tor-webwml.git

Update design doc for 1.2.5.
Parent 82ee22248
Mike Perry

Mike Perry commited on 2010-04-10 06:10:35
Zeige 2 geänderte Dateien mit 184 Einfügungen und 59 Löschungen.

torbutton/design/design.xml
Zeige Datei @ d0a98d221
... ... 
@@ -11,7 +11,7 @@
11 11 
      <address><email>mikeperry.fscked/org</email></address>
12 12 
     </affiliation>
13 13 
    </author>
14 
-   <pubdate>Dec 15 2009</pubdate>
14 
+   <pubdate>Apr 10 2010</pubdate>
15 15 
  </articleinfo>
16 16
17 17 
 <sect1>
... ... 
@@ -19,7 +19,7 @@
19 19 
   <para>
20 20
21 21 
 This document describes the goals, operation, and testing procedures of the
22 
-Torbutton Firefox extension. It is current as of Torbutton 1.2.4.
22 
+Torbutton Firefox extension. It is current as of Torbutton 1.2.5.
23 23
24 24 
   </para>
25 25 
   <sect2 id="adversary">
... ... 
@@ -1202,7 +1202,7 @@ to retrieve the original screen values by using <ulink
1202 1202 
 url="http://pseudo-flaw.net/tor/torbutton/unmask-sandbox-xpcnativewrapper.html">XPCNativeWrapper</ulink>
1203 1203 
 or <ulink
1204 1204 
 url="http://pseudo-flaw.net/tor/torbutton/unmask-components-lookupmethod.html">Components.lookupMethod</ulink>.
1205 
-We are still looking for a workaround as of Torbutton 1.2.4.
1205 
+We are still looking for a workaround as of Torbutton 1.2.5.
1206 1206
1207 1207 
 <!-- FIXME: Don't forget to update this -->
1208 1208
... ... 
@@ -1273,6 +1273,25 @@ This setting satisfies the <link
1273 1273 
 linkend="updates">Update Safety</link> requirement.
1274 1274 
 </para>
1275 1275 
 </sect2>
1276 
+<sect2>
1277 
+<title>Redirect Torbutton Updates Via Tor (recommended)</title>
1278 
+
1279 
+  <para>Option: <command>extensions.torbutton.update_torbutton_via_tor</command></para>
1280 
+
1281 
+  <para>This setting causes Torbutton to install an
1282 
+
1283 
+<ulink
1284 
+url="https://developer.mozilla.org/en/nsIProtocolProxyFilter">nsIProtocolProxyFilter</ulink>
1285 
+in order to redirect all version update checks and Torbutton update downloads
1286 
+via Tor, regardless of if Tor is enabled or not. This was done both to address
1287 
+concerns about data retention done by <ulink
1288 
+url="https://www.addons.mozilla.org">addons.mozilla.org</ulink>, as well as to
1289 
+help censored users meet the <link linkend="undiscoverability">Tor
1290 
+Undiscoverability</link> requirement.
1291 
+
1292 
+  </para>
1293 
+</sect2>
1294 
+
1276 1295 
 <sect2>
1277 1296
1278 1297 
 <title>Disable Search Suggestions during Tor (recommended)</title>
... ... 
@@ -1713,7 +1732,7 @@ cookie clearing, 1 means clear only during Tor-enabled shutdown, and 2 means
1713 1732 
 clear for both Tor and Non-Tor shutdown. When set to 1 or 2, Torbutton listens
1714 1733 
 for the <ulink
1715 1734 
 url="http://developer.mozilla.org/en/docs/Observer_Notifications#Application_shutdown">quit-application-granted</ulink> event in
1716 
-<function>torbutton_uninstall_observer()</function> and use <ulink
1735 
+<function>https://git.torproject.org/checkout/torbutton/master/src/components/crash-observer.js</function> and use <ulink
1717 1736 
 url="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-jar-selector.js">@torproject.org/cookie-jar-selector;2</ulink>
1718 1737 
 to clear out all cookies and all cookie jars upon shutdown.  </para>
1719 1738 
 <para>
... ... 
@@ -1770,7 +1789,7 @@ url="https://git.torproject.org/checkout/torbutton/master/src/components/crash-o
1770 1789 
   <command>extensions.torbutton.crashed</command> pref). To confirm for
1771 1790 
 false positives (such as session restore failures, upgrade, normal
1772 1791 
 session restore, etc), Torbutton also sets the pref
1773 
-extensions.torbutton.normal_exit in torbutton_uninstall_observer() during
1792 
+extensions.torbutton.normal_exit during
1774 1793 
 Firefox exit and checks this value as well during startup.
1775 1794 
 </para>
1776 1795 
 <para>
... ... 
@@ -1925,6 +1944,67 @@ url="http://kb.mozillazine.org/Network.http.sendRefererHeader">network.http.send
1925 1944 
 <para>
1926 1945 
 This setting also does not directly satisfy any Torbutton requirement, but
1927 1946 
 some may desire to mask their referrer for general privacy concerns.
1947 
+</para>
1948 
+</sect2>
1949 
+<sect2>
1950 
+  <title>Strip platform and language off of Google Search Box queries</title>
1951 
+
1952 
+<para>Option: <command>extensions.torbutton.fix_google_srch</command>
1953 
+</para>
1954 
+
1955 
+<para>
1956 
+
1957 
+This option causes Torbutton to use the <ulink
1958 
+url="https://wiki.mozilla.org/Search_Service:API">@mozilla.org/browser/search-service;1</ulink>
1959 
+component to wrap the Google search plugin. On many platforms, notably Debian
1960 
+and Ubuntu, the Google search plugin is set to reveal a lot of language and
1961 
+platform information. This setting strips off that info while Tor is enabled.
1962 
+
1963 
+</para>
1964 
+<para>
1965 
+This setting helps Torbutton to fulfill its <link
1966 
+linkend="setpreservation">Anonymity Set Preservation</link> requirement.
1967 
+</para>
1968 
+</sect2>
1969 
+
1970 
+<sect2>
1971 
+  <title>Automatically use an alternate search engine when presented with a
1972 
+Google Captcha</title>
1973 
+
1974 
+<para>Options:
1975 
+<simplelist>
1976 
+ <member><command>extensions.torbutton.asked_google_captcha</command></member>
1977 
+ <member><command>extensions.torbutton.dodge_google_captcha</command></member>
1978 
+ <member><command>extensions.torbutton.google_redir_url</command></member>
1979 
+</simplelist>
1980 
+</para>
1981 
+
1982 
+<para>
1983 
+
1984 
+Google's earch engine has rate limiting features that cause it to
1985 
+<ulink
1986 
+url="http://googleonlinesecurity.blogspot.com/2007/07/reason-behind-were-sorry-message.html">present
1987 
+captchas</ulink> and sometimes even outright ban IPs that issue large numbers
1988 
+of search queries, especially if a lot of these queries appear to be searching
1989 
+for software vulnerabilities or unprotected comment areas.
1990 
+
1991 
+</para>
1992 
+<para>
1993 
+
1994 
+Despite multiple discussions with Google, we were unable to come to a solution
1995 
+or any form of compromise that would reduce the number of captchas and
1996 
+outright bans seen by Tor users issuing regular queries.
1997 
+
1998 
+</para>
1999 
+<para>
2000 
+As a result, we've implemented this option as an <ulink
2001 
+url="https://developer.mozilla.org/en/XUL_School/Intercepting_Page_Loads#HTTP_Observers">'http-on-modify-request'</ulink>
2002 
+http observer to optionally redirect banned or captcha-triggering Google
2003 
+queries to search engines that do not rate limit Tor users. The current
2004 
+options are ixquick.com, bing.com, yahoo.com and scroogle.org. These are
2005 
+encoded in the preferences
2006 
+<command>extensions.torbutton.redir_url.[1-4]</command>.
2007 
+
1928 2008 
 </para>
1929 2009 
 </sect2>
1930 2010
torbutton/design/index.html.en
Zeige Datei @ d0a98d221
... ... 
@@ -1,9 +1,10 @@
1 1 
 <?xml version="1.0" encoding="UTF-8"?>
2 2 
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3 
-<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Torbutton Design Documentation</title><meta name="generator" content="DocBook XSL Stylesheets V1.75.2" /></head><body><div class="article" title="Torbutton Design Documentation"><div class="titlepage"><div><div><h2 class="title"><a id="design"></a>Torbutton Design Documentation</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Mike</span> <span class="surname">Perry</span></h3><div class="affiliation"><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:mikeperry.fscked/org">mikeperry.fscked/org</a>&gt;</code></p></div></div></div></div><div><p class="pubdate">Dec 15 2009</p></div></div><hr /></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="#id2510984">1. Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="#adversary">1.1. Adversary Model</a></span></dt><dt><span class="sect2"><a href="#requirements">1.2. Torbutton Requirements</a></span></dt><dt><span class="sect2"><a href="#layout">1.3. Extension Layout</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2541734">2. Components</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2509118">2.1. Hooked Components</a></span></dt><dt><span class="sect2"><a href="#id2513073">2.2. New Components</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2511168">3. Chrome</a></span></dt><dd><dl><dt><span class="sect2"><a href="#browseroverlay">3.1. Browser Overlay - torbutton.xul</a></span></dt><dt><span class="sect2"><a href="#id2521151">3.2. Preferences Window - preferences.xul</a></span></dt><dt><span class="sect2"><a href="#id2524897">3.3. Other Windows</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2538737">4. Toggle Code Path</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2519814">4.1. Button Click</a></span></dt><dt><span class="sect2"><a href="#id2519526">4.2. Proxy Update</a></span></dt><dt><span class="sect2"><a href="#id2504564">4.3. Settings Update</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2519462">5. Description of Options</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2542642">5.1. Test Settings</a></span></dt><dt><span class="sect2"><a href="#plugins">5.2. Disable plugins on Tor Usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2536168">5.3. Isolate Dynamic Content to Tor State (crucial)</a></span></dt><dt><span class="sect2"><a href="#jshooks">5.4. Hook Dangerous Javascript</a></span></dt><dt><span class="sect2"><a href="#id2530601">5.5. Resize windows to multiples of 50px during Tor usage (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2513266">5.6. Disable Updates During Tor</a></span></dt><dt><span class="sect2"><a href="#id2505201">5.7. Disable Search Suggestions during Tor (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2505239">5.8. Disable livemarks updates during Tor usage (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2505311">5.9. Block Tor/Non-Tor access to network from file:// urls (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2505383">5.10. Close all Tor/Non-Tor tabs and windows on toggle (optional)</a></span></dt><dt><span class="sect2"><a href="#id2505464">5.11. Isolate Access to History navigation to Tor state (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2505548">5.12. History Access Settings</a></span></dt><dt><span class="sect2"><a href="#id2505661">5.13. Clear History During Tor Toggle (optional)</a></span></dt><dt><span class="sect2"><a href="#id2505706">5.14. Block Password+Form saving during Tor/Non-Tor</a></span></dt><dt><span class="sect2"><a href="#id2547259">5.15. Block Tor disk cache and clear all cache on Tor Toggle</a></span></dt><dt><span class="sect2"><a href="#id2547309">5.16. Block disk and memory cache during Tor</a></span></dt><dt><span class="sect2"><a href="#id2547362">5.17. Clear Cookies on Tor Toggle</a></span></dt><dt><span class="sect2"><a href="#id2547413">5.18. Store Non-Tor cookies in a protected jar</a></span></dt><dt><span class="sect2"><a href="#id2547469">5.19. Store both Non-Tor and Tor cookies in a protected jar (dangerous)</a></span></dt><dt><span class="sect2"><a href="#id2547508">5.20. Manage My Own Cookies (dangerous)</a></span></dt><dt><span class="sect2"><a href="#id2547523">5.21. Disable DOM Storage during Tor usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2547627">5.22. Clear HTTP Auth on Tor Toggle (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2547664">5.23. Clear cookies on Tor/Non-Tor shutdown</a></span></dt><dt><span class="sect2"><a href="#id2547718">5.24. Reload cookie jar/clear cookies on Firefox crash</a></span></dt><dt><span class="sect2"><a href="#id2547794">5.25. On crash recovery or session restored startup, restore via: Tor, Non-Tor</a></span></dt><dt><span class="sect2"><a href="#id2547866">5.26. On normal startup, set state to: Tor, Non-Tor, Shutdown State</a></span></dt><dt><span class="sect2"><a href="#id2547925">5.27. Prevent session store from saving Non-Tor/Tor-loaded tabs</a></span></dt><dt><span class="sect2"><a href="#id2547990">5.28. Set user agent during Tor usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2548164">5.29. Spoof US English Browser</a></span></dt><dt><span class="sect2"><a href="#id2548257">5.30. Don't send referrer during Tor Usage</a></span></dt><dt><span class="sect2"><a href="#id2548297">5.31. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)</a></span></dt></dl></dd><dt><span class="sect1"><a href="#FirefoxBugs">6. Relevant Firefox Bugs</a></span></dt><dd><dl><dt><span class="sect2"><a href="#FirefoxSecurity">6.1. Bugs impacting security</a></span></dt><dt><span class="sect2"><a href="#FirefoxWishlist">6.2. Bugs blocking functionality</a></span></dt><dt><span class="sect2"><a href="#FirefoxMiscBugs">6.3. Low Priority Bugs</a></span></dt></dl></dd><dt><span class="sect1"><a href="#TestPlan">7. Testing</a></span></dt><dd><dl><dt><span class="sect2"><a href="#SingleStateTesting">7.1. Single state testing</a></span></dt><dt><span class="sect2"><a href="#id2549304">7.2. Multi-state testing</a></span></dt><dt><span class="sect2"><a href="#HackTorbutton">7.3. Active testing (aka How to Hack Torbutton)</a></span></dt></dl></dd></dl></div><div class="sect1" title="1. Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2510984"></a>1. Introduction</h2></div></div></div><p>
3 
+<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Torbutton Design Documentation</title><meta name="generator" content="DocBook XSL Stylesheets V1.75.2" /></head><body><div class="article" title="Torbutton Design Documentation"><div class="titlepage"><div><div><h2 class="title"><a id="design"></a>Torbutton Design Documentation</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Mike</span> <span class="surname">Perry</span></h3><div class="affiliation"><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:mikeperry.fscked/org">mikeperry.fscked/org</a>&gt;</code></p></div></div></div></div><div><p class="pubdate">Apr 10 2010</p></div></div><hr /></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="#id2945584">1. Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="#adversary">1.1. Adversary Model</a></span></dt><dt><span class="sect2"><a href="#requirements">1.2. Torbutton Requirements</a></span></dt><dt><span class="sect2"><a href="#layout">1.3. Extension Layout</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2976187">2. Components</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2969623">2.1. Hooked Components</a></span></dt><dt><span class="sect2"><a href="#id2952263">2.2. New Components</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2962049">3. Chrome</a></span></dt><dd><dl><dt><span class="sect2"><a href="#browseroverlay">3.1. Browser Overlay - torbutton.xul</a></span></dt><dt><span class="sect2"><a href="#id2941767">3.2. Preferences Window - preferences.xul</a></span></dt><dt><span class="sect2"><a href="#id2976170">3.3. Other Windows</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2977751">4. Toggle Code Path</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2944154">4.1. Button Click</a></span></dt><dt><span class="sect2"><a href="#id2978704">4.2. Proxy Update</a></span></dt><dt><span class="sect2"><a href="#id2945348">4.3. Settings Update</a></span></dt></dl></dd><dt><span class="sect1"><a href="#id2966553">5. Description of Options</a></span></dt><dd><dl><dt><span class="sect2"><a href="#id2948284">5.1. Test Settings</a></span></dt><dt><span class="sect2"><a href="#plugins">5.2. Disable plugins on Tor Usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2965289">5.3. Isolate Dynamic Content to Tor State (crucial)</a></span></dt><dt><span class="sect2"><a href="#jshooks">5.4. Hook Dangerous Javascript</a></span></dt><dt><span class="sect2"><a href="#id2964952">5.5. Resize windows to multiples of 50px during Tor usage (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2977086">5.6. Disable Updates During Tor</a></span></dt><dt><span class="sect2"><a href="#id2937206">5.7. Redirect Torbutton Updates Via Tor (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2937250">5.8. Disable Search Suggestions during Tor (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2937289">5.9. Disable livemarks updates during Tor usage (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2937361">5.10. Block Tor/Non-Tor access to network from file:// urls (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2937433">5.11. Close all Tor/Non-Tor tabs and windows on toggle (optional)</a></span></dt><dt><span class="sect2"><a href="#id2937514">5.12. Isolate Access to History navigation to Tor state (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2937598">5.13. History Access Settings</a></span></dt><dt><span class="sect2"><a href="#id2937711">5.14. Clear History During Tor Toggle (optional)</a></span></dt><dt><span class="sect2"><a href="#id2979251">5.15. Block Password+Form saving during Tor/Non-Tor</a></span></dt><dt><span class="sect2"><a href="#id2979312">5.16. Block Tor disk cache and clear all cache on Tor Toggle</a></span></dt><dt><span class="sect2"><a href="#id2979362">5.17. Block disk and memory cache during Tor</a></span></dt><dt><span class="sect2"><a href="#id2979414">5.18. Clear Cookies on Tor Toggle</a></span></dt><dt><span class="sect2"><a href="#id2979465">5.19. Store Non-Tor cookies in a protected jar</a></span></dt><dt><span class="sect2"><a href="#id2979522">5.20. Store both Non-Tor and Tor cookies in a protected jar (dangerous)</a></span></dt><dt><span class="sect2"><a href="#id2979560">5.21. Manage My Own Cookies (dangerous)</a></span></dt><dt><span class="sect2"><a href="#id2979576">5.22. Disable DOM Storage during Tor usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2979679">5.23. Clear HTTP Auth on Tor Toggle (recommended)</a></span></dt><dt><span class="sect2"><a href="#id2979717">5.24. Clear cookies on Tor/Non-Tor shutdown</a></span></dt><dt><span class="sect2"><a href="#id2979772">5.25. Reload cookie jar/clear cookies on Firefox crash</a></span></dt><dt><span class="sect2"><a href="#id2979847">5.26. On crash recovery or session restored startup, restore via: Tor, Non-Tor</a></span></dt><dt><span class="sect2"><a href="#id2979919">5.27. On normal startup, set state to: Tor, Non-Tor, Shutdown State</a></span></dt><dt><span class="sect2"><a href="#id2979978">5.28. Prevent session store from saving Non-Tor/Tor-loaded tabs</a></span></dt><dt><span class="sect2"><a href="#id2980042">5.29. Set user agent during Tor usage (crucial)</a></span></dt><dt><span class="sect2"><a href="#id2980217">5.30. Spoof US English Browser</a></span></dt><dt><span class="sect2"><a href="#id2980310">5.31. Don't send referrer during Tor Usage</a></span></dt><dt><span class="sect2"><a href="#id2980350">5.32. Strip platform and language off of Google Search Box queries</a></span></dt><dt><span class="sect2"><a href="#id2980391">5.33. Automatically use an alternate search engine when presented with a
4 
+Google Captcha</a></span></dt><dt><span class="sect2"><a href="#id2980471">5.34. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)</a></span></dt></dl></dd><dt><span class="sect1"><a href="#FirefoxBugs">6. Relevant Firefox Bugs</a></span></dt><dd><dl><dt><span class="sect2"><a href="#FirefoxSecurity">6.1. Bugs impacting security</a></span></dt><dt><span class="sect2"><a href="#FirefoxWishlist">6.2. Bugs blocking functionality</a></span></dt><dt><span class="sect2"><a href="#FirefoxMiscBugs">6.3. Low Priority Bugs</a></span></dt></dl></dd><dt><span class="sect1"><a href="#TestPlan">7. Testing</a></span></dt><dd><dl><dt><span class="sect2"><a href="#SingleStateTesting">7.1. Single state testing</a></span></dt><dt><span class="sect2"><a href="#id2981478">7.2. Multi-state testing</a></span></dt><dt><span class="sect2"><a href="#HackTorbutton">7.3. Active testing (aka How to Hack Torbutton)</a></span></dt></dl></dd></dl></div><div class="sect1" title="1. Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2945584"></a>1. Introduction</h2></div></div></div><p>
4 5
5 6 
 This document describes the goals, operation, and testing procedures of the
6 
-Torbutton Firefox extension. It is current as of Torbutton 1.2.4.
7 
+Torbutton Firefox extension. It is current as of Torbutton 1.2.5.
7 8
8 9 
   </p><div class="sect2" title="1.1. Adversary Model"><div class="titlepage"><div><div><h3 class="title"><a id="adversary"></a>1.1. Adversary Model</h3></div></div></div><p>
9 10
... ... 
@@ -231,13 +232,13 @@ obsolete and deprecated interfaces and has proved to be less than
231 232 
 stable.</p><p>'Chrome' is a combination of XML and Javascript used to describe a window.
232 233 
 Extensions are allowed to create 'overlays' that are 'bound' to existing XML
233 234 
 window definitions, or they can create their own windows. The DTD for this XML
234 
-is called <a class="ulink" href="http://developer.mozilla.org/en/docs/XUL_Reference" target="_top">XUL</a>.</p></div></div><div class="sect1" title="2. Components"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2541734"></a>2. Components</h2></div></div></div><p>
235 
+is called <a class="ulink" href="http://developer.mozilla.org/en/docs/XUL_Reference" target="_top">XUL</a>.</p></div></div><div class="sect1" title="2. Components"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2976187"></a>2. Components</h2></div></div></div><p>
235 236
236 237 
 Torbutton installs components for two purposes: hooking existing components to
237 238 
 reimplement their interfaces; and creating new components that provide
238 239 
 services to other pieces of the extension.
239 240
240 
-  </p><div class="sect2" title="2.1. Hooked Components"><div class="titlepage"><div><div><h3 class="title"><a id="id2509118"></a>2.1. Hooked Components</h3></div></div></div><p>Torbutton makes extensive use of Contract ID hooking, and implements some
241 
+  </p><div class="sect2" title="2.1. Hooked Components"><div class="titlepage"><div><div><h3 class="title"><a id="id2969623"></a>2.1. Hooked Components</h3></div></div></div><p>Torbutton makes extensive use of Contract ID hooking, and implements some
241 242 
 of its own standalone components as well.  Let's discuss the hooked components
242 243 
 first.</p><div class="sect3" title="@mozilla.org/browser/sessionstore;1 - components/nsSessionStore36.js"><div class="titlepage"><div><div><h4 class="title"><a id="sessionstore"></a><a class="ulink" href="http://developer.mozilla.org/en/docs/nsISessionStore" target="_top">@mozilla.org/browser/sessionstore;1</a> -
243 244 
 <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/nsSessionStore36.js" target="_top">components/nsSessionStore36.js</a></h4></div></div></div><p>These components address the <a class="link" href="#disk">Disk Avoidance</a>
... ... 
@@ -266,7 +267,7 @@ do not obey proxy settings, they can be manipulated to automatically connect
266 267 
 back to arbitrary servers outside of Tor with no user intervention. Fixing
267 268 
 this issue helps to satisfy Torbutton's <a class="link" href="#proxy">Proxy
268 269 
 Obedience</a> Requirement.
269 
- </p></div><div class="sect3" title="@mozilla.org/browser/sessionstartup;1 - components/crash-observer.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2523615"></a><a class="ulink" href="http://lxr.mozilla.org/seamonkey/source/browser/components/sessionstore/src/nsSessionStartup.js" target="_top">@mozilla.org/browser/sessionstartup;1</a> -
270 
+ </p></div><div class="sect3" title="@mozilla.org/browser/sessionstartup;1 - components/crash-observer.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2962061"></a><a class="ulink" href="http://lxr.mozilla.org/seamonkey/source/browser/components/sessionstore/src/nsSessionStartup.js" target="_top">@mozilla.org/browser/sessionstartup;1</a> -
270 271 
     <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/crash-observer.js" target="_top">components/crash-observer.js</a></h4></div></div></div><p>This component wraps the Firefox Session Startup component that is in
271 272 
 charge of <a class="ulink" href="http://developer.mozilla.org/en/docs/Session_store_API" target="_top">restoring saved
272 273 
 sessions</a>. The wrapper's only job is to intercept the
... ... 
@@ -280,7 +281,7 @@ includes setting the Tor state to the one the user selected for crash recovery
280 281 
 in the preferences window (<span class="command"><strong>extensions.torbutton.restore_tor</strong></span>), and
281 282 
 restoring cookies for the corresponding cookie jar, if it exists.</p><p>By performing this notification, this component assists in the
282 283 
 <a class="link" href="#proxy">Proxy Obedience</a>, and <a class="link" href="#isolation">Network Isolation</a> requirements.
283 
-</p></div><div class="sect3" title="@mozilla.org/browser/global-history;2 - components/ignore-history.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2535078"></a><a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/browser/global-history;2" target="_top">@mozilla.org/browser/global-history;2</a>
284 
+</p></div><div class="sect3" title="@mozilla.org/browser/global-history;2 - components/ignore-history.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2970544"></a><a class="ulink" href="http://www.oxymoronical.com/experiments/xpcomref/applications/Firefox/3.5/components/%40mozilla.org/browser/global-history;2" target="_top">@mozilla.org/browser/global-history;2</a>
284 285 
 - <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/ignore-history.js" target="_top">components/ignore-history.js</a></h4></div></div></div><p>This component was contributed by <a class="ulink" href="http://www.collinjackson.com/" target="_top">Collin Jackson</a> as a method for defeating
285 286 
 CSS and Javascript-based methods of history disclosure. The global-history
286 287 
 component is what is used by Firefox to determine if a link was visited or not
... ... 
@@ -305,9 +306,9 @@ firing in the event the browser starts in Tor mode.
305 306 
 This component helps satisfy the <a class="link" href="#isolation">Network
306 307 
 Isolation</a> and <a class="link" href="#setpreservation">Anonymity Set
307 308 
 Preservation</a> requirements.
308 
-</p></div></div><div class="sect2" title="2.2. New Components"><div class="titlepage"><div><div><h3 class="title"><a id="id2513073"></a>2.2. New Components</h3></div></div></div><p>Torbutton creates four new components that are used throughout the
309 
+</p></div></div><div class="sect2" title="2.2. New Components"><div class="titlepage"><div><div><h3 class="title"><a id="id2952263"></a>2.2. New Components</h3></div></div></div><p>Torbutton creates four new components that are used throughout the
309 310 
 extension. These components do not hook any interfaces, nor are they used
310 
-anywhere besides Torbutton itself.</p><div class="sect3" title="@torproject.org/cookie-jar-selector;2 - components/cookie-jar-selector.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2541606"></a><a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-jar-selector.js" target="_top">@torproject.org/cookie-jar-selector;2
311 
+anywhere besides Torbutton itself.</p><div class="sect3" title="@torproject.org/cookie-jar-selector;2 - components/cookie-jar-selector.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2952530"></a><a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-jar-selector.js" target="_top">@torproject.org/cookie-jar-selector;2
311 312 
 - components/cookie-jar-selector.js</a></h4></div></div></div><p>The cookie jar selector (also based on code from <a class="ulink" href="http://www.collinjackson.com/" target="_top">Collin
312 313 
 Jackson</a>) is used by the Torbutton chrome to switch between
313 314 
 Tor and Non-Tor cookies. Its operations are simple: sync cookies to disk, then
... ... 
@@ -316,7 +317,7 @@ move the current cookies.txt file to the appropriate backup location
316 317 
 into place.</p><p>
317 318 
 This component helps to address the <a class="link" href="#state">State
318 319 
 Isolation</a> requirement of Torbutton.
319 
-</p></div><div class="sect3" title="@torproject.org/torbutton-logger;1 - components/torbutton-logger.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2528340"></a><a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/torbutton-logger.js" target="_top">@torproject.org/torbutton-logger;1
320 
+</p></div><div class="sect3" title="@torproject.org/torbutton-logger;1 - components/torbutton-logger.js"><div class="titlepage"><div><div><h4 class="title"><a id="id2965661"></a><a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/torbutton-logger.js" target="_top">@torproject.org/torbutton-logger;1
320 321 
 - components/torbutton-logger.js</a></h4></div></div></div><p>The torbutton logger component allows on-the-fly redirection of torbutton
321 322 
 logging messages to either Firefox stderr
322 323 
 (<span class="command"><strong>extensions.torbutton.logmethod=0</strong></span>), the Javascript error console
... ... 
@@ -368,7 +369,7 @@ reason are not passed to the Firefox content policy itself (see Firefox Bugs
368 369 
 </p><p>
369 370
370 371 
 This helps to fulfill both the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> and the <a class="link" href="#undiscoverability">Tor Undiscoverability</a> requirements of
371 
-Torbutton.</p></div></div></div><div class="sect1" title="3. Chrome"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2511168"></a>3. Chrome</h2></div></div></div><p>The chrome is where all the torbutton graphical elements and windows are
372 
+Torbutton.</p></div></div></div><div class="sect1" title="3. Chrome"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2962049"></a>3. Chrome</h2></div></div></div><p>The chrome is where all the torbutton graphical elements and windows are
372 373 
 located. Each window is described as an <a class="ulink" href="http://developer.mozilla.org/en/docs/XUL_Reference" target="_top">XML file</a>, with zero or more Javascript
373 374 
 files attached. The scope of these Javascript files is their containing
374 375 
 window.</p><div class="sect2" title="3.1. Browser Overlay - torbutton.xul"><div class="titlepage"><div><div><h3 class="title"><a id="browseroverlay"></a>3.1. Browser Overlay - <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/torbutton.xul" target="_top">torbutton.xul</a></h3></div></div></div><p>The browser overlay, torbutton.xul, defines the toolbar button, the status
... ... 
@@ -495,9 +496,9 @@ enabled. This helps Torbutton fulfill its <a class="link" href="#disk">Disk
495 496 
 Avoidance</a> and <a class="link" href="#state">State Separation</a>
496 497 
 requirements.
497 498
498 
-   </p></li></ol></div></div><div class="sect2" title="3.2. Preferences Window - preferences.xul"><div class="titlepage"><div><div><h3 class="title"><a id="id2521151"></a>3.2. Preferences Window - <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/preferences.xul" target="_top">preferences.xul</a></h3></div></div></div><p>The preferences window of course lays out the Torbutton preferences, with
499 
-handlers located in <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/preferences.js" target="_top">chrome/content/preferences.js</a>.</p></div><div class="sect2" title="3.3. Other Windows"><div class="titlepage"><div><div><h3 class="title"><a id="id2524897"></a>3.3. Other Windows</h3></div></div></div><p>There are additional windows that describe popups for right clicking on
500 
-the status bar, the toolbutton, and the about page.</p></div></div><div class="sect1" title="4. Toggle Code Path"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2538737"></a>4. Toggle Code Path</h2></div></div></div><p>
499 
+   </p></li></ol></div></div><div class="sect2" title="3.2. Preferences Window - preferences.xul"><div class="titlepage"><div><div><h3 class="title"><a id="id2941767"></a>3.2. Preferences Window - <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/preferences.xul" target="_top">preferences.xul</a></h3></div></div></div><p>The preferences window of course lays out the Torbutton preferences, with
500 
+handlers located in <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/preferences.js" target="_top">chrome/content/preferences.js</a>.</p></div><div class="sect2" title="3.3. Other Windows"><div class="titlepage"><div><div><h3 class="title"><a id="id2976170"></a>3.3. Other Windows</h3></div></div></div><p>There are additional windows that describe popups for right clicking on
501 
+the status bar, the toolbutton, and the about page.</p></div></div><div class="sect1" title="4. Toggle Code Path"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2977751"></a>4. Toggle Code Path</h2></div></div></div><p>
501 502
502 503 
 The act of toggling is connected to <code class="function">torbutton_toggle()</code>
503 504 
 via the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/chrome/content/torbutton.xul" target="_top">torbutton.xul</a>
... ... 
@@ -518,7 +519,7 @@ conditions and leakage, especially with <a class="ulink" href="https://bugzilla.
518 519 
 409737</a> unfixed. The content policy does not allow any network activity
519 520 
 whatsoever during this three stage transition.
520 521
521 
- </p><div class="sect2" title="4.1. Button Click"><div class="titlepage"><div><div><h3 class="title"><a id="id2519814"></a>4.1. Button Click</h3></div></div></div><p>
522 
+ </p><div class="sect2" title="4.1. Button Click"><div class="titlepage"><div><div><h3 class="title"><a id="id2944154"></a>4.1. Button Click</h3></div></div></div><p>
522 523
523 524 
 This is the first step in the toggling process. When the user clicks the
524 525 
 toggle button or the toolbar, <code class="function">torbutton_toggle()</code> is
... ... 
@@ -531,7 +532,7 @@ observer</a>
531 532 
 <span class="command"><strong>torbutton_unique_pref_observer</strong></span> to perform the rest of the
532 533 
 toggle.
533 534
534 
-  </p></div><div class="sect2" title="4.2. Proxy Update"><div class="titlepage"><div><div><h3 class="title"><a id="id2519526"></a>4.2. Proxy Update</h3></div></div></div><p>
535 
+  </p></div><div class="sect2" title="4.2. Proxy Update"><div class="titlepage"><div><div><h3 class="title"><a id="id2978704"></a>4.2. Proxy Update</h3></div></div></div><p>
535 536
536 537 
 When Torbutton receives any proxy change notifications via its
537 538 
 <span class="command"><strong>torbutton_unique_pref_observer</strong></span>, it calls
... ... 
@@ -546,7 +547,7 @@ value. This is decoupled from the button click functionalty via the pref
546 547 
 observer so that other addons (such as SwitchProxy) can switch the proxy
547 548 
 settings between multiple proxies.
548 549
549 
-  </p></div><div class="sect2" title="4.3. Settings Update"><div class="titlepage"><div><div><h3 class="title"><a id="id2504564"></a>4.3. Settings Update</h3></div></div></div><p>
550 
+  </p></div><div class="sect2" title="4.3. Settings Update"><div class="titlepage"><div><div><h3 class="title"><a id="id2945348"></a>4.3. Settings Update</h3></div></div></div><p>
550 551
551 552 
 The next stage is also handled by
552 553 
 <code class="function">torbutton_update_status()</code>. This function sets scores of
... ... 
@@ -557,10 +558,10 @@ end of its work, it sets
557 558 
 <span class="command"><strong>extensions.torbutton.settings_applied</strong></span>, which signifies the
558 559 
 completion of the toggle operation to the <a class="link" href="#contentpolicy" title="@torproject.org/cssblocker;1 - components/cssblocker.js">content policy</a>.
559 560
560 
-  </p></div></div><div class="sect1" title="5. Description of Options"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2519462"></a>5. Description of Options</h2></div></div></div><p>This section provides a detailed description of Torbutton's options. Each
561 
+  </p></div></div><div class="sect1" title="5. Description of Options"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2966553"></a>5. Description of Options</h2></div></div></div><p>This section provides a detailed description of Torbutton's options. Each
561 562 
 option is presented as the string from the preferences window, a summary, the
562 563 
 preferences it touches, and the effect this has on the components, chrome, and
563 
-browser properties.</p><div class="sect2" title="5.1. Test Settings"><div class="titlepage"><div><div><h3 class="title"><a id="id2542642"></a>5.1. Test Settings</h3></div></div></div><p>
564 
+browser properties.</p><div class="sect2" title="5.1. Test Settings"><div class="titlepage"><div><div><h3 class="title"><a id="id2948284"></a>5.1. Test Settings</h3></div></div></div><p>
564 565 
 This button under the Proxy Settings tab provides a way to verify that the
565 566 
 proxy settings are correct, and actually do route through the Tor network. It
566 567 
 performs this check by issuing an <a class="ulink" href="http://developer.mozilla.org/en/docs/XMLHttpRequest" target="_top">XMLHTTPRequest</a>
... ... 
@@ -619,7 +620,7 @@ all this and the plugin managed to find some way to load.
619 620 
 Since most plugins completely ignore browser proxy settings, the actions
620 621 
 performed by this setting are crucial to satisfying the <a class="link" href="#proxy">Proxy Obedience</a> requirement.
621 622
622 
- </p></div><div class="sect2" title="5.3. Isolate Dynamic Content to Tor State (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2536168"></a>5.3. Isolate Dynamic Content to Tor State (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.isolate_content</strong></span></p><p>Enabling this preference is what enables the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cssblocker.js" target="_top">@torproject.org/cssblocker;1</a> content policy
623 
+ </p></div><div class="sect2" title="5.3. Isolate Dynamic Content to Tor State (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2965289"></a>5.3. Isolate Dynamic Content to Tor State (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.isolate_content</strong></span></p><p>Enabling this preference is what enables the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cssblocker.js" target="_top">@torproject.org/cssblocker;1</a> content policy
623 624 
 mentioned above, and causes it to block content load attempts in pages an
624 625 
 opposite Tor state from the current state. Freshly loaded <a class="ulink" href="https://developer.mozilla.org/en/XUL/tabbrowser" target="_top">browser
625 626 
 tabs</a> are tagged
... ... 
@@ -667,11 +668,11 @@ meet the <a class="link" href="#setpreservation">Anonymity Set Preservation</a>
667 668 
 requirements. Unfortunately, Gregory Fleischer discovered it is still possible
668 669 
 to retrieve the original screen values by using <a class="ulink" href="http://pseudo-flaw.net/tor/torbutton/unmask-sandbox-xpcnativewrapper.html" target="_top">XPCNativeWrapper</a>
669 670 
 or <a class="ulink" href="http://pseudo-flaw.net/tor/torbutton/unmask-components-lookupmethod.html" target="_top">Components.lookupMethod</a>.
670 
-We are still looking for a workaround as of Torbutton 1.2.4.
671 
+We are still looking for a workaround as of Torbutton 1.2.5.
671 672
672 673
673 674
674 
-</p></div><div class="sect2" title="5.5. Resize windows to multiples of 50px during Tor usage (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2530601"></a>5.5. Resize windows to multiples of 50px during Tor usage (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.resize_windows</strong></span></p><p>
675 
+</p></div><div class="sect2" title="5.5. Resize windows to multiples of 50px during Tor usage (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2964952"></a>5.5. Resize windows to multiples of 50px during Tor usage (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.resize_windows</strong></span></p><p>
675 676
676 677 
 This option drastically cuts down on the number of distinct anonymity sets
677 678 
 that divide the Tor web userbase. Without this setting, the dimensions for a
... ... 
@@ -706,7 +707,7 @@ infer toolbar size/presence by the distance to the nearest 50 pixel roundoff).
706 707
707 708 
 </p><p>
708 709 
 This setting helps to meet the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> requirements.
709 
-</p></div><div class="sect2" title="5.6. Disable Updates During Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2513266"></a>5.6. Disable Updates During Tor</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_updates</strong></span></p><p>This setting causes Torbutton to disable the four <a class="ulink" href="http://wiki.mozilla.org/Update:Users/Checking_For_Updates#Preference_Controls_and_State" target="_top">Firefox
710 
+</p></div><div class="sect2" title="5.6. Disable Updates During Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2977086"></a>5.6. Disable Updates During Tor</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_updates</strong></span></p><p>This setting causes Torbutton to disable the four <a class="ulink" href="http://wiki.mozilla.org/Update:Users/Checking_For_Updates#Preference_Controls_and_State" target="_top">Firefox
710 711 
 update settings</a> during Tor
711 712 
   usage: <span class="command"><strong>extensions.update.enabled</strong></span>,
712 713 
 <span class="command"><strong>app.update.enabled</strong></span>,
... ... 
@@ -716,7 +717,16 @@ update settings</a> during Tor
716 717 
   checking for search plugin updates while Tor is enabled.
717 718 
   </p><p>
718 719 
 This setting satisfies the <a class="link" href="#updates">Update Safety</a> requirement.
719 
-</p></div><div class="sect2" title="5.7. Disable Search Suggestions during Tor (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2505201"></a>5.7. Disable Search Suggestions during Tor (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_search</strong></span></p><p>
720 
+</p></div><div class="sect2" title="5.7. Redirect Torbutton Updates Via Tor (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2937206"></a>5.7. Redirect Torbutton Updates Via Tor (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.update_torbutton_via_tor</strong></span></p><p>This setting causes Torbutton to install an
721 
+
722 
+<a class="ulink" href="https://developer.mozilla.org/en/nsIProtocolProxyFilter" target="_top">nsIProtocolProxyFilter</a>
723 
+in order to redirect all version update checks and Torbutton update downloads
724 
+via Tor, regardless of if Tor is enabled or not. This was done both to address
725 
+concerns about data retention done by <a class="ulink" href="https://www.addons.mozilla.org" target="_top">addons.mozilla.org</a>, as well as to
726 
+help censored users meet the <a class="link" href="#undiscoverability">Tor
727 
+Undiscoverability</a> requirement.
728 
+
729 
+  </p></div><div class="sect2" title="5.8. Disable Search Suggestions during Tor (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2937250"></a>5.8. Disable Search Suggestions during Tor (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.no_search</strong></span></p><p>
720 730 
 This setting causes Torbutton to disable <a class="ulink" href="http://kb.mozillazine.org/Browser.search.suggest.enabled" target="_top"><span class="command"><strong>browser.search.suggest.enabled</strong></span></a>
721 731 
 during Tor usage.
722 732 
 This governs if you get Google search suggestions during Tor
... ... 
@@ -727,7 +737,7 @@ this is recommended to be disabled.
727 737 
 While this setting doesn't satisfy any Torbutton requirements, the fact that
728 738 
 cookies are transmitted for partially typed queries does not seem desirable
729 739 
 for Tor usage.
730 
-</p></div><div class="sect2" title="5.8. Disable livemarks updates during Tor usage (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2505239"></a>5.8. Disable livemarks updates during Tor usage (recommended)</h3></div></div></div><p>Option:
740 
+</p></div><div class="sect2" title="5.9. Disable livemarks updates during Tor usage (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2937289"></a>5.9. Disable livemarks updates during Tor usage (recommended)</h3></div></div></div><p>Option:
731 741 
    </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.disable_livemarks</strong></span></td></tr></table><p>
732 742 
   </p><p>
733 743 
 This option causes Torbutton to prevent Firefox from loading <a class="ulink" href="http://www.mozilla.com/firefox/livebookmarks.html" target="_top">Livemarks</a> during
... ... 
@@ -741,7 +751,7 @@ service</a> when Tor is enabled.
741 751 
 This helps satisfy the <a class="link" href="#isolation">Network
742 752 
 Isolation</a> and <a class="link" href="#setpreservation">Anonymity Set
743 753 
 Preservation</a> requirements.
744 
-</p></div><div class="sect2" title="5.9. Block Tor/Non-Tor access to network from file:// urls (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2505311"></a>5.9. Block Tor/Non-Tor access to network from file:// urls (recommended)</h3></div></div></div><p>Options:
754 
+</p></div><div class="sect2" title="5.10. Block Tor/Non-Tor access to network from file:// urls (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2937361"></a>5.10. Block Tor/Non-Tor access to network from file:// urls (recommended)</h3></div></div></div><p>Options:
745 755 
    </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.block_tor_file_net</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_nontor_file_net</strong></span></td></tr></table><p>
746 756 
   </p><p>
747 757
... ... 
@@ -761,7 +771,7 @@ Isolation</a> requirement, by preventing file urls from executing network
761 771 
 operations in opposite Tor states. Also, allowing pages to submit arbitrary
762 772 
 files to arbitrary sites just generally seems like a bad idea.
763 773
764 
-</p></div><div class="sect2" title="5.10. Close all Tor/Non-Tor tabs and windows on toggle (optional)"><div class="titlepage"><div><div><h3 class="title"><a id="id2505383"></a>5.10. Close all Tor/Non-Tor tabs and windows on toggle (optional)</h3></div></div></div><p>Options:
774 
+</p></div><div class="sect2" title="5.11. Close all Tor/Non-Tor tabs and windows on toggle (optional)"><div class="titlepage"><div><div><h3 class="title"><a id="id2937433"></a>5.11. Close all Tor/Non-Tor tabs and windows on toggle (optional)</h3></div></div></div><p>Options:
765 775 
    </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.close_nontor</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.close_tor</strong></span></td></tr></table><p>
766 776 
   </p><p>
767 777
... ... 
@@ -785,7 +795,7 @@ out longer than necessary.
785 795 
 While this setting doesn't satisfy any Torbutton requirements, the fact that
786 796 
 cookies are transmitted for partially typed queries does not seem desirable
787 797 
 for Tor usage.
788 
-</p></div><div class="sect2" title="5.11. Isolate Access to History navigation to Tor state (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2505464"></a>5.11. Isolate Access to History navigation to Tor state (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.block_js_history</strong></span></p><p>
798 
+</p></div><div class="sect2" title="5.12. Isolate Access to History navigation to Tor state (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2937514"></a>5.12. Isolate Access to History navigation to Tor state (crucial)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.block_js_history</strong></span></p><p>
789 799 
 This setting determines if Torbutton installs an <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsISHistoryListener" target="_top">nsISHistoryListener</a>
790 800 
 attached to the <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsISHistory" target="_top">sessionHistory</a> of
791 801 
 of each browser's <a class="ulink" href="https://developer.mozilla.org/en/XUL%3aProperty%3awebNavigation" target="_top">webNavigatator</a>.
... ... 
@@ -813,7 +823,7 @@ This setting helps to fulfill Torbutton's <a class="link" href="#state">State
813 823 
 Separation</a> and (until Bug 409737 is fixed) <a class="link" href="#isolation">Network Isolation</a>
814 824 
 requirements.
815 825
816 
-   </p></div><div class="sect2" title="5.12. History Access Settings"><div class="titlepage"><div><div><h3 class="title"><a id="id2505548"></a>5.12. History Access Settings</h3></div></div></div><p>Options:
826 
+   </p></div><div class="sect2" title="5.13. History Access Settings"><div class="titlepage"><div><div><h3 class="title"><a id="id2937598"></a>5.13. History Access Settings</h3></div></div></div><p>Options:
817 827 
   </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.block_thread</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_nthread</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_thwrite</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_nthwrite</strong></span></td></tr></table><p>
818 828 
   </p><p>These four settings govern the behavior of the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/ignore-history.js" target="_top">components/ignore-history.js</a>
819 829 
 history blocker component mentioned above. By hooking the browser's view of
... ... 
@@ -828,12 +838,12 @@ Database</a> and the older Firefox 2 mechanisms.
828 838
829 839 
 </p><p>
830 840 
 This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements.
831 
-</p></div><div class="sect2" title="5.13. Clear History During Tor Toggle (optional)"><div class="titlepage"><div><div><h3 class="title"><a id="id2505661"></a>5.13. Clear History During Tor Toggle (optional)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_history</strong></span></p><p>This setting governs if Torbutton calls
841 
+</p></div><div class="sect2" title="5.14. Clear History During Tor Toggle (optional)"><div class="titlepage"><div><div><h3 class="title"><a id="id2937711"></a>5.14. Clear History During Tor Toggle (optional)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_history</strong></span></p><p>This setting governs if Torbutton calls
832 842 
 <a class="ulink" href="https://developer.mozilla.org/en/nsIBrowserHistory#removeAllPages.28.29" target="_top">nsIBrowserHistory.removeAllPages</a>
833 843 
 and <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsISHistory" target="_top">nsISHistory.PurgeHistory</a>
834 844 
 for each tab on Tor toggle.</p><p>
835 845 
 This setting is an optional way to help satisfy the <a class="link" href="#state">State Separation</a> requirement.
836 
-</p></div><div class="sect2" title="5.14. Block Password+Form saving during Tor/Non-Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2505706"></a>5.14. Block Password+Form saving during Tor/Non-Tor</h3></div></div></div><p>Options:
846 
+</p></div><div class="sect2" title="5.15. Block Password+Form saving during Tor/Non-Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2979251"></a>5.15. Block Password+Form saving during Tor/Non-Tor</h3></div></div></div><p>Options:
837 847 
   </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.block_tforms</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.block_ntforms</strong></span></td></tr></table><p>
838 848 
   </p><p>These settings govern if Torbutton disables
839 849 
 <span class="command"><strong>browser.formfill.enable</strong></span>
... ... 
@@ -842,19 +852,19 @@ Since form fields can be read at any time by Javascript, this setting is a lot
842 852 
 more important than it seems.
843 853 
 </p><p>
844 854 
 This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements.
845 
-</p></div><div class="sect2" title="5.15. Block Tor disk cache and clear all cache on Tor Toggle"><div class="titlepage"><div><div><h3 class="title"><a id="id2547259"></a>5.15. Block Tor disk cache and clear all cache on Tor Toggle</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_cache</strong></span>
855 
+</p></div><div class="sect2" title="5.16. Block Tor disk cache and clear all cache on Tor Toggle"><div class="titlepage"><div><div><h3 class="title"><a id="id2979312"></a>5.16. Block Tor disk cache and clear all cache on Tor Toggle</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_cache</strong></span>
846 856 
   </p><p>This option causes Torbutton to call <a class="ulink" href="https://developer.mozilla.org/en/nsICacheService#evictEntries.28.29" target="_top">nsICacheService.evictEntries(0)</a>
847 857 
 on Tor toggle to remove all entries from the cache. In addition, this setting
848 858 
 causes Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Browser.cache.disk.enable" target="_top">browser.cache.disk.enable</a> to false.
849 859 
 </p><p>
850 860 
 This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements.
851 
-</p></div><div class="sect2" title="5.16. Block disk and memory cache during Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2547309"></a>5.16. Block disk and memory cache during Tor</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.block_cache</strong></span></p><p>This setting
861 
+</p></div><div class="sect2" title="5.17. Block disk and memory cache during Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2979362"></a>5.17. Block disk and memory cache during Tor</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.block_cache</strong></span></p><p>This setting
852 862 
 causes Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Browser.cache.memory.enable" target="_top">browser.cache.memory.enable</a>,
853 863 
 <a class="ulink" href="http://kb.mozillazine.org/Browser.cache.disk.enable" target="_top">browser.cache.disk.enable</a> and
854 864 
 <a class="ulink" href="http://kb.mozillazine.org/Network.http.use-cache" target="_top">network.http.use-cache</a> to false during tor usage.
855 865 
 </p><p>
856 866 
 This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements.
857 
-</p></div><div class="sect2" title="5.17. Clear Cookies on Tor Toggle"><div class="titlepage"><div><div><h3 class="title"><a id="id2547362"></a>5.17. Clear Cookies on Tor Toggle</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_cookies</strong></span>
867 
+</p></div><div class="sect2" title="5.18. Clear Cookies on Tor Toggle"><div class="titlepage"><div><div><h3 class="title"><a id="id2979414"></a>5.18. Clear Cookies on Tor Toggle</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_cookies</strong></span>
858 868 
   </p><p>
859 869
860 870 
 This setting causes Torbutton to call <a class="ulink" href="https://developer.mozilla.org/en/nsICookieManager#removeAll.28.29" target="_top">nsICookieManager.removeAll()</a> on
... ... 
@@ -864,7 +874,7 @@ which prevents them from being written to disk.
864 874
865 875 
 </p><p>
866 876 
 This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements.
867 
-</p></div><div class="sect2" title="5.18. Store Non-Tor cookies in a protected jar"><div class="titlepage"><div><div><h3 class="title"><a id="id2547413"></a>5.18. Store Non-Tor cookies in a protected jar</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.cookie_jars</strong></span>
877 
+</p></div><div class="sect2" title="5.19. Store Non-Tor cookies in a protected jar"><div class="titlepage"><div><div><h3 class="title"><a id="id2979465"></a>5.19. Store Non-Tor cookies in a protected jar</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.cookie_jars</strong></span>
868 878 
   </p><p>
869 879
870 880 
 This setting causes Torbutton to use <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-jar-selector.js" target="_top">@torproject.org/cookie-jar-selector;2</a> to store
... ... 
@@ -877,15 +887,15 @@ which prevents them from being written to disk.
877 887
878 888 
 </p><p>
879 889 
 This setting helps to satisfy the <a class="link" href="#state">State Separation</a> and <a class="link" href="#disk">Disk Avoidance</a> requirements.
880 
-</p></div><div class="sect2" title="5.19. Store both Non-Tor and Tor cookies in a protected jar (dangerous)"><div class="titlepage"><div><div><h3 class="title"><a id="id2547469"></a>5.19. Store both Non-Tor and Tor cookies in a protected jar (dangerous)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.dual_cookie_jars</strong></span>
890 
+</p></div><div class="sect2" title="5.20. Store both Non-Tor and Tor cookies in a protected jar (dangerous)"><div class="titlepage"><div><div><h3 class="title"><a id="id2979522"></a>5.20. Store both Non-Tor and Tor cookies in a protected jar (dangerous)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.dual_cookie_jars</strong></span>
881 891 
   </p><p>
882 892
883 893 
 This setting causes Torbutton to use <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-jar-selector.js" target="_top">@torproject.org/cookie-jar-selector;2</a> to store
884 894 
 both Tor and Non-Tor cookies into protected jars.
885 895 
 </p><p>
886 896 
 This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement.
887 
-</p></div><div class="sect2" title="5.20. Manage My Own Cookies (dangerous)"><div class="titlepage"><div><div><h3 class="title"><a id="id2547508"></a>5.20. Manage My Own Cookies (dangerous)</h3></div></div></div><p>Options: None</p><p>This setting disables all Torbutton cookie handling by setting the above
888 
-cookie prefs all to false.</p></div><div class="sect2" title="5.21. Disable DOM Storage during Tor usage (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2547523"></a>5.21. Disable DOM Storage during Tor usage (crucial)</h3></div></div></div><div class="sect2" title="5.21.1. Do not write Tor/Non-Tor cookies to disk"><div class="titlepage"><div><div><h3 class="title"><a id="id2547525"></a>5.21.1. Do not write Tor/Non-Tor cookies to disk</h3></div></div></div><p>Options:
897 
+</p></div><div class="sect2" title="5.21. Manage My Own Cookies (dangerous)"><div class="titlepage"><div><div><h3 class="title"><a id="id2979560"></a>5.21. Manage My Own Cookies (dangerous)</h3></div></div></div><p>Options: None</p><p>This setting disables all Torbutton cookie handling by setting the above
898 
+cookie prefs all to false.</p></div><div class="sect2" title="5.22. Disable DOM Storage during Tor usage (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2979576"></a>5.22. Disable DOM Storage during Tor usage (crucial)</h3></div></div></div><div class="sect2" title="5.22.1. Do not write Tor/Non-Tor cookies to disk"><div class="titlepage"><div><div><h3 class="title"><a id="id2979578"></a>5.22.1. Do not write Tor/Non-Tor cookies to disk</h3></div></div></div><p>Options:
889 899 
   </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.tor_memory_jar</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.nontor_memory_jar</strong></span></td></tr></table><p>
890 900 
   </p><p>
891 901 
 These settings (contributed by arno) cause Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Network.cookie.lifetimePolicy" target="_top">network.cookie.lifetimePolicy</a>
... ... 
@@ -905,21 +915,21 @@ usage to prevent
905 915 
 <a class="ulink" href="http://developer.mozilla.org/en/docs/DOM:Storage" target="_top">DOM Storage</a> from
906 916 
   being used to store persistent information across Tor states.</p><p>
907 917 
 This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement.
908 
-</p></div><div class="sect2" title="5.22. Clear HTTP Auth on Tor Toggle (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2547627"></a>5.22. Clear HTTP Auth on Tor Toggle (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_http_auth</strong></span>
918 
+</p></div><div class="sect2" title="5.23. Clear HTTP Auth on Tor Toggle (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2979679"></a>5.23. Clear HTTP Auth on Tor Toggle (recommended)</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.clear_http_auth</strong></span>
909 919 
   </p><p>
910 920 
 This setting causes Torbutton to call <a class="ulink" href="http://www.oxymoronical.com/experiments/apidocs/interface/nsIHttpAuthManager" target="_top">nsIHttpAuthManager.clearAll()</a>
911 921 
 every time Tor is toggled.
912 922 
 </p><p>
913 923 
 This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement.
914 
-</p></div><div class="sect2" title="5.23. Clear cookies on Tor/Non-Tor shutdown"><div class="titlepage"><div><div><h3 class="title"><a id="id2547664"></a>5.23. Clear cookies on Tor/Non-Tor shutdown</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.shutdown_method</strong></span>
924 
+</p></div><div class="sect2" title="5.24. Clear cookies on Tor/Non-Tor shutdown"><div class="titlepage"><div><div><h3 class="title"><a id="id2979717"></a>5.24. Clear cookies on Tor/Non-Tor shutdown</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.shutdown_method</strong></span>
915 925 
   </p><p> This option variable can actually take 3 values: 0, 1, and 2. 0 means no
916 926 
 cookie clearing, 1 means clear only during Tor-enabled shutdown, and 2 means
917 927 
 clear for both Tor and Non-Tor shutdown. When set to 1 or 2, Torbutton listens
918 928 
 for the <a class="ulink" href="http://developer.mozilla.org/en/docs/Observer_Notifications#Application_shutdown" target="_top">quit-application-granted</a> event in
919 
-<code class="function">torbutton_uninstall_observer()</code> and use <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-jar-selector.js" target="_top">@torproject.org/cookie-jar-selector;2</a>
929 
+<code class="function">https://git.torproject.org/checkout/torbutton/master/src/components/crash-observer.js</code> and use <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/cookie-jar-selector.js" target="_top">@torproject.org/cookie-jar-selector;2</a>
920 930 
 to clear out all cookies and all cookie jars upon shutdown.  </p><p>
921 931 
 This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement.
922 
-</p></div><div class="sect2" title="5.24. Reload cookie jar/clear cookies on Firefox crash"><div class="titlepage"><div><div><h3 class="title"><a id="id2547718"></a>5.24. Reload cookie jar/clear cookies on Firefox crash</h3></div></div></div><p>Options:
932 
+</p></div><div class="sect2" title="5.25. Reload cookie jar/clear cookies on Firefox crash"><div class="titlepage"><div><div><h3 class="title"><a id="id2979772"></a>5.25. Reload cookie jar/clear cookies on Firefox crash</h3></div></div></div><p>Options:
923 933 
   </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.reload_crashed_jar</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.crashed</strong></span></td></tr></table><p>
924 934 
   </p><p>This is no longer a user visible option, and is enabled by default. In
925 935 
 the event of a crash, the Torbutton <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/crash-observer.js" target="_top">components/crash-observer.js</a>
... ... 
@@ -931,14 +941,14 @@ the chrome that listens for this update), and Torbutton will load the
931 941 
   component.</p><p>
932 942 
 This setting helps to satisfy the <a class="link" href="#state">State Separation</a> requirement in the event of Firefox
933 943 
 crashes.
934 
-</p></div><div class="sect2" title="5.25. On crash recovery or session restored startup, restore via: Tor, Non-Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2547794"></a>5.25. On crash recovery or session restored startup, restore via: Tor, Non-Tor</h3></div></div></div><p>Options:
944 
+</p></div><div class="sect2" title="5.26. On crash recovery or session restored startup, restore via: Tor, Non-Tor"><div class="titlepage"><div><div><h3 class="title"><a id="id2979847"></a>5.26. On crash recovery or session restored startup, restore via: Tor, Non-Tor</h3></div></div></div><p>Options:
935 945 
   </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.restore_tor</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.crashed</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.normal_exit</strong></span></td></tr></table><p>
936 946 
   </p><p>This option works with the Torbutton <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/crash-observer.js" target="_top">crash-observer.js</a>
937 947 
   to set the Tor state after a crash is detected (via the
938 948 
   <span class="command"><strong>extensions.torbutton.crashed</strong></span> pref). To confirm for
939 949 
 false positives (such as session restore failures, upgrade, normal
940 950 
 session restore, etc), Torbutton also sets the pref
941 
-extensions.torbutton.normal_exit in torbutton_uninstall_observer() during
951 
+extensions.torbutton.normal_exit during
942 952 
 Firefox exit and checks this value as well during startup.
943 953 
 </p><p>
944 954
... ... 
@@ -947,7 +957,7 @@ setting helps to satisfy the <a class="link" href="#state">State Separation</a>
947 957 
 requirement in the event of Firefox crashes by ensuring all cookies,
948 958 
 settings and saved sessions are reloaded from a fixed Tor state.
949 959
950 
-</p></div><div class="sect2" title="5.26. On normal startup, set state to: Tor, Non-Tor, Shutdown State"><div class="titlepage"><div><div><h3 class="title"><a id="id2547866"></a>5.26. On normal startup, set state to: Tor, Non-Tor, Shutdown State</h3></div></div></div><p>Options:
960 
+</p></div><div class="sect2" title="5.27. On normal startup, set state to: Tor, Non-Tor, Shutdown State"><div class="titlepage"><div><div><h3 class="title"><a id="id2979919"></a>5.27. On normal startup, set state to: Tor, Non-Tor, Shutdown State</h3></div></div></div><p>Options:
951 961 
   </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.startup_state</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.noncrashed</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.normal_exit</strong></span></td></tr></table><p>
952 962 
   </p><p>This option also works with the Torbutton <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/crash-observer.js" target="_top">crash-observer.js</a>
953 963 
   to set the Tor state after a normal startup is detected (via the
... ... 
@@ -957,7 +967,7 @@ false positives
957 967 
 extensions.torbutton.normal_exit in torbutton_uninstall_observer() during
958 968 
 Firefox exit and checks this value as well during startup.
959 969
960 
-</p></div><div class="sect2" title="5.27. Prevent session store from saving Non-Tor/Tor-loaded tabs"><div class="titlepage"><div><div><h3 class="title"><a id="id2547925"></a>5.27. Prevent session store from saving Non-Tor/Tor-loaded tabs</h3></div></div></div><p>Options:
970 
+</p></div><div class="sect2" title="5.28. Prevent session store from saving Non-Tor/Tor-loaded tabs"><div class="titlepage"><div><div><h3 class="title"><a id="id2979978"></a>5.28. Prevent session store from saving Non-Tor/Tor-loaded tabs</h3></div></div></div><p>Options:
961 971 
   </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.nonontor_sessionstore</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.notor_sessionstore</strong></span></td></tr></table><p>
962 972 
   </p><p>If these options are enabled, the <a class="ulink" href="https://git.torproject.org/checkout/torbutton/master/src/components/nsSessionStore3.js" target="_top">replacement nsSessionStore.js</a>
963 973 
   component checks the <span class="command"><strong>__tb_tor_fetched</strong></span> tag of tabs before writing them
... ... 
@@ -967,7 +977,7 @@ This setting helps to satisfy the <a class="link" href="#disk">Disk Avoidance</a
967 977 
 requirement, and also helps to satisfy the <a class="link" href="#state">State Separation</a> requirement in the event of Firefox
968 978 
 crashes.
969 979
970 
-</p></div><div class="sect2" title="5.28. Set user agent during Tor usage (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2547990"></a>5.28. Set user agent during Tor usage (crucial)</h3></div></div></div><p>Options:
980 
+</p></div><div class="sect2" title="5.29. Set user agent during Tor usage (crucial)"><div class="titlepage"><div><div><h3 class="title"><a id="id2980042"></a>5.29. Set user agent during Tor usage (crucial)</h3></div></div></div><p>Options:
971 981 
    </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.set_uagent</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.platform_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.oscpu_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.buildID_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.productsub_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.appname_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.appversion_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.useragent_override</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.useragent_vendor</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.useragent_vendorSub</strong></span></td></tr></table><p>
972 982 
    </p><p>On face, user agent switching appears to be straight-forward in Firefox.
973 983 
 It provides several options for controlling the browser user agent string:
... ... 
@@ -991,7 +1001,7 @@ certain resource:// files</a>. These cases are handled by Torbutton's
991 1001
992 1002 
 </p><p>
993 1003 
 This setting helps to satisfy the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> requirement.
994 
-</p></div><div class="sect2" title="5.29. Spoof US English Browser"><div class="titlepage"><div><div><h3 class="title"><a id="id2548164"></a>5.29. Spoof US English Browser</h3></div></div></div><p>Options:
1004 
+</p></div><div class="sect2" title="5.30. Spoof US English Browser"><div class="titlepage"><div><div><h3 class="title"><a id="id2980217"></a>5.30. Spoof US English Browser</h3></div></div></div><p>Options:
995 1005 
 </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.spoof_english</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.spoof_charset</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.spoof_language</strong></span></td></tr></table><p>
996 1006 
 </p><p> This option causes Torbutton to set
997 1007 
 <span class="command"><strong>general.useragent.locale</strong></span>
... ... 
@@ -1002,13 +1012,48 @@ This setting helps to satisfy the <a class="link" href="#setpreservation">Anonym
1002 1012 
 well as hooking <span class="command"><strong>navigator.language</strong></span> via its <a class="link" href="#jshooks" title="5.4. Hook Dangerous Javascript">javascript hooks</a>.
1003 1013 
  </p><p>
1004 1014 
 This setting helps to satisfy the <a class="link" href="#setpreservation">Anonymity Set Preservation</a> and <a class="link" href="#location">Location Neutrality</a> requirements.
1005 
-</p></div><div class="sect2" title="5.30. Don't send referrer during Tor Usage"><div class="titlepage"><div><div><h3 class="title"><a id="id2548257"></a>5.30. Don't send referrer during Tor Usage</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.disable_referer</strong></span>
1015 
+</p></div><div class="sect2" title="5.31. Don't send referrer during Tor Usage"><div class="titlepage"><div><div><h3 class="title"><a id="id2980310"></a>5.31. Don't send referrer during Tor Usage</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.disable_referer</strong></span>
1006 1016 
 </p><p>
1007 1017 
 This option causes Torbutton to set <a class="ulink" href="http://kb.mozillazine.org/Network.http.sendSecureXSiteReferrer" target="_top">network.http.sendSecureXSiteReferrer</a> and
1008 1018 
 <a class="ulink" href="http://kb.mozillazine.org/Network.http.sendRefererHeader" target="_top">network.http.sendRefererHeader</a> during Tor usage.</p><p>
1009 1019 
 This setting also does not directly satisfy any Torbutton requirement, but
1010 1020 
 some may desire to mask their referrer for general privacy concerns.
1011 
-</p></div><div class="sect2" title="5.31. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2548297"></a>5.31. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)</h3></div></div></div><p>Options:
1021 
+</p></div><div class="sect2" title="5.32. Strip platform and language off of Google Search Box queries"><div class="titlepage"><div><div><h3 class="title"><a id="id2980350"></a>5.32. Strip platform and language off of Google Search Box queries</h3></div></div></div><p>Option: <span class="command"><strong>extensions.torbutton.fix_google_srch</strong></span>
1022 
+</p><p>
1023 
+
1024 
+This option causes Torbutton to use the <a class="ulink" href="https://wiki.mozilla.org/Search_Service:API" target="_top">@mozilla.org/browser/search-service;1</a>
1025 
+component to wrap the Google search plugin. On many platforms, notably Debian
1026 
+and Ubuntu, the Google search plugin is set to reveal a lot of language and
1027 
+platform information. This setting strips off that info while Tor is enabled.
1028 
+
1029 
+</p><p>
1030 
+This setting helps Torbutton to fulfill its <a class="link" href="#setpreservation">Anonymity Set Preservation</a> requirement.
1031 
+</p></div><div class="sect2" title="5.33. Automatically use an alternate search engine when presented with a Google Captcha"><div class="titlepage"><div><div><h3 class="title"><a id="id2980391"></a>5.33. Automatically use an alternate search engine when presented with a
1032 
+Google Captcha</h3></div></div></div><p>Options:
1033 
+</p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.asked_google_captcha</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.dodge_google_captcha</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.google_redir_url</strong></span></td></tr></table><p>
1034 
+</p><p>
1035 
+
1036 
+Google's earch engine has rate limiting features that cause it to
1037 
+<a class="ulink" href="http://googleonlinesecurity.blogspot.com/2007/07/reason-behind-were-sorry-message.html" target="_top">present
1038 
+captchas</a> and sometimes even outright ban IPs that issue large numbers
1039 
+of search queries, especially if a lot of these queries appear to be searching
1040 
+for software vulnerabilities or unprotected comment areas.
1041 
+
1042 
+</p><p>
1043 
+
1044 
+Despite multiple discussions with Google, we were unable to come to a solution
1045 
+or any form of compromise that would reduce the number of captchas and
1046 
+outright bans seen by Tor users issuing regular queries.
1047 
+
1048 
+</p><p>
1049 
+As a result, we've implemented this option as an <a class="ulink" href="https://developer.mozilla.org/en/XUL_School/Intercepting_Page_Loads#HTTP_Observers" target="_top">'http-on-modify-request'</a>
1050 
+http observer to optionally redirect banned or captcha-triggering Google
1051 
+queries to search engines that do not rate limit Tor users. The current
1052 
+options are ixquick.com, bing.com, yahoo.com and scroogle.org. These are
1053 
+encoded in the preferences
1054 
+<span class="command"><strong>extensions.torbutton.redir_url.[1-4]</strong></span>.
1055 
+
1056 
+</p></div><div class="sect2" title="5.34. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)"><div class="titlepage"><div><div><h3 class="title"><a id="id2980471"></a>5.34. Store SSL/CA Certs in separate jars for Tor/Non-Tor (recommended)</h3></div></div></div><p>Options:
1012 1057 
 </p><table border="0" summary="Simple list" class="simplelist"><tr><td><span class="command"><strong>extensions.torbutton.jar_certs</strong></span></td></tr><tr><td><span class="command"><strong>extensions.torbutton.jar_ca_certs</strong></span></td></tr></table><p>
1013 1058 
 </p><p>
1014 1059
... ... 
@@ -1345,13 +1390,13 @@ or complete, but it is automated and could be turned into something useful
1345 1390 
 with a bit of work.
1346 1391
1347 1392 
        </p></li></ol></div><p>
1348 
-    </p></div><div class="sect2" title="7.2. Multi-state testing"><div class="titlepage"><div><div><h3 class="title"><a id="id2549304"></a>7.2. Multi-state testing</h3></div></div></div><p>
1393 
+    </p></div><div class="sect2" title="7.2. Multi-state testing"><div class="titlepage"><div><div><h3 class="title"><a id="id2981478"></a>7.2. Multi-state testing</h3></div></div></div><p>
1349 1394
1350 1395 
 The tests in this section are geared towards a page that would instruct the
1351 1396 
 user to toggle their Tor state after the fetch and perform some operations:
1352 1397 
 mouseovers, stray clicks, and potentially reloads.
1353 1398
1354 
-   </p><div class="sect3" title="Cookies and Cache Correlation"><div class="titlepage"><div><div><h4 class="title"><a id="id2549316"></a>Cookies and Cache Correlation</h4></div></div></div><p>
1399 
+   </p><div class="sect3" title="Cookies and Cache Correlation"><div class="titlepage"><div><div><h4 class="title"><a id="id2981490"></a>Cookies and Cache Correlation</h4></div></div></div><p>
1355 1400 
 The most obvious test is to set a cookie, ask the user to toggle tor, and then
1356 1401 
 have them reload the page. The cookie should no longer be set if they are
1357 1402 
 using the default Torbutton settings. In addition, it is possible to leverage
... ... 
@@ -1359,11 +1404,11 @@ the cache to <a class="ulink" href="http://crypto.stanford.edu/sameorigin/safeca
1359 1404 
 identifiers</a>. The default settings of Torbutton should also protect
1360 1405 
 against these from persisting across Tor Toggle.
1361 1406
1362 
-    </p></div><div class="sect3" title="Javascript timers and event handlers"><div class="titlepage"><div><div><h4 class="title"><a id="id2549339"></a>Javascript timers and event handlers</h4></div></div></div><p>
1407 
+    </p></div><div class="sect3" title="Javascript timers and event handlers"><div class="titlepage"><div><div><h4 class="title"><a id="id2981513"></a>Javascript timers and event handlers</h4></div></div></div><p>
1363 1408
1364 1409 
 Javascript can set timers and register event handlers in the hopes of fetching
1365 1410 
 URLs after the user has toggled Torbutton.
1366 
-    </p></div><div class="sect3" title="CSS Popups and non-script Dynamic Content"><div class="titlepage"><div><div><h4 class="title"><a id="id2549351"></a>CSS Popups and non-script Dynamic Content</h4></div></div></div><p>
1411 
+    </p></div><div class="sect3" title="CSS Popups and non-script Dynamic Content"><div class="titlepage"><div><div><h4 class="title"><a id="id2981526"></a>CSS Popups and non-script Dynamic Content</h4></div></div></div><p>
1367 1412
1368 1413 
 Even if Javascript is disabled, CSS is still able to
1369 1414 
 <a class="ulink" href="http://www.tjkdesign.com/articles/css%20pop%20ups/" target="_top">create popup-like
... ... 
@@ -1388,7 +1433,7 @@ these attacks, playing with them, and reporting what you find (and potentially
1388 1433 
 submitting the test cases back to be run in the standard batch of Torbutton
1389 1434 
 tests.
1390 1435
1391 
-   </p><div class="sect3" title="Some suggested vectors to investigate"><div class="titlepage"><div><div><h4 class="title"><a id="id2549406"></a>Some suggested vectors to investigate</h4></div></div></div><p>
1436 
+   </p><div class="sect3" title="Some suggested vectors to investigate"><div class="titlepage"><div><div><h4 class="title"><a id="id2981580"></a>Some suggested vectors to investigate</h4></div></div></div><p>
1392 1437 
     </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">Strange ways to register Javascript <a class="ulink" href="http://en.wikipedia.org/wiki/DOM_Events" target="_top">events</a> and <a class="ulink" href="http://www.devshed.com/c/a/JavaScript/Using-Timers-in-JavaScript/" target="_top">timeouts</a> should
1393 1438 
 be verified to actually be ineffective after Tor has been toggled.</li><li class="listitem">Other ways to cause Javascript to be executed after
1394 1439 
 <span class="command"><strong>javascript.enabled</strong></span> has been toggled off.</li><li class="listitem">Odd ways to attempt to load plugins. Kyle Williams has had
1395 1440