[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #30388 [Applications/Tor Browser]: NoScript and all user-installed add-ons got deactivated! (armagadd-on-2.0)
#30388: NoScript and all user-installed add-ons got deactivated! (armagadd-on-2.0)
--------------------------------------+------------------------------
Reporter: cypherpunks | Owner: tbb-team
Type: task | Status: needs_review
Priority: Immediate | Milestone:
Component: Applications/Tor Browser | Version:
Severity: Blocker | Resolution:
Keywords: AffectsTails | Actual Points:
Parent ID: | Points:
Reviewer: | Sponsor:
--------------------------------------+------------------------------
Comment (by cypherpunks):
Replying to [comment:1 mcs]:
> Until this can be fixed properly, here is a temporary workaround for Tor
Browser:
> 1. Open about:config
> 2. Toggle the value of `xpinstall.signatures.required` so it becomes
`false`.
Please don't tell people to do this. The suggested workaround is an
'''unequivocally bad idea'''.
In the immediate sense, this is a real risk. In the big picture, the Tor
Project is training users to defeat "certificate validation" failed
errors! This flies in the face of security/usability doctrine.
Today, Mozilla broke its PKI; so you tell users how to disable
cryptographic signature checks of addons. Tomorrow, Verislime breaks its
PKI; so you tell users to click "Add Exception" for every TLS certificate
error?
For the sake not only of security, but also of long-term user education,
please change the public blog post to not tell people to disable signature
checks.
'''Good workaround: Open `about:config`, and set `javascript.enabled` to
`false`.'''
This will totally disable JavaScript. Therefore, NoScript is not needed.
(Thanks to other cypherpunks in ticket:30394#comment:4 .)
It may mess up the Security Slider, so do this ''after'' setting the
Slider to High. This way, you will also get settings such as disabling
SVG, MathML, Web fonts... Or if you need JavaScript on some sites, set the
Slider to Medium first (disables ultra-dangerous script features). Then,
leave an `about:config` tab open so you can toggle JavaScript on and off
(as I did in the 90s, before the Tor Browser existed). I do not know if
that has any additional risks; NoScript also disables some JavaScript
features, and has XSS protection.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/30388#comment:19>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs