Tor Browser 11.5: automatic censorship detection, HTTPS-Only by default and more

https://blog.torproject.org/new-release-tor-browser-115/

by jerheinze • 4 years ago

57 7 4 years ago

blog.torproject.org

Trouble_007• 4 years ago

Tor Browser 11.5 - July 7 2022 - Change Log (Text) : https://gitweb.torproject.org/builders/tor-browser-build.git...

i67vw32• 4 years ago

Any update on this https://blog.torproject.org/domain-fronting-critical-open-we...

As I get it, to connect to bridges (get data) it will use normal clearnet https. But, to avoid getting yourself flagged (at the time you are getting data about bridges), it will use moat and pretend to connect to Microsoft Azure servers to get the info about bridges. The blog post is from 2018, so is tor project still using azure, or did the whole 'domain-fronting' feature get blocked from azure too just like AWS and google.

detaro• 4 years ago

Azure announced last year they'll be blocking it at some point, it still worked earlier this year but its days are likely numbered.

i67vw32• 4 years ago

So what are they planning to do if azure domain-fronting shuts down in forseeable future? Will Cloudlfare be the replacement for it?

gravitate• 4 years ago

Great. I used to have HTTPS Everywhere extension installed in Tor Browser Bundle, with the EASE/Encrypt All Sites Eligible toggle turned on to avoid browsing HTTP only sites during casual surfing. Some exit nodes are malicious and slurp up plaintext HTTP and there is the risk of leaking stuff with plaintext sites. With a native implementation of HTTPS-Only I don’t have to install an addon and it will force people to not browse HTTP sites, unless they turn it off which adds to the fingerprintability of the browser, so I would recommend against messing with the default setting.

fuglede_• 4 years ago

Here's a small historical curiosity: In HTTPS Everywhere, the functionality used to be call "Block all HTTP requests" but when that functionality was changed (back in 2016 [0]) to not block connections to non-HTTPS hidden services, it was renamed to "Block all unencrypted requests".

I just checked, and indeed Tor Browser 11.5 does not block non-HTTPS connections to hidden services, even when in "HTTPS-Only" mode. Thankfully.

[0] https://github.com/EFForg/https-everywhere/pull/4370

midislack• 4 years ago

Does it still use the same guard node forever or did they fix that?

Tor Browser 11.5: automatic censorship detection, HTTPS-Only by default and more

Related Stories