A significant release of the specialized Tor Browser 12.0 has been formed, transitioning to the ESR branch of Firefox 102. The browser focuses on ensuring anonymity, security, and privacy, with all traffic routed only through the Tor network. Direct access via the current system's standard network connection is impossible, which prevents tracking the user's real IP address (in the event of a browser hack, attackers could access system network parameters, so products like Whonix should be used to completely block potential leaks). Tor Browser builds are prepared for Linux, Windows, and macOS. The formation of a new version for Android is delayed.
To provide additional protection, Tor Browser includes the HTTPS Everywhere extension, allowing encryption of traffic on all sites where possible. To mitigate threats from JavaScript-based attacks and to block plugins by default, the NoScript extension is included. To combat traffic blocking and inspection, fteproxy and obfs4proxy are utilized.
For establishing an encrypted communication channel in environments that block any traffic except HTTP, alternative transports are offered, which, for example, allow circumventing attempts to block Tor in China. To protect against tracking user movement and isolating specific characteristics of individual visitors, APIs such as WebGL, WebGL2, WebAudio, Social, SpeechSynthesis, Touch, AudioContext, HTMLMediaElement, Mediastream, Canvas, SharedWorker, WebAudio, Permissions, MediaDevices.enumerateDevices, and screen.orientation are disabled or limited, as well as telemetry submission tools, Pocket, Reader View, HTTP Alternative-Services, MozTCPSocket, "link rel=preconnect", modified libmdns.
In the new version:
- The code base has transitioned to Firefox 102 ESR and the stable branch tor 0.4.7.12.
- Multilingual builds have been provided — previously, a separate build was required for each language, but now a universal build allows for on-the-fly language switching. For new installations in Tor Browser 12.0, the language corresponding to the system locale will be automatically selected (the language can be changed during use), and when transitioning from branch 11.5.x, the previously used Tor Browser language will be retained. The multilingual build is approximately 105 MB.
- The Android version has HTTPS-Only mode enabled by default, where all requests made without encryption are automatically redirected to the secure version of the pages ("http://" is replaced with "https://"). This mode was introduced in the last significant version for desktop systems.
- In the Android version, the 'Privacy and Security' section has added the 'Prioritize .onion sites' setting, which ensures automatic redirection to onion sites when attempting to open web pages that provide the HTTP header 'Onion-Location', indicating the presence of a site variant on the Tor network.
- Interface translations have been added for Albanian and Ukrainian languages.
- The tor-launcher component has been redesigned to facilitate the launch of Tor for Tor Browser.
- The implementation of the letterboxing mechanism has been improved, adding padding around web page content to prevent identification by window size. The option to disable letterboxing for trusted pages has been provided, the removal of one-pixel borders around fullscreen videos has been implemented, and potential information leaks have been addressed.
- After conducting an audit, support for HTTP/2 Push has been enabled.
- Data leaks regarding locale through the Intl API, system colors via CSS4, and blocked ports (network.security.ports.banned) have been prevented.
- The Presentation API and Web MIDI have been disabled.
- Native builds for Apple devices with Apple Silicon chips have been prepared.
Source: opennet.ru
