On the 13.0 release of the specialized Tor Browser, a significant update has been made, transitioning to the ESR branch of Firefox 115. The browser focuses on ensuring anonymity, security, and privacy, redirecting all traffic solely through the Tor network. Direct access through the system's current network connection is impossible, which prevents the tracking of the user's actual IP address (in case the browser is compromised, attackers may gain access to system network parameters, thus for complete leak protection, products like Whonix should be used). Tor Browser builds are prepared for Linux, Android, Windows, and macOS.
To provide additional protection in Tor Browser, the "HTTPS Only" setting is enabled, allowing for traffic encryption on all sites where possible. To reduce threats from JavaScript attack vectors and to block plugins by default, the NoScript extension is included. To combat traffic blocking and inspection, fteproxy and obfs4proxy are utilized.
For organizing an encrypted communication channel in environments that block any traffic except HTTP, alternative transports are offered, which, for example, allow bypassing attempts to block Tor in China. To protect against tracking of user movement and to prevent identification of specific characteristics unique to individual visitors, APIs such as WebGL, WebGL2, WebAudio, Social, SpeechSynthesis, Touch, AudioContext, HTMLMediaElement, Mediastream, Canvas, SharedWorker, WebAudio, Permissions, MediaDevices.enumerateDevices, and screen.orientation are disabled or limited. Additionally, telemetry sending tools, Pocket, Reader View, HTTP Alternative-Services, MozTCPSocket, "link rel=preconnect", and modified libmdns are turned off.
Uues versioonis:
- The transition to the Firefox 115 ESR codebase and stable branch of Tor 0.4.8.7 has been completed. During the transition to the new version of Firefox, an audit of the changes made since the appearance of the ESR branch of Firefox 102 has been conducted, and patches deemed questionable in terms of security and privacy have been disabled. Among other things, the string-to-double conversion code has been replaced, the recent linking exchange function has been disabled, the API for saving PDFs has been turned off, the cookie confirmation banner auto-hide service and interface have been removed, and text recognition interface has been eliminated.
- Icons have been updated and the application's logo refined, while maintaining overall recognition.
- Esitatud on uus kodulehe rakendus ("about:tor"), mis paistab silma logo lisamise, kujunduse lihtsustamise ning ainult otsinguriba ja "onionize" lĂŒliti jĂ€tmisega DuckDuckGo juurde minemiseks onion-teenusesse. Kodulehe renderdamisel on parandatud ekraanilugejate ja puuetega inimeste abivahendite tuge. Lisatud on jĂ€rjehoidjate paneeli kuvamine. Lahendatud on probleem "punase surmaekraaniga", mis tekkis Tor vĂ”rguĂŒhenduse kontrollimise rikke tĂ”ttu.
On:
Oli:
- Uute akende suurust on suurendatud, et vaikimisi valitav kuvasuhe oleks laiekraanide kasutajatele mugavam. Informatsiooni ekraani ja akna suuruse leket vĂ€ltimiseks rakendatakse Tor Brauseris letterboxing mehhanismi, mis lisab sisu ĂŒmber veebilehtedele marginaalid. Eelmistes versioonides muutus akna suuruse muutmisel aktiivse ala suurus samm-sammu haaval 200Ă100 pikslit, kuid maksimaalse lahutuse piirang oli 1000Ă1000, mis liiga vĂ€ikese laiuse tĂ”ttu tekitas probleeme mĂ”nede veebisaitidega, mis nĂ€itasid horisontaalset kerimisriba vĂ”i kuvati tahvelarvuti ja mobiilseadmete versiooni. Selle probleemi lahendamiseks on maksimaalne lahutus suurendatud 1400Ă900-ni ja suuruse muutmise loogika on muudetud.
- Ăleminek on toimunud uuele pakendite nimetamise skeemile, mis vastab mustrile "${ARTIFACT}-${OS}-${ARCH}-${VERSION}.${EXT}". NĂ€iteks varem tarniti macOS versioon kui "TorBrowser-12.5-macos_ALL.dmg", nĂŒĂŒd on see vormis "tor-browser-macos-13.0.dmg".
- MĂ”ned DuckDuckGo otsingud mÀÀratakse nĂŒĂŒd JavaScriptita versioonile, kui valitakse "Safest" reĆŸiim.
- WebRTC-lekke kaitse on tugevdatud.
- Lisatud on URL-i parameetrite puhastamine, mida kasutatakse liikumiste jÀlgimiseks (nt eemaldatakse mc_eid ja fbclid parameetrid, mis lisatakse Facebooki lehtedelt linkide avamisel).
- Eemaldatud on seade javascript.options.large_arraybuffers.
- Linuxi platvormil on keelatud seadistus browser.tabs.searchclipboardfor.middleclick.
Allikas: opennet.ru
