Opened 4 years ago

Closed 4 years ago

#16729 closed defect (worksforme)

New YouTube HTML5 video player doesn't load with non-default security slider

Reported by: cypherpunks Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Keywords: tbb-usability-website
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

throws javascript exception

browser: 4.5.3
security slider: High

cookie: doesn't matter (on or off)
noscript whitelist: www.youtube.com

Child Tickets

Change History (5)

comment:1 Changed 4 years ago by cypherpunks

Priority: normalcritical

With regard to YouTube videos, the FAQ only addresses security issues with Flash:

https://www.torproject.org/docs/faq.html.en#TBBFlash

Another area of confusion is the existence of a separate FAQ:

https://trac.torproject.org/projects/tor/wiki/doc/TorFAQ

YouTube had been working in Tor browser without Flash by manually allowing the HTML5 video object in NoScript, and the FAQ does not discuss this. But several days ago the option to allow the video object inexplicably disappeared. There must be thousands of confused people wondering what to do now that YouTube is broken.

I think it is time to update the FAQ to explain how to view YouTube without Flash. If possible, I think the user should also be able to click on the video in Tor browser to play it and the security settings would automatically be changed temporarily as needed, then restored after the video is finished playing (or the tab is closed.)

In my opinion this is a HIGH priority issue because many journalists & academics need to use YouTube on a daily basis for other things than entertainment.

comment:2 Changed 4 years ago by theMaimedAsura

I noticed the problem as well.
Most interestingly, YouTube videos embedded on other websites still work perfectly - the same way as on YouTube itself until recently - if you allow that website's JavaScript.
I checked some and e.g. listenonrepeat.com among others was fine.

For the sake of completeness I'd like to add, that the HTML5 videos used to play without such clicking if HTML5 audio/video was permanently allowed.

comment:3 Changed 4 years ago by gk

Keywords: tbb-usability-website added
Priority: criticalnormal
Summary: New YouTube HTML5 video player doesn't loadNew YouTube HTML5 video player doesn't load with non-default security slider

Regarding this ticket: Playing HTML 5 videos works fine with a default Tor Browser 5.x. As soon as I raise the security level I don't seem to be able to make exceptions to the NoScript click-to-play. The browser console shows:

NS_ERROR_NOT_AVAILABLE: Component returned failure code: 0x80040111 (NS_ERROR_NOT_AVAILABLE) [nsIMIMEService.getTypeFromURI] in jar:file:///home/thomas/Arbeit/Tor/TBB/tor-browser-bundle/tor-browser_en-US/Browser/TorBrowser/Data/Browser/profile.default/extensions/torbutton@torproject.org.xpi!/components/external-app-blocker.js line 131 > eval

Overhauling the FAQ is a different ticket.

comment:4 Changed 4 years ago by gk

This actually works for me with the security slider set to high:

1) On https://www.youtube.com in the NoScript menu select: "Temporarily allow all this page"
2) Select the video you want to watch
3) Don't allow the extraction of canvas image data
4) Click on the NoScript button -> Blocked Objects -> Temporarily allow *@https://your-subdomain.googlevideo.com

comment:5 Changed 4 years ago by gk

Resolution: worksforme
Status: newclosed
Note: See TracTickets for help on using tickets.