New Release: Tor Browser 8.0.3

by boklm | October 23, 2018

Tor Browser 8.0.3 is now available from the Tor Browser Project page and also from our distribution directory.

This release features important security updates to Firefox.

Tor Browser 8.0.3 includes newer NoScript and HTTPS Everywhere versions. Moreover, it ships with a donation banner for our end of the year campaign and includes another round of smaller fixes for Tor Browser 8 issues on Linux systems. We also switched to a newer API for our NoScript <-> Torbutton communication, which we need for the Security Slider.

The full changelog since Tor Browser 8.0.2 is:

  • All platforms
    • Update Firefox to 60.3.0esr
    • Update Torbutton to 2.0.8
      • Bug 23925+27959: Donation banner for year end 2018 campaign
      • Bug 24172: Donation banner clobbers Tor Browser version string
      • Bug 27760: Use new NoScript API for IPC and fix about:blank issue
      • Translations update
    • Update HTTPS Everywhere to 2018.9.19
    • Update NoScript to 10.1.9.9
  • Linux
    • Bug 27546: Fix vertical scrollbar behavior in Tor Browser 8 with Gtk3
    • Bug 27552: Use bundled dir on CentOS/RHEL 6

Comments

Please note that the comment area below has been archived.

nasga (not verified) said:

October 23, 2018

Permalink

yes

Anonymous (not verified) said:

November 04, 2018

Permalink

Unable to post comment at the ticket (link above), so, posting here:
Gesturefy 2.0.3 (extension enabled)
TBB 8.0.3

dom.w3c_pointer_events.enabled=false **no mouse gestures are seen by the extension, as if it's not even turned on
dom.w3c_pointer_events.enabled=true **mouse gestures are seen by the extension, but no matter what gesture I try, only 'UP' gesture is executed

Anonymous (not verified) said:

November 23, 2018

Permalink

Unable to post comment at the ticket (link above), so, posting here:
Gesturefy 2.0.3 (extension enabled)
TBB 8.0.3

-- continuation from the last post / dom.w3c_pointer_events.enabled testing --

privacy.resistFingerprinting=true [default] **mouse gestures not seen by the extension
privacy.resistFingerprinting=false **mouse gestures and the extension works properly

As I do not know what this preference does, nor it's impact on privacy/TOR, I have set it back to default. So, once again gestures do not work. If someone can find out what exactly this preference is doing to the extension, that'd be great.

There are several other privacy.resistFingerprinting(.xxx) preferences, all of which were left on default (TRUE) during testing.

"Orange" is number one (ISP) in france
ISP = FAI in french
CBF means that he can't log in his ISP mailbox/client service.
afaik, it is not related at tor but it's related at the isp which does not allow anonymous log in (javascript required & cookies maybe) even with a vpn, it could be refused ...
first you must connect at home second allow javascript & cooky third call the client service (or by chat) if you cannot anymore. i mean it is more a server problem than a tor one.
contactez votre service client en cas 'de diffilculté de connection : c'est plus un probleme de serveur côté fai qu'un probleme avec tor (n'oubliez pas d'activez javascript et d'autorisez les cookies).
la surveillance est très forte en france : the update does not block the connection but the government maybe.

Antivirus dete… (not verified) said:

October 24, 2018

Permalink

My TOR auto-updated. My Anti-virus red flagged PINGSENDER.EXE as malicious. Just letting you know.

Thanks for the free software GK. We appreciate your efforts too.

VK (not verified) said:

October 24, 2018

Permalink

“The dictionary is the only place that success comes before work. work is the key to success, and hard work can help you accomplish anything.”
― Vince Lombardi

My BIG salute to your hard work. you guys are extraordinary.

keep on moving.................

By "blocking", do you mean an almost blank page, with message something like, "bandwidth too high" ? (I don't recall words)
Often refreshing that tab fixes the problem. Other times, need to use "new circuit for this site" (in the left end of the addressbar) to fix.

Anonymous (not verified) said:

October 24, 2018

Permalink

Why do exit servers sometimes show as coming from one country when checked at the URL info buttun, but when checked with GeoIP it shows they are from another country?

your first relay shows you the country (guard) where you live, when you check with geoip , it is another relay (third / unknown) ... so another country ... it is like that tor runs

but (not verified) said:

November 01, 2018

Permalink

my first relay (picked randomly out of the guard relay pool) is often located where i live ;)

anon (not verified) said:

October 24, 2018

Permalink

same prob as others. McAfee reports the 64bit ESR Firefox update this installs as a virus. TOR 8.0.3 installs / updates earlier version fine, it updates Firefox to Firefox to 60.3.0 esr and then requests a restart. When you do, McAfee quarantines it. Did clean installs of other earlier 64bit TOR versions, same thing happened ever time after the Firefox upgrade.

Did several new installs of 8.0.3 32bit and NPF.

tortor (not verified) said:

October 28, 2018

Permalink

Sometimes when I start Tor it shows the progress bar but never seems to complete. Would the tor browser time out if it can't create a circuit?

Anon (not verified) said:

October 25, 2018

Permalink

This is perhaps not related to TOR per se ...

I had violetmonkey installed. After the 8..0.3 updated, it is disabled. Clicking on the icon, it shows 'scripts disabled'.

I switched to violetmonkey as greasemonkey stopped functioning when TOR 8 was announced.

If you know of any way to get back userscript support, please let know.

Thanks.

The same as la… (not verified) said:

October 25, 2018

Permalink

GK

Thanks for your response of the 15th re my concerns about the information I got when trying to verify the 8.0.2 bundle signature.

I have just tried to verify 8.0.3. and whilst I understand what you have said regarding 8.0.2 and the GnuPG configuration, there is still one aspect of the divergence that I get versus what your instructions say I should get that still confuses/worries me.

It is in relation to the RSA key. You say that what I should get is:
“using RSA key 0xD1483FA6C3C07136””
Whereas what I do get (again) is:
RSA key EB774491D9FF06E2

I rather thought (assumed) that something as important as the RSA key should not vary, so why does it?

Thanks

sugg (not verified) said:

October 25, 2018

Permalink

suggestion : could you add at the standard toolbar the icon "home" & the icon "https everywhere" please ?
i feel it should be better with these 2 icons (https is in blue/red easily and home is helpful).
of course, the option "customize" helps but a toolbar including these ones per default should be nicer.

Not showing the HTTPS-Everywhere icon on first start is actually a bug (https://trac.torproject.org/projects/tor/ticket/23359), but we are in the process of redesigning our security controls and the HTTPS-Everywhere icon will be removed from the toolbar in that process. (see: https://gitweb.torproject.org/tor-browser-spec.git/tree/proposals/101-s…)

For the home button I opened https://ocewjwkdco.tudasnich.de/comment/278265#comment-278265.

Anonymous (not verified) said:

October 25, 2018

Permalink

Hello torproject
Why the browser directory in the 64bit install.exe(TBB) is an PE+-blob i can't unpack with e.g. 7zip?
Can you change this to a SFX i can handle with e.g. 7zip?

question (not verified) said:

October 25, 2018

Permalink

Is it safe TBB is opening a circuit with all 3 relays -guard/middle/exit- in 1 country. I haven't seen this before.

Yes, it's the best option. If it refused to build circuits like that, then somebody who knows your exit can narrow out what country your entry guard is in -- and if they see a bunch of connections from you, they would be able to quite quickly learn exactly which country your entry guard is in. That wouldn't be good.

More generally, don't just think of the relay locations, but also think of the network links between the relays. It gets messy quickly:
https://ocewjwkdco.tudasnich.de/improving-tors-anonymity-changing-guard-par…

Tor automatically avoids using more than one relay in a given network /16 in any circuit. I think there could be a bit more room for complexity in path selection, but complexity is bad news for anonymity (see e.g. the attack at the beginning of this comment) so we need to tread carefully.

Johnny (not verified) said:

October 25, 2018

Permalink

When i download Tor Brower in french, he is not in french, but in english, with ALL versions of 8.0.x & 8.5.x

Can fix please

Jean (not verified) said:

October 26, 2018

Permalink

Thank you very much for everyone for the great work making Tor better all those years - lots of love

SuperOnions (not verified) said:

October 26, 2018

Permalink

Default Tor Browser 8.0.3 window resolution is _1000 wide x 998 high_, with saved bookmarks and saved bookmarks folders visible in the horizontal Bookmarks Toolbar visible beneath the Address Bar, and all other settings affecting resolution have their standard-default settings.

8.0.3 resolution should be 1000x1000, as in Tor Browser 7.5.6, with saved bookmarks and saved bookmarks folders visible in the horizontal Bookmarks Toolbar visible beneath the Address Bar, and all other settings affecting resolution have their standard-default settings.

This defect, resolution:1000x998, in 8.0.3 duplicates the identical defect, resolution:1000x998, present in 8.0, 8.0.1, and 8.0.2.

See: https://trac.torproject.org/projects/tor/ticket/27845

Platform: macOS 10.10.5, desktop

bookmarks gone (not verified) said:

October 26, 2018

Permalink

Can someone please help me. McAfee had quarenteed an object when I installed the new TBB update (Windows 10 64-bit). I now lost all my bookmarks when I thought by deleting the entire Tor browser off my desktop that I could do a new TBB install thinking bookmarks would still be there but it's not. I went to the Firefox user profile for bookmark backups but they only show the bookmarks I have for Firefox. Did me uninstalling the entire Tor browser delete any chance of me retrieving my bookmarks or is there another way to find them on my system? Thank You!

hello (not verified) said:

October 27, 2018

Permalink

also with 8.0.3 noscript settings not being saved
i would call this an "important security risk"

Anonymous (not verified) said:

October 27, 2018

Permalink

high CPU usage on pornhub.com >
./firefox.real --class Tor Browser -profile TorBrowser/Data/Browser/profile.default
browser console not working properly, platform Arch.

tortor (not verified) said:

October 28, 2018

Permalink

I have requested new bridges several times over 10 times but I keep getting the same bridges.
94.181.82.25:34457
172.104.184.204:41319
79.66.110.5:42215
can you tell me why?

Its not the specific bridges that repeat its the bridges the torbrowser application aquires when getting bridges from "tor network settings" then "provide a brisge I know". another Mac running high siera had the same issue

anon (not verified) said:

October 28, 2018

Permalink

Starting with version 8, 90% OF THE TIME when I start Tor I get the error page that says "Something is wrong" and complaining that Tor is not connected. I quit Tor and restart it and 100% of the time Tor connects on the second try.

It looks like the initial connection on the first startup is either being refused or is timing out prematurely. Is there a workaround for this behavior?

So it looks like the first start of Tor 8.0.3 is hanging in your case and immediately failing in my case. This might reflect a TCP timeout issue. You are hanging waiting for a connection. I am displaying the "Something is wrong" red error startup tab in Tor because my connection is immediately failing. But what is common to both our cases is that the first start of Tor 8.0.3 fails to connect properly. The second connection seems to work.

No chance that this is some kind of man-in-the-middle attack?

anon (not verified) said:

October 30, 2018

Permalink

Just got TBB setup on W7 and working. Had tinywall allowing TBB through. No trouble getting online but I'm getting a crash on exiting TBB. A dialog box comes up about 30secs later where I can close TBB. In taskmanager theres 2x firefox exe's - One is using 127328 kbs the other is 3596kbs Is this normal?
Thx

Anonymous (not verified) said:

October 30, 2018

Permalink

When I first used to start TBB I always clicked on the link "check if I'm currently using Tor" Also I sometimes like to go to the Tor Project page but there's no link to that either. Can we have these back please?

Yas (not verified) said:

November 03, 2018

Permalink

Since the summer time started on in Brazil, Tor has stopped to work. It does not connect to any bridge. Other common browsers work regularly. Sometimes during the fail Tor produces some message about a fail in the clock of something.

Anonymous (not verified) said:

November 05, 2018

Permalink

When I close the browser the Tor process is kept alive as a child of systemd which prevents me from restarting the browser. I need to manually terminate the Tor process before I am able to restart the browser.

Is that reproducible? How are you closing Tor Browser? What log output do you get in a terminal if you are closing it? (You can see output by starting the browser with ./start-tor-browser.desktop --debug)

Anonymous (not verified) said:

November 07, 2018

Permalink

It is reproducible for me. I close the browser simply by clicking the close button in the browser's window frame.

start-tor-browser.desktop does not start the browser, but start-tor-browser does.

When I close the browser the output first mentions a JavaScript error in tor-circuit-display.js (myController is null) and then there are some warnings which look a bit like this:

[Parent ..., Gecko_IOThread] WARNING: pipe error ... Connection reset by peer: file /var/.../ipc_channel_posix.cc, line 353

And finally when I manually terminate the Tor process I am notified:

Catching signal TERM, exiting cleanly.

Anonymous (not verified) said:

December 01, 2018

Permalink

Correction: Tor detaches from firefox.real when I close the browser and becomes a standalone process, not a child of systemd. I misread the process graph. My apologies. But I must still manually terminate the Tor process before I can restart the browser.

Ump (not verified) said:

November 07, 2018

Permalink

A big problem with Tor Browser is that many image and file downloading web sites don't work!
These web sites request captcha's and/ or clicking trough multiple layers of javascript links to get into the stuff but they load the final thing (image, or file, or page) from a different sub-domain, sometimes even different domains! And then present the error that the IP is wrong... because Tor Browser is using different paths to different sub-domains and different domains.
There should be a way to allow, at least for some sessions to allow the Tor Browser to use the same path at the very least in the same tab, and maybe even give that option to the all session and all tabs existent or new or to the actual tab and any new tab or windows it opens... from the web site point of view the IP should always seem the same no matter what sub-domains/ different domains it loads to find out if the user is really coming from that IP or using Onion network.
This is extremely danger when not used carefully so some UI should warn visually the user when that is being done... and should be explicitly activated by the user for that "Identity session", and the user should be able to disable it.
Otherwise there exists web sites that can't be used at all because of this way of working of Tor Browser.

Loook (not verified) said:

November 08, 2018

Permalink

It happen to me one time a web site I was in is blocked in Russia, the problem is the redirect the domain to another and I couldn't ask for a new onion path since the domain was redirected before I could do that.
Can you add a manual mode in the options to ask for a new path for a specific domain/ sub-domain without having to enter in a tab such that the Tor makes a new path to it and allow the current tabs to get the new path and keep/ start using the page.

Not Loook (not verified) said:

November 15, 2018

Permalink

Another way might be to have a circuits/domains tab that you can open which displays all of the active circuits/domains, similar to how the downloads tab displays a list of downloaded files. You could order the circuits by most recent attempted connection and a display a "new circuit" button next to each circuit, similar to how there is a "pause/resume/retry" button next to each incomplete download on the downloads tab.

Loook (not verified) said:

November 19, 2018

Permalink

It should be enough some UI to enter the domain/ sub-domain and ask Tor manually for a new path to it.
For example, bellow "New Tor Circuit for this Site" option you could add "New Tor Circuit for user provided URL". And explain in help section that in case TOR is making you exit in a server that is redirecting the domain to some other domain/ sub-domain (ex.: country's that censor some contents like Russia and many others) some times to show a message that you were trying to access a forbidden domain, the user should request manually for a new circuit so that it doesn't keep ending in the same censored server.

Not Loook (not verified) said:

December 12, 2018

Permalink

I would add there is another problem/bug closely related to the problem Loook describes. If a website fails to load due to a timeout, the circuit is displayed but clicking on "new circuit" only reloads the page but does not provide a new circuit! "New circuit" only works as expected if a connection is already established. I am using the linux 8.0.3 version.

tortor (not verified) said:

November 21, 2018

Permalink

When I try to access the site "https://www.usnews.com/news/best-countries" even using many different TOR circuits I get the message
"Access Denied
You don't have permission to access "http://www.usnews.com/" on this server.
Reference #18.edcf180.1542840518.2dd64b6 "

I find it hard to belive that a US news site would block TOR access. Could you provide some reasons why TOR would be blocked or could this be blocked from other sources?

That website is using the CDN services by Akamai and they have a Tor blocklist installed by default. Chances are high that the site owner either does not know about and is just running with the default settings. Please ask them to get rid of that Tor ban, thanks!

Anonymous (not verified) said:

December 10, 2018

Permalink

So Akamai is just as bad as Cloudflare then! How sad. I recall reading a blog post some time ago which discussed the problem with Cloudflare and it referenced a report by Akamai which found the proportion of legitimate web traffic to be the same for Tor and non-Tor users, so I can't see why they think a default Tor blocklist is a good idea, it just deprives users of content and site owners of traffic!

tortor (not verified) said:

November 21, 2018

Permalink

I noticed that when I go to "https://bridges.torproject.org/options" for bridges and select IPv6 I get the message

"Uh oh, spaghettios!
There currently aren't any bridges available... Perhaps you should try going back and choosing a different bridge type! "

Are IPv6 bridges available? This occurs for all bridge types

Anonymous (not verified) said:

November 22, 2018

Permalink

Just wanted to say I am using 8.0.3 on Debian 9.4 and it appears to be working great. As always, a million thanks to the Tor Browser team for all your hard work! My contribution will be coming your way in a week or so, I hope.

Resize Jitters (not verified) said:

November 28, 2018

Permalink

When I right click a link to open in a new private window, the new window opens against the top of my screen. It will resize itself to full screen almost spontaneously, and quite unpredictably. I try to place the mouse cursor at the top of the browser window to click and drag the window down. Sometimes I make it before "Full Screening", and other times ... BOOM! There it goes. Also, when the browser resizes, there is no yellow warning banner at the top anymore advising against resizing the browser. That's different. This is a TBB 8.0.3_x64bit on a Windows 7-x64bit machine. Thank you for helping all of us users with your continuous dedication to Tor Project.

Resize Jitters (not verified) said:

December 03, 2018

Permalink

Re: https://trac.torproject.org/projects/tor/ticket/28700 ...
Thanks gk. I have gone through 2 or three new mice trying to remedy some odd mouse performance (all of them the same brand from the same retailer ... not my first choice, but they were what was for sale). My last selection has been a different and well known brand (the last one in my reserves). The erratic TBB window resizing has ceased. Other problems with highlight-copy-paste seem solved, too. The warning still does not appear if I deliberately resize though. My trouble may have been defective hardware, i.e.: the computer mice.

When I read this and think of the times when I have accidentally resized to full screen with a slip of the mouse, I would think it better for the browser to catch a resize event and warn the user before it goes ahead with the resize rather than after when it is too late. "Are you sure you want to do this?" seems a better question than "did you really mean to do that?" But maybe it is more challenging to implement this way, I don't know.

Anonymous (not verified) said:

December 05, 2018

Permalink

Almost every time I open Tor Browser, the browser is "not responding" for a few seconds.

Also, sometimes when watching videos, the pointer of the mouse is very difficult to handle.

Do you have solutions? Thanks!

Anonymous (not verified) said:

December 24, 2018

Permalink

In addition to my first post.

Sometimes when opening Tor Browser, I get a red screen, saying: "Something Went Wrong! Tor is not working in this browser."

I have the same problem of the browser freezing up for a few seconds after opening it and I'm using version 8.0.3 on Linux. I never experienced this before with the 7.x versions. On a different note I noticed the pagination on this site was messed up the last few days, at least for me it didn't work at all (was the code changed?) but the pagination is working again now.

Chip (not verified) said:

December 11, 2018

Permalink

I recently downloaded Tor 8.0.3 64-bit to my new computer that has Windows 10 64-bit. The Tor browser launches, but I cannot bookmark web pages, the bookmarks toolbar doesn't appear, the menu button in the upper right does nothing and customize gives a blank screen. I am running Firefox 63.0.3, the most recent. Any idea what's going on? Thanks.

Does an update to 8.0.4 help? Do you have some antivirus/firewall software installed that could interfere with Tor Browser? Does your issue go away if you uninstall it (just for testing as disabling is often not enough to stop this kind of software from messing with other applications)?

Chip (not verified) said:

December 15, 2018

Permalink

Hi again. Updating to 8.0.4 and having the latest Firefox version now allows me to open the menu (button on upper right) and the customize screen now opens from the menu. The bookmarks toolbar now also appears, but I still cannot bookmark pages. Ugh. Thank for your help.

Chip (not verified) said:

December 17, 2018

Permalink

Nothing. When you click bookmark this page, the bookmark window doesn't open where you would select the folder you want to put the bookmark in. Thank for looking into this.

And I assume the bookmark did not get created at a default location somewhere? If you open the browser console (Ctrl+Shift+J) does any error pop up when you are trying to create a bookmark?

Chip (not verified) said:

December 18, 2018

Permalink

Yes. There are a bunch of these errors listed.....

Error: Error(s) encountered during statement execution: attempt to write a readonly database
Stack trace:
handleCompletion@resource://gre/modules/Sqlite.jsm:807:25
(unknown)
IndexedDB UnknownErr: ActorsParent.cpp:600 (unknown)
undefined (unknown)

Chip (not verified) said:

December 20, 2018

Permalink

I went to security settings and unchecked block pop-ups and still nothing when I try to bookmark. Here are the error messages from the log:

Error: Error(s) encountered during statement execution: attempt to write a readonly database Sqlite.jsm:807:25
Key event not available on some keyboard layouts: key=“r” modifiers=“accel,alt” id=“key_quickRestart” browser.xul
Key event not available on GTK2: key=“u” modifiers=“accel shift” id=“torbutton-new-identity-key” browser.xul
Key event not available on some keyboard layouts: key=“i” modifiers=“accel,alt,shift” id=“key_browserToolbox” browser.xul
IndexedDB UnknownErr: ActorsParent.cpp:600 (unknown)
undefined (unknown)
NS_ERROR_FILE_READ_ONLY: Component returned failure code: 0x80520013 (NS_ERROR_FILE_READ_ONLY) [nsINavBookmarksService.createFolder] PlacesUIUtils.jsm:982
NS_ERROR_FILE_READ_ONLY: Component returned failure code: 0x80520013 (NS_ERROR_FILE_READ_ONLY) [nsINavBookmarksService.runInBatchMode] PlacesUIUtils.jsm:1037
[12-20 10:54:37] Torbutton WARN: no SOCKS credentials found for current document.[12-20 10:54:39] Torbutton WARN: no SOCKS credentials found for current document.

Any ideas what I should do?

Chip (not verified) said:

January 01, 2019

Permalink

Will the next update 8.0.5(?) fix the bookmarking problem with Windows 10? I never had any issues bookmarking pages with Windows 7.

If you mark the folder where you store your Tor Browser as read-only there is not much what we can do. I recently read:

"On Windows 10, Microsoft has an optional feature that protects the home directory and desktop from modification. When this feature is turned on, Tor Browser doesn't work, because it is installed on the desktop in the home directory." (https://trac.torproject.org/projects/tor/ticket/28678#comment:2)

Maybe you have turned that on?

Chip (not verified) said:

January 12, 2019

Permalink

When I uncheck Read Only for the Tor Browser folder on the desktop under properties and click apply, a pop-up asks if I want to apply that to all sub-folders and files. I clicked yes. When I go back to the folder properties, Read Only is again checked. I can live without being able to bookmark pages, but it is aggravating. I wish you all could come up with a fix for this issue. I'm not a computer heavyweight and the stuff in the link above was way over my head. Thanks.

You don't have to install Tor Browser in a folder that is marked read-only on your system. The install wizard gives you are suggestion (your desktop), so that you can easily find the installed version (users had trouble with that in the past). If you want to install it somewhere else, just enter a different location. However, I don't know what is marked as read-only on your system. Thus, it is hard to give you a good alternative suggestion.

Chip (not verified) said:

January 17, 2019

Permalink

Also, I was unsuccessful in importing my bookmarks from the Tor Browser on my laptop running Windows 7 to my Windows 10 desktop. I got this error message - "Unable to process the backup file." The file was a .json file.