TBB design doc: Fix typos, clarify extensions policy a bit.
Mike Perry commited on 2013-03-17 00:47:12
Zeige 1 geänderte Dateien mit 46 Einfügungen und 18 Löschungen.
- projects/torbrowser/design/index.html.en 5580a1212..8ec770eae
| ... | ... |
@@ -1,6 +1,6 @@ |
| 1 | 1 |
<?xml version="1.0" encoding="UTF-8"?> |
| 2 | 2 |
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> |
| 3 |
-<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>The Design and Implementation of the Tor Browser [DRAFT]</title><meta name="generator" content="DocBook XSL Stylesheets V1.76.1" /></head><body><div class="article" title="The Design and Implementation of the Tor Browser [DRAFT]"><div class="titlepage"><div><div><h2 class="title"><a id="design"></a>The Design and Implementation of the Tor Browser [DRAFT]</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Mike</span> <span class="surname">Perry</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:mikeperry#torproject org">mikeperry#torproject org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Erinn</span> <span class="surname">Clark</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:erinn#torproject org">erinn#torproject org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Steven</span> <span class="surname">Murdoch</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:sjmurdoch#torproject org">sjmurdoch#torproject org</a>></code></p></div></div></div></div><div><p class="pubdate">March 11, 2013</p></div></div><hr /></div><div class="toc"><p><strong>Table of Contents</strong></p><dl><dt><span class="sect1"><a href="#idp3154416">1. Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="#components">1.1. Browser Component Overview</a></span></dt></dl></dd><dt><span class="sect1"><a href="#DesignRequirements">2. Design Requirements and Philosophy</a></span></dt><dd><dl><dt><span class="sect2"><a href="#security">2.1. Security Requirements</a></span></dt><dt><span class="sect2"><a href="#privacy">2.2. Privacy Requirements</a></span></dt><dt><span class="sect2"><a href="#philosophy">2.3. Philosophy</a></span></dt></dl></dd><dt><span class="sect1"><a href="#adversary">3. Adversary Model</a></span></dt><dd><dl><dt><span class="sect2"><a href="#adversary-goals">3.1. Adversary Goals</a></span></dt><dt><span class="sect2"><a href="#adversary-positioning">3.2. Adversary Capabilities - Positioning</a></span></dt><dt><span class="sect2"><a href="#attacks">3.3. Adversary Capabilities - Attacks</a></span></dt></dl></dd><dt><span class="sect1"><a href="#Implementation">4. Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="#proxy-obedience">4.1. Proxy Obedience</a></span></dt><dt><span class="sect2"><a href="#state-separation">4.2. State Separation</a></span></dt><dt><span class="sect2"><a href="#disk-avoidance">4.3. Disk Avoidance</a></span></dt><dt><span class="sect2"><a href="#app-data-isolation">4.4. Application Data Isolation</a></span></dt><dt><span class="sect2"><a href="#identifier-linkability">4.5. Cross-Origin Identifier Unlinkability</a></span></dt><dt><span class="sect2"><a href="#fingerprinting-linkability">4.6. Cross-Origin Fingerprinting Unlinkability</a></span></dt><dt><span class="sect2"><a href="#new-identity">4.7. Long-Term Unlinkability via "New Identity" button</a></span></dt><dt><span class="sect2"><a href="#other-security">4.8. Other Security Measures</a></span></dt><dt><span class="sect2"><a href="#firefox-patches">4.9. Description of Firefox Patches</a></span></dt></dl></dd><dt><span class="appendix"><a href="#Transparency">A. Towards Transparency in Navigation Tracking</a></span></dt><dd><dl><dt><span class="sect1"><a href="#deprecate">A.1. Deprecation Wishlist</a></span></dt><dt><span class="sect1"><a href="#idp5843792">A.2. Promising Standards</a></span></dt></dl></dd></dl></div><div class="sect1" title="1. Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="idp3154416"></a>1. Introduction</h2></div></div></div><p> |
|
| 3 |
+<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>The Design and Implementation of the Tor Browser [DRAFT]</title><meta name="generator" content="DocBook XSL Stylesheets V1.76.1" /></head><body><div class="article" title="The Design and Implementation of the Tor Browser [DRAFT]"><div class="titlepage"><div><div><h2 class="title"><a id="design"></a>The Design and Implementation of the Tor Browser [DRAFT]</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Mike</span> <span class="surname">Perry</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:mikeperry#torproject org">mikeperry#torproject org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Erinn</span> <span class="surname">Clark</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:erinn#torproject org">erinn#torproject org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Steven</span> <span class="surname">Murdoch</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:sjmurdoch#torproject org">sjmurdoch#torproject org</a>></code></p></div></div></div></div><div><p class="pubdate">March 15, 2013</p></div></div><hr /></div><div class="toc"><p><strong>Table of Contents</strong></p><dl><dt><span class="sect1"><a href="#idp2182160">1. Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="#components">1.1. Browser Component Overview</a></span></dt></dl></dd><dt><span class="sect1"><a href="#DesignRequirements">2. Design Requirements and Philosophy</a></span></dt><dd><dl><dt><span class="sect2"><a href="#security">2.1. Security Requirements</a></span></dt><dt><span class="sect2"><a href="#privacy">2.2. Privacy Requirements</a></span></dt><dt><span class="sect2"><a href="#philosophy">2.3. Philosophy</a></span></dt></dl></dd><dt><span class="sect1"><a href="#adversary">3. Adversary Model</a></span></dt><dd><dl><dt><span class="sect2"><a href="#adversary-goals">3.1. Adversary Goals</a></span></dt><dt><span class="sect2"><a href="#adversary-positioning">3.2. Adversary Capabilities - Positioning</a></span></dt><dt><span class="sect2"><a href="#attacks">3.3. Adversary Capabilities - Attacks</a></span></dt></dl></dd><dt><span class="sect1"><a href="#Implementation">4. Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="#proxy-obedience">4.1. Proxy Obedience</a></span></dt><dt><span class="sect2"><a href="#state-separation">4.2. State Separation</a></span></dt><dt><span class="sect2"><a href="#disk-avoidance">4.3. Disk Avoidance</a></span></dt><dt><span class="sect2"><a href="#app-data-isolation">4.4. Application Data Isolation</a></span></dt><dt><span class="sect2"><a href="#identifier-linkability">4.5. Cross-Origin Identifier Unlinkability</a></span></dt><dt><span class="sect2"><a href="#fingerprinting-linkability">4.6. Cross-Origin Fingerprinting Unlinkability</a></span></dt><dt><span class="sect2"><a href="#new-identity">4.7. Long-Term Unlinkability via "New Identity" button</a></span></dt><dt><span class="sect2"><a href="#other-security">4.8. Other Security Measures</a></span></dt><dt><span class="sect2"><a href="#firefox-patches">4.9. Description of Firefox Patches</a></span></dt></dl></dd><dt><span class="appendix"><a href="#Transparency">A. Towards Transparency in Navigation Tracking</a></span></dt><dd><dl><dt><span class="sect1"><a href="#deprecate">A.1. Deprecation Wishlist</a></span></dt><dt><span class="sect1"><a href="#idp5896048">A.2. Promising Standards</a></span></dt></dl></dd></dl></div><div class="sect1" title="1. Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="idp2182160"></a>1. Introduction</h2></div></div></div><p> |
|
| 4 | 4 |
|
| 5 | 5 |
This document describes the <a class="link" href="#adversary" title="3. Adversary Model">adversary model</a>, |
| 6 | 6 |
<a class="link" href="#DesignRequirements" title="2. Design Requirements and Philosophy">design requirements</a>, and <a class="link" href="#Implementation" title="4. Implementation">implementation</a> of the Tor Browser. It is current as of Tor Browser |
| ... | ... |
@@ -468,7 +468,7 @@ number of "web pages" many orders of magnitude larger than even <a class="ulink" |
| 468 | 468 |
"Open World" scenario</a>, which suffered continous near-constant decline |
| 469 | 469 |
in the true positive rate as the "Open World" size grew (see figure 4). This |
| 470 | 470 |
large level of classification complexity is further confounded by a noisy and |
| 471 |
-low resolution featureset - one which is also realtively easy for the defender |
|
| 471 |
+low resolution featureset - one which is also relatively easy for the defender |
|
| 472 | 472 |
to manipulate at low cost. |
| 473 | 473 |
|
| 474 | 474 |
</p><p> |
| ... | ... |
@@ -497,14 +497,24 @@ OS</strong></span><p> |
| 497 | 497 |
Last, but definitely not least, the adversary can exploit either general |
| 498 | 498 |
browser vulnerabilities, plugin vulnerabilities, or OS vulnerabilities to |
| 499 | 499 |
install malware and surveillance software. An adversary with physical access |
| 500 |
-can perform similar actions. Regrettably, this last attack capability is |
|
| 501 |
-outside of the browser's ability to defend against, but it is worth mentioning |
|
| 502 |
-for completeness. In fact, <a class="ulink" href="http://tails.boum.org/contribute/design/" target="_top">The Tails system</a> can |
|
| 503 |
-provide some defense against this adversary, and it does include the Tor |
|
| 504 |
-Browser. We do however aim to defend against an adersary that has passive |
|
| 505 |
-forensic access the disk after browsing activity takes place, as part of our |
|
| 500 |
+can perform similar actions. |
|
| 501 |
+ |
|
| 502 |
+ </p><p> |
|
| 503 |
+ |
|
| 504 |
+For the purposes of the browser itself, we limit the scope of this adversary |
|
| 505 |
+to one that has passive forensic access to the disk after browsing activity |
|
| 506 |
+has taken place. This adversary motivates our |
|
| 506 | 507 |
<a class="link" href="#disk-avoidance" title="4.3. Disk Avoidance">Disk Avoidance</a> defenses. |
| 507 | 508 |
|
| 509 |
+ </p><p> |
|
| 510 |
+ |
|
| 511 |
+An adversary with arbitrary code execution typically has more power, though. |
|
| 512 |
+It can be quite hard to really significantly limit the capabilities of such an |
|
| 513 |
+adversary. <a class="ulink" href="http://tails.boum.org/contribute/design/" target="_top">The Tails system</a> can |
|
| 514 |
+provide some defense against this adversary through the use of readonly media |
|
| 515 |
+and frequent reboots, but even this can be circumvented on machines without |
|
| 516 |
+Secure Boot through the use of BIOS rootkits. |
|
| 517 |
+ |
|
| 508 | 518 |
</p></li></ol></div></div></div><div class="sect1" title="4. Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="Implementation"></a>4. Implementation</h2></div></div></div><p> |
| 509 | 519 |
|
| 510 | 520 |
The Implementation section is divided into subsections, each of which |
| ... | ... |
@@ -605,17 +615,35 @@ clicking on an image link. We had to patch Firefox to <a class="ulink" href="htt |
| 605 | 615 |
an observer event during dragging</a> to allow us to filter the drag |
| 606 | 616 |
events from Torbutton before the OS downloads the URLs the events contained. |
| 607 | 617 |
|
| 618 |
+ </p></li><li class="listitem">Disabling system extensions and clearing the addon whitelist |
|
| 619 |
+ <p> |
|
| 620 |
+ |
|
| 621 |
+Firefox addons can perform arbitrary activity on your computer, including |
|
| 622 |
+bypassing Tor. It is for this reason we disable the addon whitelist |
|
| 623 |
+(<span class="command"><strong>xpinstall.whitelist.add</strong></span>), so that users are prompted |
|
| 624 |
+before installing addons regardless of the source. We also exclude |
|
| 625 |
+system-level addons from the browser through the use of |
|
| 626 |
+<span class="command"><strong>extensions.enabledScopes</strong></span> and |
|
| 627 |
+<span class="command"><strong>extensions.autoDisableScopes</strong></span>. |
|
| 628 |
+ |
|
| 608 | 629 |
</p></li></ol></div></div><div class="sect2" title="4.2. State Separation"><div class="titlepage"><div><div><h3 class="title"><a id="state-separation"></a>4.2. State Separation</h3></div></div></div><p> |
| 630 |
+ |
|
| 609 | 631 |
Tor Browser State is separated from existing browser state through use of a |
| 610 |
-custom Firefox profile. Furthermore, plugins are disabled, which prevents |
|
| 611 |
-Flash cookies from leaking from a pre-existing Flash directory. |
|
| 612 |
- </p></div><div class="sect2" title="4.3. Disk Avoidance"><div class="titlepage"><div><div><h3 class="title"><a id="disk-avoidance"></a>4.3. Disk Avoidance</h3></div></div></div><div class="sect3" title="Design Goal:"><div class="titlepage"><div><div><h4 class="title"><a id="idp5587232"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> |
|
| 632 |
+custom Firefox profile, and by setting the $HOME environment variable to the |
|
| 633 |
+root of the bundle's directory. The browser also does not load any |
|
| 634 |
+system-wide extensions (through the use of |
|
| 635 |
+<span class="command"><strong>extensions.enabledScopes</strong></span> and |
|
| 636 |
+<span class="command"><strong>extensions.autoDisableScopes</strong></span>. Furthermore, plugins are |
|
| 637 |
+disabled, which prevents Flash cookies from leaking from a pre-existing Flash |
|
| 638 |
+directory. |
|
| 639 |
+ |
|
| 640 |
+ </p></div><div class="sect2" title="4.3. Disk Avoidance"><div class="titlepage"><div><div><h3 class="title"><a id="disk-avoidance"></a>4.3. Disk Avoidance</h3></div></div></div><div class="sect3" title="Design Goal:"><div class="titlepage"><div><div><h4 class="title"><a id="idp5639136"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> |
|
| 613 | 641 |
|
| 614 | 642 |
The User Agent MUST (at user option) prevent all disk records of browser activity. |
| 615 | 643 |
The user should be able to optionally enable URL history and other history |
| 616 | 644 |
features if they so desire. |
| 617 | 645 |
|
| 618 |
- </blockquote></div></div><div class="sect3" title="Implementation Status:"><div class="titlepage"><div><div><h4 class="title"><a id="idp5588592"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> |
|
| 646 |
+ </blockquote></div></div><div class="sect3" title="Implementation Status:"><div class="titlepage"><div><div><h4 class="title"><a id="idp5640496"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> |
|
| 619 | 647 |
|
| 620 | 648 |
We achieve this goal through several mechanisms. First, we set the Firefox |
| 621 | 649 |
Private Browsing preference |
| ... | ... |
@@ -695,7 +723,7 @@ the url bar origin for which browser state exists, possibly with a |
| 695 | 723 |
context-menu option to drill down into specific types of state or permissions. |
| 696 | 724 |
An example of this simplification can be seen in Figure 1. |
| 697 | 725 |
|
| 698 |
- </p><div class="figure"><a id="idp5612672"></a><p class="title"><strong>Figure 1. Improving the Privacy UI</strong></p><div class="figure-contents"><div class="mediaobject" align="center"><img src="NewCookieManager.png" align="middle" alt="Improving the Privacy UI" /></div><div class="caption"><p></p> |
|
| 726 |
+ </p><div class="figure"><a id="idp5664576"></a><p class="title"><strong>Figure 1. Improving the Privacy UI</strong></p><div class="figure-contents"><div class="mediaobject" align="center"><img src="NewCookieManager.png" align="middle" alt="Improving the Privacy UI" /></div><div class="caption"><p></p> |
|
| 699 | 727 |
|
| 700 | 728 |
This example UI is a mock-up of how isolating identifiers to the URL bar |
| 701 | 729 |
origin can simplify the privacy UI for all data - not just cookies. Once |
| ... | ... |
@@ -1182,11 +1210,11 @@ In order to avoid long-term linkability, we provide a "New Identity" context |
| 1182 | 1210 |
menu option in Torbutton. This context menu option is active if Torbutton can |
| 1183 | 1211 |
read the environment variables $TOR_CONTROL_PASSWD and $TOR_CONTROL_PORT. |
| 1184 | 1212 |
|
| 1185 |
- </p><div class="sect3" title="Design Goal:"><div class="titlepage"><div><div><h4 class="title"><a id="idp5731056"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> |
|
| 1213 |
+ </p><div class="sect3" title="Design Goal:"><div class="titlepage"><div><div><h4 class="title"><a id="idp5782640"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> |
|
| 1186 | 1214 |
|
| 1187 | 1215 |
All linkable identifiers and browser state MUST be cleared by this feature. |
| 1188 | 1216 |
|
| 1189 |
- </blockquote></div></div><div class="sect3" title="Implementation Status:"><div class="titlepage"><div><div><h4 class="title"><a id="idp5732304"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> |
|
| 1217 |
+ </blockquote></div></div><div class="sect3" title="Implementation Status:"><div class="titlepage"><div><div><h4 class="title"><a id="idp5783888"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> |
|
| 1190 | 1218 |
|
| 1191 | 1219 |
First, Torbutton disables Javascript in all open tabs and windows by using |
| 1192 | 1220 |
both the <a class="ulink" href="https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsIDocShell#Attributes" target="_top">browser.docShell.allowJavascript</a> |
| ... | ... |
@@ -1230,7 +1258,7 @@ privacy and security issues. |
| 1230 | 1258 |
Fingerprinting</a> is a statistical attack to attempt to recognize specific |
| 1231 | 1259 |
encrypted website activity. |
| 1232 | 1260 |
|
| 1233 |
- </p><div class="sect3" title="Design Goal:"><div class="titlepage"><div><div><h4 class="title"><a id="idp5746320"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> |
|
| 1261 |
+ </p><div class="sect3" title="Design Goal:"><div class="titlepage"><div><div><h4 class="title"><a id="idp5797920"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> |
|
| 1234 | 1262 |
|
| 1235 | 1263 |
We want to deploy a mechanism that reduces the accuracy of <a class="ulink" href="https://en.wikipedia.org/wiki/Feature_selection" target="_top">useful features</a> available |
| 1236 | 1264 |
for classification. This mechanism would either impact the true and false |
| ... | ... |
@@ -1252,7 +1280,7 @@ Congestion-Sensitive BUFLO</a>. It may be also possible to <a class="ulink" href |
| 1252 | 1280 |
defenses</a> such that they only use existing spare Guard bandwidth capacity in the Tor |
| 1253 | 1281 |
network, making them also effectively no-overhead. |
| 1254 | 1282 |
|
| 1255 |
- </p></blockquote></div></div><div class="sect3" title="Implementation Status:"><div class="titlepage"><div><div><h4 class="title"><a id="idp5753216"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> |
|
| 1283 |
+ </p></blockquote></div></div><div class="sect3" title="Implementation Status:"><div class="titlepage"><div><div><h4 class="title"><a id="idp5804816"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> |
|
| 1256 | 1284 |
Currently, we patch Firefox to <a class="ulink" href="https://gitweb.torproject.org/torbrowser.git/blob/maint-2.4:/src/current-patches/firefox/0017-Randomize-HTTP-request-order-and-pipeline-depth.patch" target="_top">randomize |
| 1257 | 1285 |
pipeline order and depth</a>. Unfortunately, pipelining is very fragile. |
| 1258 | 1286 |
Many sites do not support it, and even sites that advertise support for |
| ... | ... |
@@ -1589,7 +1617,7 @@ possible for us to <a class="ulink" href="https://trac.torproject.org/projects/t |
| 1589 | 1617 |
ourselves</a>, as they are comparatively rare and can be handled with site |
| 1590 | 1618 |
permissions. |
| 1591 | 1619 |
|
| 1592 |
- </p></li></ol></div></div><div class="sect1" title="A.2. Promising Standards"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="idp5843792"></a>A.2. Promising Standards</h2></div></div></div><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><a class="ulink" href="http://web-send.org" target="_top">Web-Send Introducer</a><p> |
|
| 1620 |
+ </p></li></ol></div></div><div class="sect1" title="A.2. Promising Standards"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="idp5896048"></a>A.2. Promising Standards</h2></div></div></div><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><a class="ulink" href="http://web-send.org" target="_top">Web-Send Introducer</a><p> |
|
| 1593 | 1621 |
|
| 1594 | 1622 |
Web-Send is a browser-based link sharing and federated login widget that is |
| 1595 | 1623 |
designed to operate without relying on third-party tracking or abusing other |
| 1596 | 1624 |