The release of the specialized browser Tor Browser 15.0 has been announced, which has transitioned to the Firefox 140 ESR branch. The browser focuses on ensuring privacy and security, with all traffic routed solely through the Tor network. It is not possible to connect directly through the system's current network connection (in case the browser is compromised, attackers may gain access to system network settings, so to completely block potential leaks, products like Whonix should be used). Tor Browser builds are prepared for Linux, Android, Windows, and macOS.
For additional protection, Tor Browser includes the 'HTTPS Only' setting, allowing encryption of traffic on all sites where possible. To reduce threats from JavaScript-based attacks and to block plugins by default, the NoScript extension is included. To combat traffic blockage and inspection, fteproxy and obfs4proxy are used. Alternative transports are offered for establishing an encrypted communication channel in environments that block any traffic except HTTP.
To prevent tracking of user movement and to limit the identification of visitor-specific characteristics, APIs such as WebGL, WebGL2, WebAudio, Social, SpeechSynthesis, Touch, AudioContext, HTMLMediaElement, Mediastream, Canvas, SharedWorker, WebAudio, Permissions, MediaDevices.enumerateDevices, and screen.orientation have been disabled or restricted, as well as telemetry sending tools, Pocket, Reader View, HTTP Alternative-Services, MozTCPSocket, 'link rel=preconnect', and libmdns has been modified.
In the new version:
- The transition to the Firefox 140 ESR codebase has been carried out (previously using Firefox 128). The NoScript extension has been updated to version 13.2.2. During the transition, an audit of changes in Firefox was conducted, analyzing and addressing over 200 potential issues that could negatively impact privacy and security.
- New features implemented in Firefox over the past year have been utilized, such as support for tab grouping, vertical tab placement, bookmark navigation from the sidebar, and a unified search button in the address bar.
- The Android version has added a screen lock feature that prevents viewing open tabs until the device unlock code is entered or biometric authentication is passed. The lock is enabled in the settings under 'Settings > Tabs' and automatically activates each time switching to another application.
- The NoScript extension has been utilized to block WebAssembly technology, which is applied by default when selecting the Safer and Safest security levels. Previously, a global setting 'javascript.options.wasm' was changed to block it, but after using WebAssembly in the built-in PDF viewer, this method began to block the PDF viewer.
- Tor Browser 15.0 continues to support Android 5.0+, but following changes in Firefox, the platform requirements will be raised in Tor Browser 16.0, requiring at least Android 8 for operation. Similarly, in Tor Browser 16.0, support for 32-bit x86 CPUs in Linux and Android builds will be discontinued.
Source: opennet.ru
