Opened 9 years ago

Closed 8 years ago

#2128 closed defect (duplicate)

TBB users can't enable flash even if they choose to

Reported by: arma Owned by: erinn
Priority: Medium Milestone:
Component: Applications/Tor bundles/installation Version:
Severity: Keywords:
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

Some Tor users are in situations where they install Tor in order to reach youtube -- e.g. users in Turkey.

But Torbutton blocks plugins by default, so youtube is broken.

We point people at the Torbutton faq entry:
https://www.torproject.org/torbutton/torbutton-faq.html.en#noflash
which walks them through how to tell Torbutton to allow flash.

But in the Tor Browser Bundles, there is no flash, so the faq entry doesn't help them.

One option is to ship flash in the TBBs, in case they want it. But apart from the "bloat most users don't need" factor, I believe the flash license doesn't allow it.

Another option is to configure the Firefox in TBB to allow it to find other plugins in the system. Then we rely on Torbutton to prevent you from running them unless you choose to. That's bad news for security, since it puts more pressure on Torbutton to be perfect, and since it would allow the realplayer, adobe, etc etc plugins that the user has in their other Firefox install. It also isn't a perfect solution, since some users might not *have* another Firefox install.

Did I miss any options? Is there a way to let them download flash for their TBB Firefox? We hear reports of users who repeatedly try to install flash (because their firefox keeps saying it's not installed). Does installing flash plus following our torbutton faq work? If not, maybe making that workflow work is the best option.

Child Tickets

Change History (5)

comment:1 Changed 9 years ago by arma

Mike also suggested that once youtube migrates to html 5, this issue might become less relevant. I wonder what their timeframe is there, and what Torbutton's and Firefox's support is like.

comment:2 Changed 9 years ago by phobos

The only realistic option I see is gnash. However, gnash needs more dev work to be usable in the general sense. The only safe option is to not use flash with tor.

comment:3 in reply to:  2 ; Changed 9 years ago by arma

Replying to phobos:

The only safe option is to not use flash with tor.

True, if by safe we mean as anonymous as Tor can be.

But we have users who want to use Tor and don't mind the anonymity risks from the destination website (or the exit relay). Are we disallowing flash because of its security history (a la Apple), or because of our inability to fully proxy it? Is our answer to users in Turkey who want a circumvention tool to reach Youtube really "stop wanting that"?

If so, we should update our faq entry to tell them to stop wanting that, rather than to tell them how to enable it (which doesn't work for them).

comment:4 in reply to:  3 Changed 9 years ago by phobos

Replying to arma:

But we have users who want to use Tor and don't mind the anonymity risks from the destination website (or the exit relay). Are we disallowing flash because of its security history (a la Apple), or because of our inability to fully proxy it? Is our answer to users in Turkey who want a circumvention tool to reach Youtube really "stop wanting that"?

With tbb, yes, they should stop wanting that. If they want to install the vidalia bundle, or point their other browsers at the tbb tor, more power to them.

comment:5 Changed 8 years ago by mikeperry

Resolution: duplicate
Status: newclosed

We're going to use #3547 for the solution for this.

Note: See TracTickets for help on using tickets.