At the ongoing meeting of Tor developers in Stockholm, a separate session issues of of Tor and Firefox. The key tasks revolve around creating an add-on that enables operation through the anonymous Tor network in standard Firefox, as well as porting patches developed for Tor Browser into the main Firefox codebase. A special website has been prepared to monitor the status of the patch porting . So far, 13 patches have been ported, and discussions on 22 patches have been initiated in the Mozilla bug tracker (over a hundred patches have been proposed in total).
The main idea behind the integration with Firefox is to utilize Tor while operating in private mode or to create an additional super-private mode with Tor. Since enabling Tor support in the main Firefox codebase requires substantial work, it has been decided to start with the development of an external add-on. The add-on will be provided through the addons.mozilla.org directory and will include a button to enable operation mode through Tor. Delivering it as an add-on will allow for assessing the overall concept of how built-in Tor support might look.
The code for working with the Tor network is planned to be compiled from C into WebAssembly rather than rewritten in JavaScript, allowing all necessary verified Tor components to be included in the add-on without reliance on external executable files and libraries.
The Tor transition will be organized through proxy settings changes and the use of a custom handler as a proxy. When switching to Tor operation mode, the add-on will also change some settings related to security. In particular, settings similar to those in Tor Browser will be applied, aimed at blocking potential proxy bypass paths and countering user system identification.
For the extension to function, it will require elevated privileges that go beyond the standard capabilities of WebExtension-based add-ons and are characteristic of system extensions (for example, the extension will directly invoke XPCOM functions). Such privileged extensions must be signed with a digital signature from Mozilla, but since the extension is being proposed to be developed in collaboration with Mozilla and released on behalf of Mozilla, there should be no issues in obtaining additional privileges.
The Tor mode interface is still under discussion. For example, it is proposed that clicking the Tor button opens a new window with a separate profile. In Tor mode, it is also suggested to completely prohibit sending requests over HTTP, as the contents of unencrypted traffic can be intercepted and modified at the Tor exit nodes. Protection against HTTP traffic manipulation through NoScript has been deemed insufficient, so it is simpler to restrict Tor mode to requests only via HTTPS.
Source: opennet.ru
