[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #3994 [Tor bundles/installation]: Get TorBrowser in Debian
#3994: Get TorBrowser in Debian
--------------------------------------+-------------------------------------
Reporter: lunar | Owner: erinn
Type: task | Status: new
Priority: normal | Milestone:
Component: Tor bundles/installation | Version:
Keywords: | Parent:
Points: | Actualpoints:
--------------------------------------+-------------------------------------
Comment(by cypherpunks):
One problem I can foresee with the idea of packaging TorBrowser for Debian
is that the packaging of Firefox/Iceweasel usually lags behind upstream by
several version numbers. This is particularly true of Debian stable. Thus
it's likely that for most of the lifetime of each Debian stable release,
the version of Iceweasel in stable will be considerably older than the
version of Firefox that the upstream TorBrowser bundle is based on.
It is probably possible for an active attacker to detect the underlying
version of Firefox by probing the level of javascript/css/html support
that the browser provides (e.g. see the ecmascript compatibility tables at
http://kangax.github.com/es5-compat-table/ ). Thus a Debian-packaged
TorBrowser will have a different "fingerprint" to a recent upstream
TorBrowserBundle, and an attacker who is trying to track users will be
able to distinguish between the two.
If there are considerably fewer users of Debian-packaged TorBrowser than
users of the upstream TorBrowserBundle on all platforms (which is likely),
users of Debian-packaged TorBrowser would have significantly less
anonymity than users of the upstream TorBrowserBundle.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/3994#comment:6>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs