Opened 2 years ago

Last modified 10 months ago

#27249 reopened defect

Tor 8.0a won't let me log in to Disqus

Reported by: mwolfe Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: tbb-usability-website, tbb-regression, tbb-8.0-issues
Cc: klondike Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

I use Tor to comment anonymously on Disqus, but the upgrade to 8.0a does not let me comment. I have no trouble commenting on 7.5, but I cannot comment on 8.0a. I log in as usual, and go back to the comments, but am not logged in. If I try to log in again, it won't let me, but I can't make a comment or vote another comment up.

Child Tickets

Change History (15)

comment:1 Changed 2 years ago by nickm

Component: - Select a componentApplications/Tor Browser
Owner: set to tbb-team

comment:2 Changed 2 years ago by gk

Keywords: ff60-esr tbb-usability-website added

comment:3 Changed 2 years ago by mwolfe

Before, tabs could see what other tabs were doing/had done. On Disqus, when I logged in, every other tab (previously opened) knew I had logged in, and status changed from 'log-in' to 'logged-in'. No more. Tabs don't know what's happened in other tabs. Disqus sets cookies. Disqus is a site that manages comments for many sites with content, so, when one signs in on the Disqus tab, this information is blocked from all the other content tabs. Changing to 'allow 3rd party cookies' allowed my log-in on the Disqus log-in tab to be seen by the content tabs with the item and the comments, so now I can comment, provided I allow 3rd party cookies (but sometimes that crashes Tor Browser).

comment:4 in reply to:  3 Changed 2 years ago by gk

Replying to mwolfe:

Before, tabs could see what other tabs were doing/had done. On Disqus, when I logged in, every other tab (previously opened) knew I had logged in, and status changed from 'log-in' to 'logged-in'. No more. Tabs don't know what's happened in other tabs. Disqus sets cookies. Disqus is a site that manages comments for many sites with content, so, when one signs in on the Disqus tab, this information is blocked from all the other content tabs. Changing to 'allow 3rd party cookies' allowed my log-in on the Disqus log-in tab to be seen by the content tabs with the item and the comments, so now I can comment, provided I allow 3rd party cookies (but sometimes that crashes Tor Browser).

Interesting. So, we disabled 3rd party cookies in Tor Browser 7 as well. There might be something else that changed. What do you mean by "but sometimes that crashes Tor Browser"? It should work even, though we don't recommend that as we have not checked Mozilla's first-party isolation of cookies yet. Maybe there is a bug with that feature? Could you open a new ticket with a crash report, so we could investigate it? Thanks!

comment:5 Changed 2 years ago by gk

Keywords: tbb-regrssion tbb-8.0-issues added; ff60-esr removed

comment:6 Changed 2 years ago by mwolfe

Before, gocomics.com rejected many Tor exit nodes. Until recently, I used New Tor Circuit until I found a node that worked, but with version 8, New Tor Circuit did not work, and I had to restart Tor Browser until I got an acceptable Exit Node. But when I enabled 3rd party cookies, New Tor Circuit started working again. I have no idea why New Tor Circuit works with 3rd party cookies enabled, but does not work (mainly on gocomics.com) if I reject all 3rd party cookies, but it does work if I accept 3rd party cookies.

comment:7 Changed 2 years ago by mwolfe

Disqus was working with Tor Browser 7, but today I got upgraded to Tor Browser 8 and Disqus stopped working. Something was different. Since I mainly comment on Disqus sites (there are many), and since it had something to do with isolation of tabs, I thought enabling 3rd party cookies might help, and it did. Before several months, when I logged in, all my content tabs with Discus comments changed from 'Log in' to 'Logged in'. That no longer happens. But now that the content tabs can see the 3rd party cookie, they let me log in.

comment:8 Changed 2 years ago by gk

Keywords: tbb-regression added; tbb-regrssion removed

comment:9 Changed 21 months ago by gk

Cc: klondike added

Closed #29452 as a duplicate.

comment:10 Changed 17 months ago by pariksheet

I can reproduce this in 8.0.9 on https://carpentries.org/blog/

I'm not sure how mwolfe is able to get Disqus to work at all by enabling 3rd party cookies?

  • I've tried clicking on the NoScript 10.6.1 icon to "Set all on this page to Temporarily TRUSTED" but Disqus' "Login" never changes to "Logged in". After the change, if I hover over the NoScript icon it says "Blocked 0 of 15 items".
  • With the onion icon my "Security Settings..." > Security Level is already on the lowest security "Standard" setting.

Any further troubleshooting suggestions would be appreciated!

comment:11 in reply to:  10 Changed 17 months ago by mwolfe

@pariksheet
I checked, and I can access Disqus, but it's not easy. It looks like all Tor exit nodes have been marked as Spam by the site, so one must get past a Captcha, sometimes possible, sometimes not. Captcha can be set to waste the time of those believed to be Spammers by demanding more and more solving of images but never admitting the suspected Spammer to the site.

comment:12 in reply to:  10 Changed 17 months ago by mwolfe

I just checked on carpentries dot ort blog and I get a Captcha. Solving it produces another Captcha then another and another, but I finally got logged in.

Disqus was getting a lot of Spam and put the Captcha on all sites, then dropped it for sites not known to be spam sites, so if one clicked 'New Exit Node' the Captcha would go away, but their new list of Spam sites includes all the Tor exit nodes. It is very tedious filling out Captcha after Captcha after Captcha, and sometimes, having gotten past the Captcha Tor changes its exit node, so when one tries to log in, one gets yet another series of Captchas.

But at least it's not a total block, if one is willing to fill in enough Captchas, one eventually gets logged in to Disqus and can comment.

comment:13 Changed 17 months ago by gk

Resolution: worksforme
Status: newclosed

Thanks, thus this does not seem to be a browser issue and is kind of working.

comment:14 in reply to:  9 Changed 17 months ago by mwolfe

Replying to gk:
The problem isn't Tor, it's Disqus. Or actually, the spam filter they bought to get rid of the massive amounts of spam they were getting.
Before, most Tor exit nodes were not listed as spam on the filter, only a few were, so changing exit nodes got rid of the Captcha. Then all Tor exit nodes were listed as 'possibly spam' and so got a Captcha. Now it appears all Tor exit nodes are marked as 'definitely spam' so no Captcha, just the notice that this is a spam website that is not allowed to access Disqus. I tried changing exit nodes, but every exit node I tried got the 'This appears to be a spam site and is not allowed. Try again later.'
(Not clear why trying again later would work.)

comment:15 Changed 10 months ago by renegat

Resolution: worksforme
Status: closedreopened

This issue clearly persists!
You can login to disqus - but you cannot log in to any site using disqus or comment annything since torbrowser v.8.0.

This is not an issue of disqus as you can log in directly to disqus.com page.
This is also not an issue of these ineffable google recaptchas and their endless loops.
It is clearly a problem with tor-browser since ver. 8.0 as it still works with ver. <8.0.

Even with 3rd party cookies enabled for disqus and the site you want to post on noscript set to always trust top level site there is no way to log in or make the site you want to post on using disqus realize that you have already logged in.

In torbrowser <8.0 it is/was possible to log in to disqus.com and every site using this crap was aware that you already had logged in.

As torbrowser was the only way to comment without beeing tracked the main purpose of torbrowser has gone with the lack to use disqus.com for me.
Please fix this and don't just close the issue with 'works for me'.
For me and most others I assume it does not.

Note: See TracTickets for help on using tickets.