On the 13.0 release of the specialized Tor Browser, a significant update has been made, transitioning to the ESR branch of Firefox 115. The browser focuses on ensuring anonymity, security, and privacy, redirecting all traffic solely through the Tor network. Direct access through the system's current network connection is impossible, which prevents the tracking of the user's actual IP address (in case the browser is compromised, attackers may gain access to system network parameters, thus for complete leak protection, products like Whonix should be used). Tor Browser builds are prepared for Linux, Android, Windows, and macOS.
To provide additional protection in Tor Browser, the "HTTPS Only" setting is enabled, allowing for traffic encryption on all sites where possible. To reduce threats from JavaScript attack vectors and to block plugins by default, the NoScript extension is included. To combat traffic blocking and inspection, fteproxy and obfs4proxy are utilized.
For organizing an encrypted communication channel in environments that block any traffic except HTTP, alternative transports are offered, which, for example, allow bypassing attempts to block Tor in China. To protect against tracking of user movement and to prevent identification of specific characteristics unique to individual visitors, APIs such as WebGL, WebGL2, WebAudio, Social, SpeechSynthesis, Touch, AudioContext, HTMLMediaElement, Mediastream, Canvas, SharedWorker, WebAudio, Permissions, MediaDevices.enumerateDevices, and screen.orientation are disabled or limited. Additionally, telemetry sending tools, Pocket, Reader View, HTTP Alternative-Services, MozTCPSocket, "link rel=preconnect", and modified libmdns are turned off.
Uues versioonis:
- The transition to the Firefox 115 ESR codebase and stable branch of Tor 0.4.8.7 has been completed. During the transition to the new version of Firefox, an audit of the changes made since the appearance of the ESR branch of Firefox 102 has been conducted, and patches deemed questionable in terms of security and privacy have been disabled. Among other things, the string-to-double conversion code has been replaced, the recent linking exchange function has been disabled, the API for saving PDFs has been turned off, the cookie confirmation banner auto-hide service and interface have been removed, and text recognition interface has been eliminated.
- Icons have been updated and the application's logo refined, while maintaining overall recognition.
- Esitatud on uus kodulehe rakendus ("about:tor"), mis paistab silma logo lisamise, kujunduse lihtsustamise ning ainult otsinguriba ja "onionize" lüliti jätmisega DuckDuckGo juurde minemiseks onion-teenusesse. Kodulehe renderdamisel on parandatud ekraanilugejate ja puuetega inimeste abivahendite tuge. Lisatud on järjehoidjate paneeli kuvamine. Lahendatud on probleem "punase surmaekraaniga", mis tekkis Tor võrguühenduse kontrollimise rikke tõttu.
On:
Oli:
- Uute akende suurust on suurendatud, et vaikimisi valitav kuvasuhe oleks laiekraanide kasutajatele mugavam. Informatsiooni ekraani ja akna suuruse leket vältimiseks rakendatakse Tor Brauseris letterboxing mehhanismi, mis lisab sisu ümber veebilehtedele marginaalid. Eelmistes versioonides muutus akna suuruse muutmisel aktiivse ala suurus samm-sammu haaval 200×100 pikslit, kuid maksimaalse lahutuse piirang oli 1000×1000, mis liiga väikese laiuse tõttu tekitas probleeme mõnede veebisaitidega, mis näitasid horisontaalset kerimisriba või kuvati tahvelarvuti ja mobiilseadmete versiooni. Selle probleemi lahendamiseks on maksimaalne lahutus suurendatud 1400×900-ni ja suuruse muutmise loogika on muudetud.
- Üleminek on toimunud uuele pakendite nimetamise skeemile, mis vastab mustrile "${ARTIFACT}-${OS}-${ARCH}-${VERSION}.${EXT}". Näiteks varem tarniti macOS versioon kui "TorBrowser-12.5-macos_ALL.dmg", nüüd on see vormis "tor-browser-macos-13.0.dmg".
- Mõned DuckDuckGo otsingud määratakse nüüd JavaScriptita versioonile, kui valitakse "Safest" režiim.
- WebRTC-lekke kaitse on tugevdatud.
- Lisatud on URL-i parameetrite puhastamine, mida kasutatakse liikumiste jälgimiseks (nt eemaldatakse mc_eid ja fbclid parameetrid, mis lisatakse Facebooki lehtedelt linkide avamisel).
- Eemaldatud on seade javascript.options.large_arraybuffers.
- Linuxi platvormil on keelatud seadistus browser.tabs.searchclipboardfor.middleclick.
Allikas: opennet.ru
