to work with
 crazy combinations of iframes, nested iframes, iframes in frames, frames in
 iframes, and popups being loaded and
 reloaded in rapid succession, and/or from one another. Think race conditions and deep, 
 parallel nesting, involving iframes from both <a class="ulink" href="http://en.wikipedia.org/wiki/Same_origin_policy"; target="_top">same-origin and
-non-same-origin</a> domains.</li><li>In addition, there may be alternate ways and other
+non-same-origin</a> domains.</li><li class="listitem">In addition, there may be alternate ways and other
 methods to query the timezone, or otherwise use some of the Date object's
 methods in combination to deduce the timezone offset. Of course, the author
 tried his best to cover all the methods he could foresee, but it's always good
-to have another set of eyes try it out.</li><li>Similarly, is there any way to confuse the <a class="link" href="#contentpolicy" title="@torproject.org/cssblocker;1 - components/cssblocker.js">content policy</a>
+to have another set of eyes try it out.</li><li class="listitem">Similarly, is there any way to confuse the <a class="link" href="#contentpolicy" title="@torproject.org/cssblocker;1 - components/cssblocker.js">content policy</a>
 mentioned above to cause it to allow certain types of page fetches? For
 example, it was recently discovered that favicons are not fetched by the
 content, but the chrome itself, hence the content policy did not look up the
 correct window to determine the current Tor tag for the favicon fetch. Are
-there other things that can do this? Popups? Bookmarklets? Active bookmarks? </li><li>Alternate ways to store and fetch unique identifiers. For example, <a class="ulink" href="http://developer.mozilla.org/en/docs/DOM:Storage"; target="_top">DOM Storage</a>
+there other things that can do this? Popups? Bookmarklets? Active bookmarks? </li><li class="listitem">Alternate ways to store and fetch unique identifiers. For example, <a class="ulink" href="http://developer.mozilla.org/en/docs/DOM:Storage"; target="_top">DOM Storage</a>
 caught us off guard. 
 It was
 also discovered by <a class="ulink" href="http://pseudo-flaw.net"; target="_top">Gregory
@@ -1366,13 +1418,13 @@ arcane or experimental ways that Firefox provides to create and store unique
 identifiers? Or perhaps unique identifiers can be queried or derived from
 properties of the machine/browser that Javascript has access to? How unique
 can these identifiers be?
-     </li><li>Is it possible to get the browser to write some history to disk
+     </li><li class="listitem">Is it possible to get the browser to write some history to disk
 (aside from swap) that can be retrieved later? By default, Torbutton should
 write no history, cookie, or other browsing activity information to the
-harddisk.</li><li>Do popup windows make it easier to break any of the above
+harddisk.</li><li class="listitem">Do popup windows make it easier to break any of the above
 behavior? Are javascript events still canceled in popups? What about recursive
 popups from Javascript, data, and other funky URL types? What about CSS
-popups? Are they still blocked after Tor is toggled?</li><li>Chrome-escalation attacks. The interaction between the
+popups? Are they still blocked after Tor is toggled?</li><li class="listitem">Chrome-escalation attacks. The interaction between the
 Torbutton chrome Javascript and the client content window javascript is pretty
 well-defined and carefully constructed, but perhaps there is a way to smuggle
 javascript back in a return value, or otherwise inject network-loaded
-- 
1.5.6.5