The release of the specialized Tor Browser 16.0 has been announced, which transitions to the ESR branch of Firefox 153. The browser focuses on ensuring privacy and security, with all traffic redirected solely through the Tor network. It is not possible to connect directly through the system's current network connection (in the event of a browser hack, attackers could gain access to system network settings; therefore, to fully block potential leaks, products like Whonix should be used). Tor Browser builds are prepared for Linux, Android, Windows, and macOS.
For additional protection, Tor Browser includes the ‘HTTPS Only’ setting, which allows for traffic encryption on all websites where possible. To mitigate the threat posed by JavaScript attacks and to block plugins by default, the NoScript extension is included. To combat traffic inspection, fteproxy and obfs4proxy are employed. For creating an encrypted communication channel in environments that block any traffic except HTTP, alternative transports are offered.
To prevent tracking of user movement and to limit the identification of visitor-specific characteristics, APIs such as WebGL, WebGL2, WebAudio, Social, SpeechSynthesis, Touch, AudioContext, HTMLMediaElement, Mediastream, Canvas, SharedWorker, WebAudio, Permissions, MediaDevices.enumerateDevices, and screen.orientation have been disabled or restricted, as well as telemetry sending tools, Pocket, Reader View, HTTP Alternative-Services, MozTCPSocket, 'link rel=preconnect', and libmdns has been modified.
In the new version:
- The transition to the Firefox 153 ESR codebase has been made (previously, Firefox 140 was used). During this transition, an audit of changes in Firefox was conducted, analyzing and addressing 274 potential issues that could negatively impact privacy and security. The NoScript extension has been updated to version 13.6.37.1984, and the Tor toolkit to version 0.4.9.15.
- The configuration interface has been redesigned, expanding the search capabilities for settings, improving navigation, and updating labels and descriptions of settings. The ‘General’ section has been divided into several new sections for appearance, downloads, tabs, languages, and tools for people with disabilities. To maintain uniformity with Firefox, Tor-specific sections for connection settings and security level have been reworked. Settings that decrease privacy or simplify hidden identification have been hidden or provided with warnings.
- A section dedicated to protection against tracking by third-party applications for pages opened in the browser has been added to the 'Privacy and Security' settings. Currently, only one option is offered to disable the display of page titles in the window's title bar. When enabled, the title will always show only 'Tor Browser'. Since obtaining information from other windows' titles does not require special permissions, any third-party application can gather information about the opened pages by tracking title changes.
The implementation of the discussed option has also been transferred to the Firefox codebase and is already available for activation through the parameters privacy.exposeContentTitleInWindow and privacy.exposeContentTitleInWindow.pbm on the about:config page.
- The user guide, as proposed on the about:manual page (in the 'Help → Tor Browser manual' menu), has been rewritten and synchronized with the documentation on the website.
- Builds for Linux systems on the AArch64 architecture have been added, which can, among other things, be used on Raspberry Pi boards and Macs with Apple Silicon chips.
- Support for 32-bit Linux builds for x86 systems has been discontinued. According to the developers, there are only about 200 requests for updates for such builds submitted daily.
- The Android version continues to transition to using the Jetpack Compose framework. A significant portion of the interface has been redesigned according to the Material Design 3 concept. Efforts have been made to reduce the APK size to not exceed the Google Play limit of 100 MB.
Source: opennet.ru
