Onion Browser (iOS Tor web browser, open source) now available in the App Store

http://v3.mike.tig.as/onionbrowser/

by mtigas • 14 years ago

123 49 14 years ago

v3.mike.tig.as

schwanksta• 14 years ago

Just bought it and it works very well. And it's open source, which is refreshing for an app store app.

masonlee• 14 years ago

It would be sweet for trusted computing if developers were able to submit source directly to an app store for the app store to compile, sign, and make available along with the binaries.

samstave• 14 years ago

Call it Git-y-app.

bamazizi• 14 years ago

bought it right away as well. confirm it doesn't work. just moved to ir couple of days ago and internet's been a nightmare!

d4sh2• 14 years ago

Only available in the US, too bad.

mtigas10• 14 years ago

Actually: should be available everywhere except France right now. (Selling encryption apps to France apparently requires an "export compliance approval" from the French government, and I haven’t gone through that process yet — primarily because I don't speak French.)

Let me know if that's not the case and I’ll double-check my settings in iTunes Connect.

d4sh2• 14 years ago

Well, it seems I should have said "not available in France", sorry for the mix up, I only checked French and US stores.

zalew2• 14 years ago

> Selling encryption apps to France apparently requires an "export compliance approval" from the French government

they require a backdoor?

jarek-foksa• 14 years ago

Check this thread on Apple developer forums, there is a link to translation of French export forms: https://devforums.apple.com/thread/109830

According to the FAQ on iTunes Connect you need French export forms only if the app contains:

  - any encryption algorithm that is yet to be standardized by
  international standard bodies such as IEEE, IETF, ISO, ITU,
  ETSI, 3GPP, TIA, etc. or not otherwise published; or 

  - standard (e.g., AES, DES, 3DES, RSA) encryption algorithm(s)
  instead of or in addition to accessing or using the encryption
  in Apple OS

nthitz• 14 years ago

Wow I'm a little surprised Apple let this one through! Looks neat!

mtigas10• 14 years ago

There’s another one (Covert Browser) that’s been in the store since November that’s got a few issues (lack of cookie support, lack of POST support) that render a lot of websites useless.

Generally I don’t think this is (on the face) any worse than a regular third-party browser app: Other apps (games are a great example) are free to implement custom communication protocols and there are plenty of unsavory / underground / illicit websites on the regular internet. Tor has a lot of legitimate and illegitimate uses, but that can pretty much be said of web-based communication in general.

showerst• 14 years ago

Just chiming in to say nice work Mike, and that it's nice to see another former Plus-One'r around these parts =)

ja272• 14 years ago

Anyone else trying to build it? Getting an error from the build-libssh.sh after openssl-1.0.1.tar.gz is downloaded:

tar: Code/iOS-OnionBrowser/build/src: Not found in archive

mtigas10• 14 years ago

What OS X and iOS SDK are you running with? You mind filing a bug if you have a GitHub account? https://github.com/mtigas/iOS-OnionBrowser/issues

I might have some dependencies that I’ve neglected to mention (since I use homebrew a ton) and I’m trying to nail down the build scripts to be a bit more portable.

ja272• 14 years ago

It was spaces in the path to where I was trying to build from. Breaking scripts for decades. It's building now.

ScottWhigham• 14 years ago

Very cool - just bought.

One confusing thing I found is that, when I typed in "onion browser" into my iPhone's App Store Search field, three results came back. I found myself not really know which one was truly yours (yours was actually #2 search result). It would have been helpful if, in the screenshots on this page, you showed the logo. The logo is shown in the App Store so that would've made it a slam dunk, easy decision.

mtigas10• 14 years ago

Thanks for the heads up — deploying a new version of the product page that has a version of the icon in the header.

richbradshaw• 14 years ago

For people trying to build, just a few things to know:

I had to install ccache before libssl would compile. Make sure you build libssl before libevent. In the icons folder is a install script to download the icons.

Otherwise compiles well. The anonymity of the .onion sites scares me. I have a very strong suspicion that one day SSL (i.e. symmetric encryption with no backdoor) will be illegal in many countries.

mtigas10• 14 years ago

Hm, tried to fix the ccache requirement[1][2], but might have botched it. Was using ccache while I was originally developing to speed up the dependency compilation but didn’t intend for it to be a requirement, just an optional speed-up. Will take a look.

[1] https://github.com/mtigas/iOS-OnionBrowser/blob/master/build... [2]: https://github.com/mtigas/iOS-OnionBrowser/commit/68a92f488b...

Aloisius• 14 years ago

The anonymity of the .onion sites scares me.

The content of a lot of .onion sites scares me. Definitely a higher concentration of crazy than I'm used to on the internet.

PaperclipTaken2• 14 years ago

This is one of the big problems that most people have with anonymity, but I believe that the freedom of speech is important. If the government has the capability to shut down the scary stuff like child porn, it also has the ability to shut down important stuff like criticism.

These corners of the internet aren't pretty but they play an important role within our society.

redthrowaway3• 14 years ago

What's the speed like? Tor on my laptop ranges from slow to unusable; I assume the same is true of the iOS app?

evoxed• 14 years ago

What exactly do you consider slow? Most recently I was getting a consistent 500kB/s downstream on my laptop [edit: while grabbing some rather large PDFs, so continuous downloading]. I've yet to give it a go on iOS.

redthrowaway3• 14 years ago

Perhaps it's gotten better lately, but I found browsing with Tor last time I did it to be painfully slow, with some pages taking forever to load. Didn't run a speedtest, though.

wladimir• 14 years ago

The latency can be significant for TOR, as your connection is bounced through various hosts all over the world. This prevents a single country from putting all the pieces together. This is what you notice while browsing.

The raw bandwidth on the other hand is usually pretty good (not great, but it's not intended for large downloads anyway as they tax the network...).

TOR is meant for the cases when anonymity trumps convenience.

haakon• 14 years ago

Exactly. Having a website load slowly is nothing compared to the insides of an Iranian torture cell. For more and more people, this is not a false dichotomy. Tor's speed is not the result of poor engineering; instead it follows from the properties a high-anonymity, low-latency network necessarily has. As users, before we complain about speed, we need to keep this in mind and consider whether we require such protection.

pooriaazimi• 14 years ago

I bought it right away (I could've built it myself, but didn't feel like opening Xcode). It doesn't work unfortunately (I'm in Iran).

mtigas10• 14 years ago

I’ll make it a priority to allow using bridges. Unfortunately, since Iran is known to block pretty much all Tor access (even regular, unlisted bridges), it may still not work.

Getting around this entirely would require obfsproxy[1] which wouldn’t work on iOS the way I have it set up due to the inability to spawn sub processes. (Tor client, when configured to use obfsproxy bridges, has to spawn an obfsproxy process to handle the obfusctaed traffic.)

[1] https://www.torproject.org/projects/obfsproxy.html.en

bonjourmr2• 14 years ago

Somewhat slow here in Aus using Telstra 3G, 45 seconds to connect to TOR network and about 7-12 seconds to return search results form DDG. Good app though and am looking forward to browsing in privacy, thanks.

bonjourmr2• 14 years ago

After having the app in the background for a few hours, I tried to use it to browse again but nothing happening. I had to force close the app and restart it to be able to use it. Is this normal and, if not, is this a known issue that is going to be corrected? Edit: in fact, it seems to do this as soon as my phone times out into auto-sleep :/

mtigas10• 14 years ago

This is the biggest glaring bug on the app right now.[1] Doesn’t seem to always affect the app (~30% of the time) when backgrounding to another app or if the phone is manually locked, but more regularly (>75%) happens when the phone idle sleeps.

I’m trying to nail this down, but it’ll likely take me some time to find a real fix.

[1] https://github.com/mtigas/iOS-OnionBrowser/issues/2

nextparadigms• 14 years ago

Is it compatible with Apple's policies? I thought they don't allow open source apps in the appstore. Or is that only for the GPL license?

mtigas10• 14 years ago

From what I understand, it’s only GPL that doesn’t work since GPL has some hefty restrictions on even binary redistribution (basically you have to open source ALL of the related bits, not just yours — which you can’t do since every iOS app Apple-provided pieces that aren’t available in source).

178• 14 years ago

It depends who puts it in the store. The author still has all the rights to the software no matter if he puts it under GPL, but puttng it under GPL doesn't give anyone else the right to sell it in the app store.

Edit: Also, the app in question is under MIT and the used libraries under various permissive licences (https://github.com/mtigas/iOS-OnionBrowser/blob/master/LICEN...).

jmathai• 14 years ago

We submitted the OpenPhoto app which is open sourced on Github under the Apache 2 license. Didn't get any questions.

josyw• 14 years ago

Not very sure if this is by design/expected, but capturing packets from a freshly booted iPad seems to indicate that the browser leaks DNS queries and HTTP GET requests when visiting YouTube through this browser. I am transmitting outside the tunnel

1) DNS query to YouTube cache server 2) GET request to Google's servers for /videoplayback

This seems isolated to the QuickTime player only. No other DNS queries or traffic appears to be visible. I suggest you warn users that video playback does not go through the tunnel.

mtigas10• 14 years ago

Ah crap, hadn’t tested video player too. Will note that, thanks.

kijin• 14 years ago

Just a heads up: Tormail.net (in the last screenshot) is now Tormail.org. Whoever runs the service was apparently foolish enough to transfer their non-Tor domain to a Russian registrar. It's disappointing that someone who claims to care about privacy doesn't check RSF's press freedom index before choosing a country to register their domain in.

https://opusmagnus.wordpress.com/2012/04/21/tormail-net-has-...

mike-cardwell• 14 years ago

For people with Android phones, check out Orbot - https://guardianproject.info/apps/orbot/ - It's Tor for Android. It's an incredibly well polished app. If you have root, it will let you individually and transparently torify any app. If you don't have root, individual app will need to support socks proxies in order to go through Tor.

It supports bridges, and it will even let you run a relay and/or hidden service directly from your phone.

I've had this idea for a while now of building an SMS-like app that runs entirely over hidden services for users with Orbot installed. If I send you a message this way, nobody knows that you received one, that I sent one, or what the message contained, and it wouldn't require me to set up any server infrastructure as it would be entirely peer to peer over Tor.

frou_dh• 14 years ago

Hey, thanks! I like having this on an "appliance-like" device like the iPad because the app is necessarily self-contained and I don't have to worry about it making system-level changes or unwanted interactions with other software.

Onion Browser (iOS Tor web browser, open source) now available in the App Store

Related Stories