Re: [tor-bugs] #27271 [Applications/Tor Browser]: Don't allow the user to install extensions from web

[Tor Bug Tracker & Wiki]

#27271: Don't allow the user to install extensions from web
---+--
 Reporter:  igt0   |  Owner:  tbb-team
 Type:  defect | Status:  closed
 Priority:  Medium |  Milestone:
Component:  Applications/Tor Browser   |Version:
 Severity:  Normal | Resolution:  fixed
 Keywords:  TorBrowserTeam201808R, tbb-mobile  |  Actual Points:
Parent ID: | Points:
 Reviewer: |Sponsor:  Sponsor8
---+--
Changes (by pili):

 * sponsor:   => Sponsor8


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #27271 [Applications/Tor Browser]: Don't allow the user to install extensions from web

[Tor Bug Tracker & Wiki]

#27271: Don't allow the user to install extensions from web
---+--
 Reporter:  igt0   |  Owner:  tbb-team
 Type:  defect | Status:  closed
 Priority:  Medium |  Milestone:
Component:  Applications/Tor Browser   |Version:
 Severity:  Normal | Resolution:  fixed
 Keywords:  TorBrowserTeam201808R, tbb-mobile  |  Actual Points:
Parent ID: | Points:
 Reviewer: |Sponsor:
---+--

Comment (by gk):

 Replying to [comment:7 gk]:
 > igt0, sysrqb: could anyone of you open a follow-up ticket with a plan
 for fixing the underlying issue better. FWIW:
 https://bugzilla.mozilla.org/show_bug.cgi?id=1464766 landed in esr60 and
 might be a thing to consider here.

 I opened #27762 for that.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #27271 [Applications/Tor Browser]: Don't allow the user to install extensions from web

[Tor Bug Tracker & Wiki]

#27271: Don't allow the user to install extensions from web
---+--
 Reporter:  igt0   |  Owner:  tbb-team
 Type:  defect | Status:  closed
 Priority:  Medium |  Milestone:
Component:  Applications/Tor Browser   |Version:
 Severity:  Normal | Resolution:  fixed
 Keywords:  TorBrowserTeam201808R, tbb-mobile  |  Actual Points:
Parent ID: | Points:
 Reviewer: |Sponsor:
---+--

Comment (by gk):

 igt0, sysrqb: could anyone of you open a follow-up ticket with a plan for
 fixing the underlying issue better. FWIW:
 https://bugzilla.mozilla.org/show_bug.cgi?id=1464766 landed in esr60 and
 might be a thing to consider here.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #27271 [Applications/Tor Browser]: Don't allow the user to install extensions from web

[Tor Bug Tracker & Wiki]

#27271: Don't allow the user to install extensions from web
---+--
 Reporter:  igt0   |  Owner:  tbb-team
 Type:  defect | Status:  closed
 Priority:  Medium |  Milestone:
Component:  Applications/Tor Browser   |Version:
 Severity:  Normal | Resolution:  fixed
 Keywords:  TorBrowserTeam201808R, tbb-mobile  |  Actual Points:
Parent ID: | Points:
 Reviewer: |Sponsor:
---+--
Changes (by gk):

 * keywords:   => TorBrowserTeam201808R, tbb-mobile
 * status:  needs_review => closed
 * resolution:   => fixed


Comment:

 Thanks, this works for me on a fresh build. I am not sure why just adding
 the prefs does nothing, though. Applied to `tor-browser-60.1.0esr-8.0-1`
 as commit a0620db9e7cd08e3d67a42d0c5b1067d5b3ed355.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #27271 [Applications/Tor Browser]: Don't allow the user to install extensions from web

[Tor Bug Tracker & Wiki]

#27271: Don't allow the user to install extensions from web
--+--
 Reporter:  igt0  |  Owner:  tbb-team
 Type:  defect| Status:  needs_review
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:|  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by igt0):

 updated code:

 
https://trac.torproject.org/projects/tor/attachment/ticket/27271/0001-Bug-27271-Don-t
 -allow-the-user-to-install-extensions.2.patch

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #27271 [Applications/Tor Browser]: Don't allow the user to install extensions from web

[Tor Bug Tracker & Wiki]

#27271: Don't allow the user to install extensions from web
--+--
 Reporter:  igt0  |  Owner:  tbb-team
 Type:  defect| Status:  needs_review
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:|  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--
Changes (by igt0):

 * Attachment "0001-Bug-27271-Don-t-allow-the-user-to-install-
 extensions.2.patch" added.


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #27271 [Applications/Tor Browser]: Don't allow the user to install extensions from web

[Tor Bug Tracker & Wiki]

#27271: Don't allow the user to install extensions from web
--+--
 Reporter:  igt0  |  Owner:  tbb-team
 Type:  defect| Status:  needs_review
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:|  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--
Changes (by gk):

 * cc: dmr (added)


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #27271 [Applications/Tor Browser]: Don't allow the user to install extensions from web

[Tor Bug Tracker & Wiki]

#27271: Don't allow the user to install extensions from web
--+--
 Reporter:  igt0  |  Owner:  tbb-team
 Type:  defect| Status:  needs_review
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:|  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--
Changes (by gk):

 * cc: dmr (removed)


Comment:

 OKay, just setting the pref after start-up and restarting still allows me
 to install extensions. I need to make a clean build to verify that, I
 guess.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #27271 [Applications/Tor Browser]: Don't allow the user to install extensions from web

[Tor Bug Tracker & Wiki]

#27271: Don't allow the user to install extensions from web
--+--
 Reporter:  igt0  |  Owner:  tbb-team
 Type:  defect| Status:  needs_review
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:|  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--
Changes (by dmr):

 * cc: dmr (added)


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #27271 [Applications/Tor Browser]: Don't allow the user to install extensions from web

[Tor Bug Tracker & Wiki]

#27271: Don't allow the user to install extensions from web
--+--
 Reporter:  igt0  |  Owner:  tbb-team
 Type:  defect| Status:  needs_review
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:|  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--
Changes (by igt0):

 * cc: sysrqb, gk (added)
 * status:  new => needs_review


Comment:

 I think for the alpha, the proposed patch is a good solution until we
 figure out a final one.

 
https://trac.torproject.org/projects/tor/attachment/ticket/27271/0001-Bug-27271-Don-t
 -allow-the-user-to-install-extensions.patch

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #27271 [Applications/Tor Browser]: Don't allow the user to install extensions from web

[Tor Bug Tracker & Wiki]

#27271: Don't allow the user to install extensions from web
--+--
 Reporter:  igt0  |  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:|  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--
Changes (by igt0):

 * Attachment "0001-Bug-27271-Don-t-allow-the-user-to-install-
 extensions.patch" added.


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

[tor-bugs] #27271 [Applications/Tor Browser]: Don't allow the user to install extensions from web

[Tor Bug Tracker & Wiki]

#27271: Don't allow the user to install extensions from web
--+--
 Reporter:  igt0  |  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal|   Keywords:
Actual Points:|  Parent ID:
   Points:|   Reviewer:
  Sponsor:|
--+--
 Tor browser for Android doesn't verify if the torbutton extension has a
 signature to install it.
 Thus, if someone sends a tampered torbutton extension to the user, they
 can install it.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs