Opened 7 years ago

Closed 7 years ago

#5758 closed defect (fixed)

Sync critical TBB prefs with Torbutton

Reported by: mikeperry Owned by: mikeperry
Priority: High Milestone:
Component: Applications/Torbutton Version:
Severity: Keywords: MikePerry201205
Cc: Actual Points: 2
Parent ID: Points: 0.5
Reviewer: Sponsor:

Description

I probably shouldn't just leave non-TBB Torbutton users to fall on their swords. Before the next release, I probably should set dom.indexedDB.enabled and network.websockets.enabled to false, to prevent identifier crossover and DNS leakage.

Though, it's not clear that Torbutton users can always properly disable plugins either, so perhaps this is moot... Still, it's easy enough, so why not?

Child Tickets

Change History (5)

comment:1 Changed 7 years ago by cypherpunks

Hey Mike!

Why have you set network.websockets.enabled back to true after having the DNS leakage disaster recently?
Is your new patch #5741 preventing DNS leakage even though websockets remaining enabled?

I would appreciate your answer.

comment:2 Changed 7 years ago by mikeperry

Correct. The Tor Browser patch in #5741 solves the DNS leak issue directly, and in a way that should prevent it from happening from any browser component in the future, not just WebSockets. Hence WebSockets should be fine to leave enabled. This ticket is only about disabling WebSockets for Torbutton users who are not using Tor Browser.

Of course it would be great if we had some simple html pages that exercised all of the WebSocket functionality to guard against other random issues as the codebase changes. The plan is to collect tests like that under #5292. If you feel like writing one, that would be really helpful.

comment:3 Changed 7 years ago by mikeperry

Note to self: To make #5709 easier, I should also ensure no prefs exist in torbutton_update_status() that we haven't duplicated in Tor Browser's prefs.js.

comment:4 Changed 7 years ago by mikeperry

Actual Points: 2

The Torbutton side is in origin/master, and should be out in 1.4.6.

The TBB side is ready for merge into all branches in mikeperry/bug5758.

comment:5 Changed 7 years ago by mikeperry

Resolution: fixed
Status: newclosed

This is merged in TBB, too.

Note: See TracTickets for help on using tickets.