Opened 7 years ago

Closed 5 years ago

#7661 closed defect (fixed)

Tor Browser update security

Reported by: ioerror Owned by: tbb-team
Priority: High Milestone:
Component: Applications/Tor Browser Version:
Severity: Keywords: needs-triage
Cc: mikeperry, erinn Actual Points:
Parent ID: Points:
Reviewer: Sponsor:


I'm watching a user update their Tor Browser and they not only went and downloaded it, they opened the .gz, unpacked it and ran it.

I suspect it would be straightforward to have a small handler for opening Tor Browser downloads that verifies the download with a very small build of gpgv. Combined with the new Firefox cert pinning, I'd feel rather good about downloading updates as we clearly (I hope someone clarifies otherwise!) won't have Thandy anytime soon.

I imagine that it would be a nice way to ensure that there is only one leap of faith, ever. The first is unavoidable and afterwards, everything else is unnecessary.

If I wrote a patch to build/include gpgv (with our gpg keys preloaded) - would that be something we could ship? Could we easily hook it for downloads?

Child Tickets

Change History (7)

comment:1 Changed 7 years ago by mikeperry

Two things to be aware of if you decide to attempt this:

  1. We're going to end up using the Firefox updater. Pearl Crescent is contracted to hack it up for us soon. See #4234.
  2. We're also going to have in-browser update notification and download links. See #7495.

comment:2 Changed 6 years ago by nickm

Cc: erinn added

Adding 'erinn' to cc list of every ticket with 'helix' in its cc list -- erinn is helix's trac username.

comment:3 Changed 6 years ago by nickm

Cc: helix removed

Removing helix from cc lists -- helix is not erinn's trac username.

comment:4 Changed 6 years ago by erinn

Keywords: needs-triage added

comment:5 Changed 6 years ago by erinn

Component: Tor bundles/installationTor Browser
Owner: changed from erinn to tbb-team

comment:6 Changed 5 years ago by proper

Can probably be closed?

comment:7 Changed 5 years ago by gk

Resolution: fixed
Status: newclosed

Yes, this got implemented with our signed MAR files I think.

Note: See TracTickets for help on using tickets.