Easier and more secure browsing in Tor Browser 4.5

The Tor project released a new version of the Tor Browser on April 27, updating many of the browser's built-in tools and improving the network-security layer. Tor Browser provides a more convenient way for users to use the anonymity and privacy of a Tor connection for their web browsing: the browser bundle is a portable application that can be run from anywhere and does not require a working Tor software installation to be installed on the host machine.

The Tor Browser, as always, is derived from Mozilla Firefox. The 4.5 release is based on Firefox 31.6 with several later patches backported—most notably, certificate-pinning improvements from Firefox 32 and 33. It also includes the Firefox extensions NoScript (version 2.6.9.22) and HTTPS Everywhere (version 5.0.3), and it bundles in the Tor client (version 0.2.6.7) and several of Tor's pluggable transport modules. These transports are plugins that obfuscate the traffic between a Tor client and the entrance node to a Tor circuit, thus making it more difficult for censors to block Tor usage. Downloads are available in a variety of language and locale options for most major operating systems.

The binaries available for download are verifiable builds; signed hashes of each binary are provided, which can be used to verify that independent builds produce the same hash. Any builder can follow the build instructions and check that their build's hash matches the official packages, and users can compare signed hashes from a number of developers' keys. This feature was introduced in the Tor Browser 3.0 series; 4.5 takes the verifiable-build concept a bit further by introducing verifiable incremental-update files as well. There are Mozilla Archive (MAR) files available for updating most 4.0-series Tor Browser binaries to 4.5, and those update files now include hash signatures as well.

Quite a bit of work has clearly gone into making Tor Browser 4.5 better on the usability front. This starts with the wrapper script used to start the browser itself. Because Tor Browser is a self-contained bundle, previous releases tended to fare rather poorly on system integration—the package was not available in the "Applications" menu, for instance, and users were left to create their own launcher scripts if they wanted the browser to appear in their PATH. As of 4.5, when Tor Browser is run for the first time, it is through a "setup" wrapper that correctly configures the user's Tor connection and, on Linux, customizes a .desktop application launcher file. This launcher can be called from any Freedesktop.org-compliant menu system or panel, run from the file manager, or even executed from the command line.

Another new usability feature is a revamped "onion menu" in the browser's main toolbar. This menu provides access to Tor- and security-related settings and features. Clicking on the menu's icon now displays status information about the Tor circuit in use for the current connection—akin to the SSL/TLS site-certificate information that Firefox displays when clicking on the location bar's lock icon. The menu also allows the user to initiate a new Tor circuit for the current page.

The settings accessible from the onion menu include a new "security slider" that allows the user to adjust the browser's overall security settings with one action. The "Low" setting (which is the default) provides basic anonymity and privacy via Tor, but does not disable any general-purpose browser features. The "Medium Low" setting turns all HTML5 video and audio content into click-to-play elements, blocks remote Java applets, disables MathML support, and disables some JavaScript performance-optimization techniques (specifically, the IonMonkey just-in-time (JIT) compiler, type inference, and asm.js) with NoScript.

In addition to the other settings, "Medium High" also disables the Baseline JavaScript JIT, disables SVG OpenType rendering and Graphite font-rendering, and disables all JavaScript on non-HTTPS sites. The "High" setting additionally disables JavaScript on HTTPS sites (although it can be re-enabled on a site-by-site basis), disables SVG rendering, and disables CSS web fonts.

Some of the features disabled with the security slider have clear security risks (such as executing remote Java applets), while others are disabled because the techniques involved have a high incidence of historical security vulnerabilities. The announcement notes that the project gleans such historical vulnerability information from research by iSEC Partners.

Under the hood, Tor Browser 4.5 offers some key improvements to the way site traffic is managed. All requests initiated in a tab will be restricted to the same Tor circuit. That should prevent problems like having a site's language suddenly change because one HTTP request is sent over a Tor circuit different than the one used a few minutes earlier.

The browser also isolates sites from one another by ensuring that different pages' requests travel over different circuits, even when those requests are to third-party sites. This ensures that embedded elements like the pervasive "like" buttons placed by social-media services cannot track the user between pages loaded in different tabs. Furthermore, the URL.createObjectURL() method from the W3C File API (a method that can be used by JavaScript code to create a new URL reference) is restricted to the same circuit as the page that called it and the SharedWorker API has been disabled entirely. Both methods could be abused to enable cross-site communication and, thus, to allow sites to track the user across multiple web sites.

Other privacy enhancements include the disabling of the W3C Sensor API and the Mozilla video statistics API (both of which enable a site to record information about the browser's behavior) and a new default search engine. The new search engine, Disconnect, is a privacy-conscious search redirector that is maintained by a privately funded US security start-up; it sends the user's search queries to popular search engines like Google, both anonymizing the request and sanitizing the results returned by the downstream search provider.

Last but not least, the new browser release includes rewritten transport modules and introduces a new transport called obfs4. The obfs4 transport is designed to better resist deep-packet inspection (DPI); the 4.5 release announcement notes that obfs4 currently enables Tor access from within China. Recent Tor releases include obfs4 (so it is running on up-to-date bridge nodes), but clients need to have the package, too, in order to use it as a transport.

If censors learn the IP address of a Tor bridge node, they can block access to that node, but it is believed that an obfs4-powered node cannot be discovered through any known automated traffic-scanning techniques. For such a bridge node to be revealed, it would have to be discovered and reported through some other means.

On the whole, the changes in Tor Browser 4.5 make for an easier-to-configure browsing experience, which is critical for convincing users to give it a chance. The lower-level improvements like better circuit isolation and improved transports may not be visible to the casual user, but are certainly critical. Given that the state of the art changes so rapidly on the web, it is encouraging to see Tor Browser keeping pace.