Tor Browser 4.0 - Everything you need to safely browse the Internet

 The Tor software protects you by bouncing your communications around a distributed network of relays run by volunteers all around the world: it prevents somebody watching your Internet connection from learning what sites you visit, it prevents the sites you visit from learning your physical location, and it lets you access sites which are blocked.

The Tor Browser lets you use Tor on Windows, Mac OS X, or Linux without needing to install any software. It can run off a USB flash drive, comes with a pre-configured web browser to protect your anonymity, and is self-contained.

This release features important security updates to Firefox. Additionally, due to the POODLE attack, we have also disabled SSLv3 in this release.

The primary user-facing change since the 3.6 series is the transition to Firefox 31-ESR.

More importantly for censored users who were using 3.6, the 4.0 series also features the addition of three versions of the meek pluggable transport. In fact, we believe that both meek-amazon and meek-azure will work in China today, without the need to obtain bridge addresses. Note though that we still need to improve meek's performance to match other transports, though. so adjust your expectations accordingly. See tickets #12428, #12778, and #12857 for details.

This release also features an in-browser updater, and a completely reorganized bundle directory structure to make this updater possible. This means that simply extracting a 4.0 Tor Browser over a 3.6.6 Tor Browser will not work. Please also be aware that the security of the updater depends on the specific CA that issued the www.torproject.org HTTPS certificate (Digicert), and so it still must be activated manually through the Help ("?") "about browser" menu option. Very soon, we will support both strong HTTPS site-specific certificate pinning (ticket #11955) and update package signatures (ticket #13379). Until then, we do not recommend using this updater if you need stronger security and normally verify GPG signatures.

There are also a couple behavioral changes relating to NoScript since 3.6. In particular, by default it now enforces script enable/disable for all sub-elements of a page, so you only need to enable scripts once for a page to work, rather than enabling many sub-scripts. This will hopefully make it possible for more people to use the "High Security" setting in our upcoming Security Slider, which will have Javascript disabled globally via NoScript by default. While we do not recommend per-element whitelisting due to fingerprinting, users who insist on keeping this functionality may wish to check out RequestPolicy.

Note to MacOS users: We intend to deprecate 32bit OSX bundles very soon. If you are still using 32bit OSX 10.6, you soon will need to either update your OS to a later version, or begin using the Tails live operating system.

Here is the changelog since 4.0-alpha-3:

• All Platforms
  • Update Firefox to 31.2.0esr
  • Update Torbutton to 1.7.0.1
    • Bug 13378: Prevent addon reordering in toolbars on first-run.
    • Bug 10751: Adapt Torbutton to ESR31's Australis UI.
    • Bug 13138: ESR31-about:tor shows "Tor is not working"
    • Bug 12947: Adapt session storage blocker to ESR 31.
    • Bug 10716: Take care of drag/drop events in ESR 31.
    • Bug 13366: Fix cert exemption dialog when disk storage is enabled.
  • Update Tor Launcher to 0.2.7.0.1
    • Translation updates only
  • Udate fteproxy to 0.2.19
  • Update NoScript to 2.6.9.1
  • Bug 13027: Spoof window.navigator useragent values in JS WebWorker threads
  • Bug 13016: Hide CSS -moz-osx-font-smoothing values.
  • Bug 13356: Meek and other symlinks missing after complete update.
  • Bug 13025: Spoof screen orientation to landscape-primary.
  • Bug 13346: Disable Firefox "slow to start" warnings and recordkeeping.
  • Bug 13318: Minimize number of buttons on the browser toolbar.
  • Bug 10715: Enable WebGL on Windows (still click-to-play via NoScript)
  • Bug 13023: Disable the gamepad API.
  • Bug 13021: Prompt before allowing Canvas isPointIn*() calls.
  • Bug 12460: Several cross-compilation and gitian fixes (see child tickets)
  • Bug 13186: Disable DOM Performance timers
  • Bug 13028: Defense-in-depth checks for OCSP/Cert validation proxy usage
  • Bug 13416: Defend against new SSLv3 attack (poodle).

Here is the list of all changes in the 4.0 series since 3.6.6:

• All Platforms
  • Update Firefox to 31.2.0esr
  • Udate fteproxy to 0.2.19
  • Update Tor to 0.2.5.8-rc (from 0.2.4.24)
  • Update NoScript to 2.6.9.1
  • Update Torbutton to 1.7.0.1 (from 1.6.12.3)
    • Bug 13378: Prevent addon reordering in toolbars on first-run.
    • Bug 10751: Adapt Torbutton to ESR31's Australis UI.
    • Bug 13138: ESR31-about:tor shows "Tor is not working"
    • Bug 12947: Adapt session storage blocker to ESR 31.
    • Bug 10716: Take care of drag/drop events in ESR 31.
    • Bug 13366: Fix cert exemption dialog when disk storage is enabled.
  • Update Tor Launcher to 0.2.7.0.1 (from 0.2.5.6)
    • Bug 11405: Remove firewall prompt from wizard.
    • Bug 12895: Mention @riseup.net as a valid bridge request email address
    • Bug 12444: Provide feedback when “Copy Tor Log” is clicked.
    • Bug 11199: Improve error messages if Tor exits unexpectedly
    • Bug 12451: Add option to hide TBB's logo
    • Bug 11193: Change "Tor Browser Bundle" to "Tor Browser"
    • Bug 11471: Ensure text fits the initial configuration dialog
    • Bug 9516: Send Tor Launcher log messages to Browser Console
  • Bug 13027: Spoof window.navigator useragent values in JS WebWorker threads
  • Bug 13016: Hide CSS -moz-osx-font-smoothing values.
  • Bug 13356: Meek and other symlinks missing after complete update.
  • Bug 13025: Spoof screen orientation to landscape-primary.
  • Bug 13346: Disable Firefox "slow to start" warnings and recordkeeping.
  • Bug 13318: Minimize number of buttons on the browser toolbar.
  • Bug 10715: Enable WebGL on Windows (still click-to-play via NoScript)
  • Bug 13023: Disable the gamepad API.
  • Bug 13021: Prompt before allowing Canvas isPointIn*() calls.
  • Bug 12460: Several cross-compilation and gitian fixes (see child tickets)
  • Bug 13186: Disable DOM Performance timers
  • Bug 13028: Defense-in-depth checks for OCSP/Cert validation proxy usage
  • Bug 4234: Automatic Update support (off by default)
  • Bug 11641: Reorganize bundle directory structure to mimic Firefox
  • Bug 10819: Create a preference to enable/disable third party isolation
  • Bug 13416: Defend against new SSLv3 attack (poodle).
• Windows:
  • Bug 10065: Enable DEP, ASLR, and SSP hardening options
• Linux:
  • Bug 13031: Add full RELRO hardening protection.
  • Bug 10178: Make it easier to set an alternate Tor control port and password
  • Bug 11102: Set Window Class to "Tor Browser" to aid in Desktop navigation
  • Bug 12249: Don't create PT debug files anymore

The list of frequently encountered known issues is also available in our bug tracker.

Download Tor Browser 4.0

Read More

Onionshare - Securely and anonymously share a file of any size

OnionShare lets you securely and anonymously share a file of any size with someone. It works by starting a web server, making it accessible as a Tor hidden service, and generating an unguessable URL access and download the file. It doesn't require setting up a server on the internet somewhere or using a third party filesharing service. You host the file on your own computer and use a Tor hidden service to make it temporarily accessible over the internet. The other user just needs to use Tor Browser to download the file from you.

Download Onionshare

Read More

Tor Browser v3.6 - Anonymity Online and defend yourself against network surveillance and traffic analysis

The Tor Browser Bundle lets you use Tor on Windows, Mac OS X, or Linux without needing to install any software. It can run off a USB flash drive, comes with a pre-configured web browser to protect your anonymity, and is self-contained.

Changelog v3.6

Here is the complete changelog since TBB 3.5.4:

• All Platforms
  • Update Firefox to 24.5.0esr
  • Include Pluggable Transports by default:
    • Obfsproxy3 0.2.4, Flashproxy 1.6, and FTE 0.2.13 are now included
  • Bug 11586: Include license files for component software in Docs directory.
  • Bug 9010: Add Turkish language support.
  • Bug 9387 testing: Disable JS JIT, type inference, asmjs, and ion.
  • Update NoScript to 2.6.8.20
  • Update Tor Launcher to 0.2.5.4
    • Bug 9665: Localize Tor’s unreachable bridges bootstrap error
    • Bug 10418: Provide UI configuration for Pluggable Transports
    • Bug 10604: Allow Tor status & error messages to be translated
    • Bug 10894: Make bridge UI clear that helpdesk is a last resort for bridges
    • Bug 10610: Clarify wizard UI text describing obstacles/blocking
    • Bug 11074: Support Tails use case (XULRunner and optional customizations)
    • Bug 11482: Hide bridge settings prompt if no default bridges.
    • Bug 11484: Show help button even if no default bridges.
  • Update Torbutton to 1.6.9.0:
    • Bug 11242: Fix improper “update needed” message after in-place upgrade.
    • Bug 10398: Ease translation of about:tor page elements
    • Bug 9901: Fix browser freeze due to content type sniffing
    • Bug 10611: Add Swedish (sv) to extra locales to update
    • Bug 7439: Improve download warning dialog text.
    • Bug 11384: Completely remove hidden toggle menu item.
  • Backport Pending Tor Patches:
    • Bug 9665: Report a bootstrap error if all bridges are unreachable
    • Bug 11200: Prevent spurious error message prior to enabling network.
    • Bug 5018: Don’t launch Pluggable Transport helpers if not in use
    • Bug 9229: Eliminate 60 second stall during bootstrap with some PTs
    • Bug 11069: Detect and report Pluggable Transport bootstrap failures
    • Bug 11156: Prevent spurious warning about missing pluggable transports
• Mac:
  • Bug 4261: Use DMG instead of ZIP for Mac packages
  • Bug 9308: Prevent install path from leaking in some JS exceptions on Mac and Windows
• Linux:
  • Bug 11190: Switch linux PT build process to python2
  • Bug 10383: Enable NIST P224 and P256 accel support for 64bit builds.
• Windows:
  • Bug 9308: Prevent install path from leaking in some JS exceptions on Mac and Windows

Here is the changelog since the 3.6-beta-2:

• All Platforms
  • Update Firefox to 24.5.0esr
  • Update Tor Launcher to 0.2.5.4
    • Bug 11482: Hide bridge settings prompt if no default bridges.
    • Bug 11484: Show help button even if no default bridges.
  • Update Torbutton to 1.6.9.0
    • Bug 7439: Improve download warning dialog text.
    • Bug 11384: Completely remove hidden toggle menu item.
  • Update NoScript to 2.6.8.20
  • Update fte transport to 0.2.13
  • Backport Pending Tor Patches:
    • Bug 11156: Additional obfsproxy startup error message fixes
  • Bug 11586: Include license files for component software in Docs directory.
• Windows and Mac:
• Bug 9308: Prevent install path from leaking in some JS exceptions on Mac and Windows builds

Download Tor Browser v3.6

Read More

[I2P] Anonymizing Network

I2P is an anonymizing network, offering a simple layer that identity-sensitive applications can use to securely communicate. All data is wrapped with several layers of encryption, and the network is both distributed and dynamic, with no trusted parties.

Many applications are available that interface with I2P, including mail, peer-peer, IRC chat, and others.

The I2P project was formed in 2003 to support the efforts of those trying to build a more free society by offering them an uncensorable, anonymous, and secure communication system. I2P is a development effort producing a low latency, fully distributed, autonomous, scalable, anonymous, resilient, and secure network. The goal is to operate successfully in hostile environments - even when an organization with substantial financial or political resources attacks it. All aspects of the network are open source and available without cost, as this should both assure the people using it that the software does what it claims, as well as enable others to contribute and improve upon it to defeat aggressive attempts to stifle free speech.

Anonymity is not a boolean - we are not trying to make something "perfectly anonymous", but instead are working at making attacks more and more expensive to mount. I2P is a low latency mix network, and there are limits to the anonymity offered by such a system, but the applications on top of I2P, such as Syndie, I2P mail, and I2PSnark extend it to offer both additional functionality and protection.

I2P is still a work in progress. It should not be relied upon for "guaranteed" anonymity at this time, due to the relatively small size of the network and the lack of extensive academic review. It is not immune to attacks from those with unlimited resources, and may never be, due to the inherent limitations of low-latency mix networks.

I2P works by routing traffic through other peers, as shown in the following picture. All traffic is encrypted end-to-end. For more information about how I2P works, see the Introduction. 

Download I2P

Read More