Re: Passing language code to check.torproject.org

[Jacob Appelbaum <jacob@xxxxxxxxxxxxx>]

Steven J. Murdoch wrote:
> [ Cc'ing or-dev in case anyone else wants to contribute ]
> 
> Jacob,
> 
> Since the Tor Browser Bundle uses Torbutton, Firefox reports that it
> is using US English to websites. This is good because it hides what
> country a particular user is coming from, and so increases the size of
> the anonymity set.

Yes. I agree. It's quite useful to mask that. In the event of the user
not having Torbutton enabled - Am I right to assume that they would
probably leak their language choice? I think it will but I'm an English
speaker and I haven't tested it.

> 
> Tor Browser Bundle has check.torproject.org as the homepage, which is
> currently only in English. However, even if it were translated, it
> cannot automatically show the right language, because of TorButton's
> language cloaking.
> 

Right.

> I think the simplest solution is for the default homepage for Tor
> Browser Bundle to be set to include the language code, e.g.
>  http://check.torproject.org/?lang=zh-CN

How do you feel about using https for this? Phobos bought us a cert that
should be good for the rest of the year. Ideally, if we use SSL, we're
going to have even less of an issue leaking possible linkable language
information to exit nodes.

We probably also want to ensure that any link on check.tpo doesn't leak
a referring url that includes their language choice.

> 
> This will allow the check page to display the right language, while
> not leaking that to other sites.

It does seem like a reasonable thing to do at some point. I certainly
have wanted to integrate the language with the "it doesn't appear that
you are using Tor" message. It's not very helpful to have that in a
language someone doesn't understand.

> 
> The down-side is that check.torproject.org will get the country code,
> but I think that is less of a problem. The site would only learn that
> a particular anonymous user has configured a certain language with the
> Tor Browser Bundle. 
> 

Right. I think this underscores the need for trust in running
check.torproject.org.

> This is less sensitive than knowing that a particular user has set
> this language and is interested in this particular website.
> 
> Any thoughts? If there are no objections, I'll add this to the next
> version of the bundle. Currently check.torproject.org appears to
> ignore the language code, so it won't make a difference now, but will
> be ready when the site is translated.
> 

I think this is good providing a switch to https://check.torproject.org

Best,
Jake