Update TBB design doc w/ an intro to the implementation section and some internal hyperlinks.
Mike Perry commited on 2011-10-19 06:40:12
Zeige 1 geänderte Dateien mit 37 Einfügungen und 15 Löschungen.
- projects/torbrowser/design/index.html.en 58541143b..a0dd1a452
| ... | ... |
@@ -1,6 +1,6 @@ |
| 1 | 1 |
<?xml version="1.0" encoding="UTF-8"?> |
| 2 | 2 |
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> |
| 3 |
-<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>The Design and Implementation of the Tor Browser [DRAFT]</title><meta name="generator" content="DocBook XSL Stylesheets V1.75.2" /></head><body><div class="article" title="The Design and Implementation of the Tor Browser [DRAFT]"><div class="titlepage"><div><div><h2 class="title"><a id="design"></a>The Design and Implementation of the Tor Browser [DRAFT]</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Mike</span> <span class="surname">Perry</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:mikeperry#torproject org">mikeperry#torproject org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Erinn</span> <span class="surname">Clark</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:erinn#torproject org">erinn#torproject org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Steven</span> <span class="surname">Murdoch</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:sjmurdoch#torproject org">sjmurdoch#torproject org</a>></code></p></div></div></div></div><div><p class="pubdate">Oct 11 2011</p></div></div><hr /></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="#id2869610">1. Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="#adversary">1.1. Adversary Model</a></span></dt></dl></dd><dt><span class="sect1"><a href="#DesignRequirements">2. Design Requirements and Philosophy</a></span></dt><dd><dl><dt><span class="sect2"><a href="#security">2.1. Security Requirements</a></span></dt><dt><span class="sect2"><a href="#privacy">2.2. Privacy Requirements</a></span></dt><dt><span class="sect2"><a href="#philosophy">2.3. Philosophy</a></span></dt></dl></dd><dt><span class="sect1"><a href="#Implementation">3. Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="#proxy-obedience">3.1. Proxy Obedience</a></span></dt><dt><span class="sect2"><a href="#state-separation">3.2. State Separation</a></span></dt><dt><span class="sect2"><a href="#disk-avoidance">3.3. Disk Avoidance</a></span></dt><dt><span class="sect2"><a href="#app-data-isolation">3.4. Application Data Isolation</a></span></dt><dt><span class="sect2"><a href="#identifier-linkability">3.5. Cross-Origin Identifier Unlinkability</a></span></dt><dt><span class="sect2"><a href="#fingerprinting-linkability">3.6. Cross-Origin Fingerprinting Unlinkability</a></span></dt><dt><span class="sect2"><a href="#new-identity">3.7. Long-Term Unlinkability via "New Identity" button</a></span></dt><dt><span class="sect2"><a href="#click-to-play">3.8. Click-to-play for plugins and invasive content</a></span></dt><dt><span class="sect2"><a href="#firefox-patches">3.9. Description of Firefox Patches</a></span></dt></dl></dd><dt><span class="sect1"><a href="#Packaging">4. Packaging</a></span></dt><dd><dl><dt><span class="sect2"><a href="#build-security">4.1. Build Process Security</a></span></dt><dt><span class="sect2"><a href="#addons">4.2. External Addons</a></span></dt><dt><span class="sect2"><a href="#prefs">4.3. Pref Changes</a></span></dt><dt><span class="sect2"><a href="#update-mechanism">4.4. Update Security</a></span></dt></dl></dd><dt><span class="sect1"><a href="#Testing">5. Testing</a></span></dt><dd><dl><dt><span class="sect2"><a href="#SingleStateTesting">5.1. Single state testing</a></span></dt></dl></dd></dl></div><div class="sect1" title="1. Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2869610"></a>1. Introduction</h2></div></div></div><p> |
|
| 3 |
+<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>The Design and Implementation of the Tor Browser [DRAFT]</title><meta name="generator" content="DocBook XSL Stylesheets V1.75.2" /></head><body><div class="article" title="The Design and Implementation of the Tor Browser [DRAFT]"><div class="titlepage"><div><div><h2 class="title"><a id="design"></a>The Design and Implementation of the Tor Browser [DRAFT]</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Mike</span> <span class="surname">Perry</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:mikeperry#torproject org">mikeperry#torproject org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Erinn</span> <span class="surname">Clark</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:erinn#torproject org">erinn#torproject org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Steven</span> <span class="surname">Murdoch</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:sjmurdoch#torproject org">sjmurdoch#torproject org</a>></code></p></div></div></div></div><div><p class="pubdate">Oct 19 2011</p></div></div><hr /></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="#id3042393">1. Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="#adversary">1.1. Adversary Model</a></span></dt></dl></dd><dt><span class="sect1"><a href="#DesignRequirements">2. Design Requirements and Philosophy</a></span></dt><dd><dl><dt><span class="sect2"><a href="#security">2.1. Security Requirements</a></span></dt><dt><span class="sect2"><a href="#privacy">2.2. Privacy Requirements</a></span></dt><dt><span class="sect2"><a href="#philosophy">2.3. Philosophy</a></span></dt></dl></dd><dt><span class="sect1"><a href="#Implementation">3. Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="#proxy-obedience">3.1. Proxy Obedience</a></span></dt><dt><span class="sect2"><a href="#state-separation">3.2. State Separation</a></span></dt><dt><span class="sect2"><a href="#disk-avoidance">3.3. Disk Avoidance</a></span></dt><dt><span class="sect2"><a href="#app-data-isolation">3.4. Application Data Isolation</a></span></dt><dt><span class="sect2"><a href="#identifier-linkability">3.5. Cross-Origin Identifier Unlinkability</a></span></dt><dt><span class="sect2"><a href="#fingerprinting-linkability">3.6. Cross-Origin Fingerprinting Unlinkability</a></span></dt><dt><span class="sect2"><a href="#new-identity">3.7. Long-Term Unlinkability via "New Identity" button</a></span></dt><dt><span class="sect2"><a href="#click-to-play">3.8. Click-to-play for plugins and invasive content</a></span></dt><dt><span class="sect2"><a href="#firefox-patches">3.9. Description of Firefox Patches</a></span></dt></dl></dd><dt><span class="sect1"><a href="#Packaging">4. Packaging</a></span></dt><dd><dl><dt><span class="sect2"><a href="#build-security">4.1. Build Process Security</a></span></dt><dt><span class="sect2"><a href="#addons">4.2. External Addons</a></span></dt><dt><span class="sect2"><a href="#prefs">4.3. Pref Changes</a></span></dt><dt><span class="sect2"><a href="#update-mechanism">4.4. Update Security</a></span></dt></dl></dd><dt><span class="sect1"><a href="#Testing">5. Testing</a></span></dt><dd><dl><dt><span class="sect2"><a href="#SingleStateTesting">5.1. Single state testing</a></span></dt></dl></dd></dl></div><div class="sect1" title="1. Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3042393"></a>1. Introduction</h2></div></div></div><p> |
|
| 4 | 4 |
|
| 5 | 5 |
This document describes the <a class="link" href="#adversary" title="1.1. Adversary Model">adversary model</a>, |
| 6 | 6 |
<a class="link" href="#DesignRequirements" title="2. Design Requirements and Philosophy">design requirements</a>, |
| ... | ... |
@@ -224,18 +224,22 @@ the user in terms of immediate deanonymization and/or observability. With |
| 224 | 224 |
respect to platform support, security requirements are the minimum properties |
| 225 | 225 |
in order for Tor to support the use of a web client platform. |
| 226 | 226 |
|
| 227 |
- </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><span class="command"><strong>Proxy Obedience</strong></span><p>The browser |
|
| 228 |
-MUST NOT bypass Tor proxy settings for any content.</p></li><li class="listitem"><span class="command"><strong>State Separation</strong></span><p>The browser MUST NOT provide any stored state to the content window |
|
| 227 |
+ </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><a class="link" href="#proxy-obedience" title="3.1. Proxy Obedience"><span class="command"><strong>Proxy |
|
| 228 |
+Obedience</strong></span></a><p>The browser |
|
| 229 |
+MUST NOT bypass Tor proxy settings for any content.</p></li><li class="listitem"><a class="link" href="#state-separation" title="3.2. State Separation"><span class="command"><strong>State |
|
| 230 |
+Separation</strong></span></a><p>The browser MUST NOT provide any stored state to the content window |
|
| 229 | 231 |
from other browsers or other browsing modes, including shared state from |
| 230 | 232 |
plugins, machine identifiers, and TLS session state. |
| 231 |
-</p></li><li class="listitem"><span class="command"><strong>Disk Avoidance</strong></span><p> |
|
| 233 |
+</p></li><li class="listitem"><a class="link" href="#disk-avoidance" title="3.3. Disk Avoidance"><span class="command"><strong>Disk |
|
| 234 |
+Avoidance</strong></span></a><p> |
|
| 232 | 235 |
|
| 233 | 236 |
The browser MUST NOT write any information that is derived from or that |
| 234 | 237 |
reveals browsing activity to the disk, or store it in memory beyond the |
| 235 | 238 |
duration of one browsing session, unless the user has explicitly opted to |
| 236 | 239 |
store their browsing history information to disk. |
| 237 | 240 |
|
| 238 |
-</p></li><li class="listitem"><span class="command"><strong>Application Data Isolation</strong></span><p> |
|
| 241 |
+</p></li><li class="listitem"><a class="link" href="#app-data-isolation" title="3.4. Application Data Isolation"><span class="command"><strong>Application Data |
|
| 242 |
+Isolation</strong></span></a><p> |
|
| 239 | 243 |
|
| 240 | 244 |
The components involved in providing private browsing MUST be self-contained, |
| 241 | 245 |
or MUST provide a mechanism for rapid, complete removal of all evidence of the |
| ... | ... |
@@ -248,7 +252,7 @@ due to operating system behavior MUST be wiped by an uninstaller. However, due |
| 248 | 252 |
to permissions issues with access to swap, implementations MAY choose to leave |
| 249 | 253 |
it out of scope, and/or leave it to the user to implement encrypted swap. |
| 250 | 254 |
|
| 251 |
-</p></li><li class="listitem"><span class="command"><strong>Update Safety</strong></span><p>The browser SHOULD NOT perform unsafe updates or upgrades.</p></li></ol></div></div><div class="sect2" title="2.2. Privacy Requirements"><div class="titlepage"><div><div><h3 class="title"><a id="privacy"></a>2.2. Privacy Requirements</h3></div></div></div><p> |
|
| 255 |
+</p></li></ol></div></div><div class="sect2" title="2.2. Privacy Requirements"><div class="titlepage"><div><div><h3 class="title"><a id="privacy"></a>2.2. Privacy Requirements</h3></div></div></div><p> |
|
| 252 | 256 |
|
| 253 | 257 |
The privacy requirements are primarily concerned with reducing linkability: |
| 254 | 258 |
the ability for a user's activity on one site to be linked with their activity |
| ... | ... |
@@ -265,7 +269,8 @@ second-level DNS name. For example, for mail.google.com, the origin would be |
| 265 | 269 |
google.com. Implementations MAY, at their option, restrict the url bar origin |
| 266 | 270 |
to be the entire fully qualified domain name. |
| 267 | 271 |
|
| 268 |
- </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><span class="command"><strong>Cross-Origin Identifier Unlinkability</strong></span><p> |
|
| 272 |
+ </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><a class="link" href="#identifier-linkability" title="3.5. Cross-Origin Identifier Unlinkability"><span class="command"><strong>Cross-Origin |
|
| 273 |
+Identifier Unlinkability</strong></span></a><p> |
|
| 269 | 274 |
|
| 270 | 275 |
User activity on one url bar origin MUST NOT be linkable to their activity in |
| 271 | 276 |
any other url bar origin by any third party automatically or without user |
| ... | ... |
@@ -275,13 +280,15 @@ requirement does not apply to linkable information the user manually submits |
| 275 | 280 |
to sites, or due information submitted during manual link traversal. This |
| 276 | 281 |
functionality SHOULD NOT interfere with federated login in a substantial way. |
| 277 | 282 |
|
| 278 |
- </p></li><li class="listitem"><span class="command"><strong>Cross-Origin Fingerprinting Unlinkability</strong></span><p> |
|
| 283 |
+ </p></li><li class="listitem"><a class="link" href="#fingerprinting-linkability" title="3.6. Cross-Origin Fingerprinting Unlinkability"><span class="command"><strong>Cross-Origin |
|
| 284 |
+Fingerprinting Unlinkability</strong></span></a><p> |
|
| 279 | 285 |
|
| 280 | 286 |
User activity on one url bar origin MUST NOT be linkable to their activity in |
| 281 | 287 |
any other url bar origin by any third party. This property specifically applies to |
| 282 | 288 |
linkability from fingerprinting browser behavior. |
| 283 | 289 |
|
| 284 |
- </p></li><li class="listitem"><span class="command"><strong>Long-Term Unlinkability</strong></span><p> |
|
| 290 |
+ </p></li><li class="listitem"><a class="link" href="#new-identity" title="3.7. Long-Term Unlinkability via "New Identity" button"><span class="command"><strong>Long-Term |
|
| 291 |
+Unlinkability</strong></span></a><p> |
|
| 285 | 292 |
|
| 286 | 293 |
The browser SHOULD provide an obvious, easy way to remove all of its |
| 287 | 294 |
authentication tokens and browser state and obtain a fresh identity. |
| ... | ... |
@@ -385,6 +392,21 @@ technologies, we cannot hope to substantially influence or be involved in |
| 385 | 392 |
their proper deployment or privacy realization. However, we will likely disable |
| 386 | 393 |
certain new features (where possible) pending analysis and audit. |
| 387 | 394 |
</p></li></ol></div></div></div><div class="sect1" title="3. Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="Implementation"></a>3. Implementation</h2></div></div></div><p> |
| 395 |
+ |
|
| 396 |
+The Implementation section is divided into subsections, each of which |
|
| 397 |
+corresponds to a <a class="link" href="#DesignRequirements" title="2. Design Requirements and Philosophy">Design Requirement</a>. |
|
| 398 |
+Each subsection is divided into specific web technologies or properties. The |
|
| 399 |
+implementation is then described for that property. |
|
| 400 |
+ |
|
| 401 |
+ </p><p> |
|
| 402 |
+ |
|
| 403 |
+In some cases, the implementation meets the design requirements in a non-ideal |
|
| 404 |
+way (for example, by disabling features). In rare cases, there may be no |
|
| 405 |
+implementation at all. Both of these cases are denoted by differentiating |
|
| 406 |
+between the <span class="command"><strong>Design Goal</strong></span> and the <span class="command"><strong>Implementation |
|
| 407 |
+Status</strong></span> for each property. Corresponding bugs in the <a class="ulink" href="https://trac.torproject.org/projects/tor/report" target="_top">Tor bug tracker</a> |
|
| 408 |
+are typically linked for these cases. |
|
| 409 |
+ |
|
| 388 | 410 |
</p><div class="sect2" title="3.1. Proxy Obedience"><div class="titlepage"><div><div><h3 class="title"><a id="proxy-obedience"></a>3.1. Proxy Obedience</h3></div></div></div><p> |
| 389 | 411 |
|
| 390 | 412 |
Proxy obedience is assured through the following: |
| ... | ... |
@@ -444,13 +466,13 @@ launch a helper app. |
| 444 | 466 |
Tor Browser State is separated from existing browser state through use of a |
| 445 | 467 |
custom Firefox profile. Furthermore, plugins are disabled, which prevents |
| 446 | 468 |
Flash cookies from leaking from a pre-existing Flash directory. |
| 447 |
- </p></div><div class="sect2" title="3.3. Disk Avoidance"><div class="titlepage"><div><div><h3 class="title"><a id="disk-avoidance"></a>3.3. Disk Avoidance</h3></div></div></div><div class="sect3" title="Design Goal:"><div class="titlepage"><div><div><h4 class="title"><a id="id2901874"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> |
|
| 469 |
+ </p></div><div class="sect2" title="3.3. Disk Avoidance"><div class="titlepage"><div><div><h3 class="title"><a id="disk-avoidance"></a>3.3. Disk Avoidance</h3></div></div></div><div class="sect3" title="Design Goal:"><div class="titlepage"><div><div><h4 class="title"><a id="id3048300"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> |
|
| 448 | 470 |
Tor Browser MUST (at user option) prevent all disk records of browser activity. |
| 449 | 471 |
The user should be able to optionally enable URL history and other history |
| 450 | 472 |
features if they so desire. Once we <a class="ulink" href="https://trac.torproject.org/projects/tor/ticket/3100" target="_top">simplify the |
| 451 | 473 |
preferences interface</a>, we will likely just enable Private Browsing |
| 452 | 474 |
mode by default to handle this goal. |
| 453 |
- </blockquote></div></div><div class="sect3" title="Implementation Status:"><div class="titlepage"><div><div><h4 class="title"><a id="id2878481"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> |
|
| 475 |
+ </blockquote></div></div><div class="sect3" title="Implementation Status:"><div class="titlepage"><div><div><h4 class="title"><a id="id3052558"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> |
|
| 454 | 476 |
For now, Tor Browser blocks write access to the disk through Torbutton |
| 455 | 477 |
using several Firefox preferences. |
| 456 | 478 |
|
| ... | ... |
@@ -515,7 +537,7 @@ the url bar origin for which browser state exists, possibly with a |
| 515 | 537 |
context-menu option to drill down into specific types of state or permissions. |
| 516 | 538 |
An example of this simplification can be seen in Figure 1. |
| 517 | 539 |
|
| 518 |
- </p><div class="figure"><a id="id2898980"></a><p class="title"><b>Figure 1. Improving the Privacy UI</b></p><div class="figure-contents"><div class="mediaobject" align="center"><img src="CookieManagers.png" align="middle" alt="Improving the Privacy UI" /></div><div class="caption"><p></p> |
|
| 540 |
+ </p><div class="figure"><a id="id3051496"></a><p class="title"><b>Figure 1. Improving the Privacy UI</b></p><div class="figure-contents"><div class="mediaobject" align="center"><img src="CookieManagers.png" align="middle" alt="Improving the Privacy UI" /></div><div class="caption"><p></p> |
|
| 519 | 541 |
|
| 520 | 542 |
On the left is the standard Firefox cookie manager. On the right is a mock-up |
| 521 | 543 |
of how isolating identifiers to the URL bar origin might simplify the privacy |
| ... | ... |
@@ -939,11 +961,11 @@ Currently we simply disable WebGL. |
| 939 | 961 |
</p></li></ol></div></div><div class="sect2" title="3.7. Long-Term Unlinkability via "New Identity" button"><div class="titlepage"><div><div><h3 class="title"><a id="new-identity"></a>3.7. Long-Term Unlinkability via "New Identity" button</h3></div></div></div><p> |
| 940 | 962 |
In order to avoid long-term linkability, we provide a "New Identity" context |
| 941 | 963 |
menu option in Torbutton. |
| 942 |
- </p><div class="sect3" title="Design Goal:"><div class="titlepage"><div><div><h4 class="title"><a id="id2857700"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> |
|
| 964 |
+ </p><div class="sect3" title="Design Goal:"><div class="titlepage"><div><div><h4 class="title"><a id="id3068567"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> |
|
| 943 | 965 |
|
| 944 | 966 |
All linkable identifiers and browser state MUST be cleared by this feature. |
| 945 | 967 |
|
| 946 |
- </blockquote></div></div><div class="sect3" title="Implementation Status:"><div class="titlepage"><div><div><h4 class="title"><a id="id2877575"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> |
|
| 968 |
+ </blockquote></div></div><div class="sect3" title="Implementation Status:"><div class="titlepage"><div><div><h4 class="title"><a id="id3057460"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> |
|
| 947 | 969 |
|
| 948 | 970 |
First, Torbutton disables all open tabs and windows via nsIContentPolicy |
| 949 | 971 |
blocking, and then closes each tab and window. The extra step for blocking |
| ... | ... |
@@ -1042,7 +1064,7 @@ ruin our day, and censorship filters). Hence we rolled our own. |
| 1042 | 1064 |
This patch prevents random URLs from being inserted into content-prefs.sqllite in |
| 1043 | 1065 |
the profile directory as content prefs change (includes site-zoom and perhaps |
| 1044 | 1066 |
other site prefs?). |
| 1045 |
- </p></li></ol></div></div></div><div class="sect1" title="4. Packaging"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="Packaging"></a>4. Packaging</h2></div></div></div><p> </p><div class="sect2" title="4.1. Build Process Security"><div class="titlepage"><div><div><h3 class="title"><a id="build-security"></a>4.1. Build Process Security</h3></div></div></div><p> </p></div><div class="sect2" title="4.2. External Addons"><div class="titlepage"><div><div><h3 class="title"><a id="addons"></a>4.2. External Addons</h3></div></div></div><p> </p><div class="sect3" title="Included Addons"><div class="titlepage"><div><div><h4 class="title"><a id="id2889516"></a>Included Addons</h4></div></div></div></div><div class="sect3" title="Excluded Addons"><div class="titlepage"><div><div><h4 class="title"><a id="id2875722"></a>Excluded Addons</h4></div></div></div></div><div class="sect3" title="Dangerous Addons"><div class="titlepage"><div><div><h4 class="title"><a id="id2861148"></a>Dangerous Addons</h4></div></div></div></div></div><div class="sect2" title="4.3. Pref Changes"><div class="titlepage"><div><div><h3 class="title"><a id="prefs"></a>4.3. Pref Changes</h3></div></div></div><p> </p></div><div class="sect2" title="4.4. Update Security"><div class="titlepage"><div><div><h3 class="title"><a id="update-mechanism"></a>4.4. Update Security</h3></div></div></div><p> </p></div></div><div class="sect1" title="5. Testing"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="Testing"></a>5. Testing</h2></div></div></div><p> |
|
| 1067 |
+ </p></li></ol></div></div></div><div class="sect1" title="4. Packaging"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="Packaging"></a>4. Packaging</h2></div></div></div><p> </p><div class="sect2" title="4.1. Build Process Security"><div class="titlepage"><div><div><h3 class="title"><a id="build-security"></a>4.1. Build Process Security</h3></div></div></div><p> </p></div><div class="sect2" title="4.2. External Addons"><div class="titlepage"><div><div><h3 class="title"><a id="addons"></a>4.2. External Addons</h3></div></div></div><p> </p><div class="sect3" title="Included Addons"><div class="titlepage"><div><div><h4 class="title"><a id="id3033960"></a>Included Addons</h4></div></div></div></div><div class="sect3" title="Excluded Addons"><div class="titlepage"><div><div><h4 class="title"><a id="id3033967"></a>Excluded Addons</h4></div></div></div></div><div class="sect3" title="Dangerous Addons"><div class="titlepage"><div><div><h4 class="title"><a id="id3033984"></a>Dangerous Addons</h4></div></div></div></div></div><div class="sect2" title="4.3. Pref Changes"><div class="titlepage"><div><div><h3 class="title"><a id="prefs"></a>4.3. Pref Changes</h3></div></div></div><p> </p></div><div class="sect2" title="4.4. Update Security"><div class="titlepage"><div><div><h3 class="title"><a id="update-mechanism"></a>4.4. Update Security</h3></div></div></div><p> </p></div></div><div class="sect1" title="5. Testing"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="Testing"></a>5. Testing</h2></div></div></div><p> |
|
| 1046 | 1068 |
|
| 1047 | 1069 |
The purpose of this section is to cover all the known ways that Tor browser |
| 1048 | 1070 |
security can be subverted from a penetration testing perspective. The hope |
| 1049 | 1071 |