Opened 6 years ago

Closed 6 years ago

#7494 closed enhancement (fixed)

Create local homepage for TBB

Reported by: mikeperry Owned by: brade
Priority: High Milestone:
Component: Firefox Patch Issues Version:
Severity: Keywords: tbb-usability, tbb-bounty, MikePerry201305
Cc: mcs, brade, phobos, isis@… Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

check.torproject.org is unmaintained and overloaded (see #6156). We've rate-limited the version check, but we still need a homepage for our browser to use instead.

We've got the work from #3749 (see http://jmtodaro.com/tor/check/success.html), but it's way too busy and overloaded with text for a homepage. We should remove the infoboxes, most of the text, and the footer. In fact, I think the only thing we should keep is the portion of that page up to and including the search box (which should point to StartPage, not DDG).

We also need to use DTD strings from Torbutton rather that flat-text (for translation).

Child Tickets

Attachments (2)

0001-TBB-Create-local-homepage-for-TBB.patch (758 bytes) - added by brade 6 years ago.
Tor Browser Bundle patch (use about:tor as default home page)
0001-Torbutton-Create-local-homepage-for-TBB.patch (43.9 KB) - added by brade 6 years ago.
Torbutton patch (add about:tor page)

Download all attachments as: .zip

Change History (17)

comment:1 Changed 6 years ago by phobos

We should use the page as is, with infoboxes and all. The problem right now is that people get to check and have no idea what it means nor what to do next. In testing, a huge number of people see the check page and then flip to their non-tor browser and assume everything is anonymized. In testing, the new success/fail pages worked much better. We should change "Your Browser" to say "This Browser".

He purposely created the page in text and css to make it portable and lightweight.

I'm not convinced we should change to startpage, as DDG supports Tor moreso than SP. SP is already the default search engine in TBB.

I strongly suggest we use the new start/fail pages as is and work off the empirical data of feedback and testing.

comment:2 in reply to:  1 Changed 6 years ago by mikeperry

Replying to phobos:

We should use the page as is, with infoboxes and all. The problem right now is that people get to check and have no idea what it means nor what to do next. In testing, a huge number of people see the check page and then flip to their non-tor browser and assume everything is anonymized. In testing, the new success/fail pages worked much better. We should change "Your Browser" to say "This Browser".

For clarity: This ticket is for replacing the browser homepage with something local as opposed to hitting check.torproject.org (the server for which is overloaded by TBB homepage activity as you pointed out in #6156). This ticket is not for changing the text on check.torproject.org itself.

I agree that we need to make it clear that "This Browser" is the browser to use and we need to change the "Your Browser" string to reflect that. But there's also a couple of sections of text that don't make sense with a local browser-sourced homepage.

In particular, the left infobox either needs new text or needs to be removed, as we have no exit IP for a local page. The translation footer is also useless, as the homepage will be automatically localized to the TBB locale that user downloaded.

The right two infoboxes are OK, I guess, if we want to busy up the homepage with text and see who actually reads any of it it in user testing.

He purposely created the page in text and css to make it portable and lightweight.

That's fine. For a local homepage though, the text needs to use DTD anchors from Torbutton's locale strings, though, or it won't get translated or localized.

I'm not convinced we should change to startpage, as DDG supports Tor moreso than SP. SP is already the default search engine in TBB.

The search engine box should definitely be configurable, but I think it's debatable that DDG has done more for us at this point. Both companies seem to have taken actions entirely out of their own self-interest. DDG's exit enclave/hidden service might improve their service slightly for Tor (this too, is debatable, since a hidden service is overkill and exit enclaves are mostly non-functional), but their 'duckduckgo' Tor relay is configured to carry almost no additional Tor traffic (it appears capped at 128k/sec right now). StartPage went to bat for us on the DoS/Captcha issue and has raised our profile with Google as a result, but that's also because we're a high profile project and a significant chunk of their userbase.

I strongly suggest we use the new start/fail pages as is and work off the empirical data of feedback and testing.

Ok. It seems like lots of text and layout are more likely to cause them to ignore all of the text on the page including the title and searchbox (which is arguably what is *most* likely to cause them to use the current browser window), but I guess we can user-test with varying numbers of additional text boxes and footer paragraphs to find this out.

I think it's worth noting that most search engines and browsers have decided that keeping the landing page clean is the best way to get people to actually use the search box, though.

comment:3 Changed 6 years ago by phobos

I guess I don't fully understand what you're trying to do then. I thought we were move the check.tpo page locally, but with a remote "tor or not" check which fed into the local page for "success/fail" status. I can see how the leftmost info box is irrelevant if we aren't passing back the exit country to the user on the local page.

As for the search box vs. other infoboxes, are we trying to emulate other browsers out there? or to provide some quick links into tor docs to explain tor and how to use it for users? Maybe we include the short user manual locally linked too for the docs, and "learn more" points back to the website docs.

I don't really have a strong bent for DDG or SP, as frankly, both of them censor the results by default with "adult content filters".

comment:4 Changed 6 years ago by isis

Cc: isis@… added

comment:5 Changed 6 years ago by mcs

Kathy Brade and I are starting to look at this.

Does the local home page need to display a "Your browser is out of date" message after the up-to-date check (done by Torbutton) fails?

Is there a way for the browser to retrieve Tor status (including country, IP address, and exit node)?

How do you think the search engine box configuration should work? Is it enough to provide a choice of DDG and SP?

comment:6 Changed 6 years ago by mcs

We are starting to work on this again. For now, we will omit the left box (IP address, country, exit node, etc.)

We do want to display a different background gradient and a warning message if tor is NOT being used. But how can the browser determine whether traffic is going through tor?

comment:7 Changed 6 years ago by mikeperry

For the browser tor test, sadly I sort of dropped the ball on #6546, which would have given us a local, quick test in 0.2.4.x... Right now, all we have is the check.torproject.org XMLHttpRequest test url, https://check.torproject.org/?TorButton=true. Seee https://gitweb.torproject.org/torbutton.git/blob/master:/src/chrome/content/torbutton.js#l980.

I am thinking that for TBB it is less important to verify you're actually using Tor, especially every time.. It is perhaps something we can do once after first bootstrap or something.

Or, perhaps all we need is a simpler test of the SOCKS port's existence.. But then we need to somehow check that the port 9150 is really a Tor port and not something else...

comment:8 Changed 6 years ago by mikeperry

Marked #8472 a dup of this.

comment:9 Changed 6 years ago by brade

We iterated on this a little at the recent Tor dev meeting. Mark and I decided to primarily patch Torbutton to provide an about:tor page and to patch TBB to make that the default home page. Screenshots that show the four page variations are available here:

http://trial.pearlcrescent.com/tor/aboutTor/

If Torbutton detects that a TBB update is available, all open about:tor pages are dynamically updated to show the "Your browser is out of date" message.

Known issues:
1) Tor status (which is based on socks configuration) is not updated dynamically.
2) When a TBB update is needed and the browser window is very narrow or very wide, the about:tor layout is not ideal.

I will post the patches in a moment.

Changed 6 years ago by brade

Tor Browser Bundle patch (use about:tor as default home page)

Changed 6 years ago by brade

Torbutton patch (add about:tor page)

comment:10 Changed 6 years ago by brade

We addressed all of the known issues and updated the Torbutton patch.

Mike, please review.
The changes are also in the bug7494 branches within user/brade/torbutton.git and user/brade/torbrowser.git

To see the four variations of the about:tor page, use about:config to toggle extensions.torbutton.updateNeeded and to modify network.proxy.socks_port.

comment:11 Changed 6 years ago by mikeperry

Keywords: MikePerry201304 added
Status: newneeds_review

comment:12 Changed 6 years ago by mikeperry

Keywords: MikePerry201305 added; MikePerry201304 removed

comment:13 Changed 6 years ago by unknown

I use transparent torificaton, manually restarting TorBrowser without Vidalia and change circuits without Vidalia.

I disable any autocheck and check for updates regularly but manually.

The simple solution for disabling annoying autocheck is in TBB about:config enable about:blank for three strings: browser.startup.homepage, extensions.torbutton.test_url, extensions.torbutton.versioncheck_url.

Is there the way for leakage some info about specific users profile?

comment:14 Changed 6 years ago by mikeperry

Owner: changed from mikeperry to brade
Status: needs_reviewassigned

unknown: this is the wrong place to report issues with transparent tor.

This homepage issue is fixed, and a release was in TBB 3.0a1.

comment:15 Changed 6 years ago by mikeperry

Resolution: fixed
Status: assignedclosed
Note: See TracTickets for help on using tickets.