Tor Browser 5.0.4 is released

by gk | November 4, 2015

A new stable release for Tor Browser is available from the Tor Browser Project page and also from our distribution directory.

This release features important security updates to Firefox.

Additionally, we included Yan Zhu's fix for not leaking the Referer header when leaving a .onion domain and are shipping an updated NoScript version.

These and all the other changes (minor bug fixes and clean-ups) can be found in the complete changelog since 5.0.3:

All Platforms
- Update Firefox to 38.4.0esr
- Update NoScript to 2.6.9.39
- Update Torbutton to 1.9.3.5
  - Bug 9623: Spoof Referer when leaving a .onion domain
  - Bug 16735: about:tor should accommodate different fonts/font sizes
  - Bug 16937: Don't translate the homepage/spellchecker dictionary string
  - Bug 17164: Don't show text-select cursor on circuit display
  - Bug 17351: Remove unused code
  - Translation updates
- Bug 16937: Remove the en-US dictionary from non en-US Tor Browser bundles
- Bug 17318: Remove dead ScrambleSuit bridge
- Bug 17473: Update meek-amazon fingerprint
- Bug 16983: Isolate favicon requests caused by the tab list dropdown
- Bug 17102: Don't crash while opening a second Tor Browser
Windows
- Bug 16906: Don't depend on Windows crypto DLLs
Linux
- Bug 17329: Ensure that non-ASCII characters can be typed (fixup of #5926)

Comments

Please note that the comment area below has been archived.

FIRST Anyway, thank you for

FIRST
Anyway, thank you for spoofing the referer after leaving a .onion domain, that was really needed.

I really do appreciate the

I really do appreciate the effort the Tor team puts into their software. Thank you for all the humanitarian work that has saved countless lives and freedoms.

I have one suggestion that might fall on deaf ears due the massive workload this team has. Please bare with me and strongly consider the following.

A relatively new systems programming language called Rust poses many benefits over the C family while still maintaining much of its valued speed. Rust avoids memory leaks, reduces overall code error, retains much of the speed of C, and as a result of its inbuilt safety measures, reduces complexity and lines of code.

An example of this is the Maidsafe project's rapid port of several years worth of C++ code over to Rust in under 6 months. As a result, development speed has dramatically improved, and the code has been reduced from nearly a million lines down to only 20 thousand. This has reduced attack surfaces, eliminated memory leaks, and generally makes the code more readable/audit-able. The lead developer David Irvine has credited Rust for improved security. It's even claimed that they wouldn't be so close to launched if it had not been for the transition over to rust. Their testnet is now only several days away (an unexpected bug in one of their libraries is the only thing left).

I really hope the Tor team really considers rust for future development. I suspect that as a result of the work that team has done with rust, its popularity will increase and the benefits understood.

Please check this post on their forums, but keep in mind that rust is now at 1.4 stable. It was yet unreleased at the time of the discussion. https://forum.safenetwork.io/t/rust-vs-c/3216

HERE IS THEIR GITHUB: https://github.com/maidsafe

Please tell me what you think :-)

Rust is coming as Mozilla

Rust is coming as Mozilla will be using it for their new rendering engine, Servo. And we have https://bugs.torproject.org/11331 for some ideas.

While an interesting

While an interesting concept, is there any reason to believe this is any different than any other new programming language that tries to give performance relatively close to C (Or at least C++) yet include additional safety measures? Rust is still a new language; I'd say give it a few years to figure out if it's still around and actually being used outside of a few diehards. I'd hesitate moving a long term project to a new programming language before the initial hype has worn off.

Of course, Tor Project really can't control what most of firefox is written in, so any decisions they make about programming languages can't apply to the browser itself.

Do not know if the update is

Do not know if the update is giving me problems, or the browser, or what, but this version gives me problems accessing onion or privacy email services...anything about this?

> problems accessing onion

> problems accessing onion or privacy email services

What is the adress of the site (onion) , what is your privacy email service ?

afaik, all is fine.

but this version gives me

but this version gives me problems accessing onion or privacy email services...anything about this?

Detailed descriptions and error messages of the problems you encountered.

From at least version 4 of TBB, there have been internet brigades sent by the NSA and GCHQ to post so-called "feedback" on the failings of the latest version and insinuating to readers to fall back on using older versions.

I should know because I am from Tailor Access Operations.

Just wanted to say thanks

Just wanted to say thanks again for keeping TBB's release cycle so close to Mozilla's. As someone who uses this product every day, it helps me feel more confident and secure in my browsing. Keep up the great work!

Strange behavior of Electrum

Strange behavior of Electrum when running through Tor

The latest TBB 5.0.4 runs on port 9150, right? Well, I configured Electrum 2.5.2 to run through Tor.

On my Linux box, whenever Electrum connects through Tor, I receive the error message:

Nov 4 00:00:00.000 [warn] Application request to port 110: this port is commonly used for unencrypted protocols. Please make sure you don't send anything you would mind the rest of the Internet reading!

Has anyone of you using Electrum over Tor come across the same issue? Does it arise from Tor or Electrum?

Port 110 is for unencrypted

Port 110 is for unencrypted POP3 E-mail access. Exit nodes can sniff and read unencrypted POP3 traffic. Tor warns about port 110 being used, but is dumb enough to not distinguish between POP3 traffic and Electrum (Stratum protocol) traffic. You can ignore this warning IMHO everything is OK.

"...Strange behavior of

"...Strange behavior of Electrum ... using Electrum over Tor"

try Tails.

What does the below error

What does the below error message mean and how did it happen?

Nov 04 08:00:04.000 [notice] Your network connection speed appears to have changed. Resetting timeout to 60s after 18 timeouts and 451 buildtimes.

Would something as benign as

Would something as benign as already having NoScript updated to 2.6.9.39 in 5.0.3 cause the incremental updater to then switch over to the full .mar file instead?

No, just updating NoScript

No, just updating NoScript and later updating to a newer Tor Browser (say to 5.0.4) is still using the incremental .mar file.

thanks to you

Where is the new Tor network

Where is the new Tor network manager? The green icon inside Tor Broswer is too week and also the ARM, Vidalia is strong but out of date. How about the Tork? But what package it requires before ./configure&make&make install

After upgrading I am still

After upgrading I am still running Tor Button 1.9.2.8!

This bug was reported 15 months ago and is easy to reproduce: https://trac.torproject.org/projects/tor/ticket/12745

Also (possibly due to the same bug?) I'm apparently running two versions of HTTPS Everywhere simultaneously: 5.0.7 and 5.1.1. (And in another user's Tor Browser I see 5.0.7 and 5.1.0.)

That upgrade method was

That upgrade method was never recommended exactly due to issues like yours. So, if you don't want to use the auto-udpater (although you should) you should resort to extracting the new version into a different location and importing your bookmarks into it manually.

With respect ro HTTPS-Everywhere: This is https://bugs.torproject.org/16909. A fix for this landed in our recent alpha and if nothing blows up we'll backport this to the stable and the problem should be gone then.

Actually, after restarting

Actually, after restarting my newly updated Tor Browser 5.0.4, my HTTPS Everywhere 5.1.1 has reverted to 5.1.0. And I still have HTTPS Everywhere 5.0.7 installed too. :(

geoip not updated in tbb

geoip not updated in tbb dist. since june,, check it,, meanwhile ipv4 now at capacity,,,

~freerasool~

Hello Tails, i love your

Hello Tails,
i love your Distribution but the old,very special, very Reproducible!
changeWindowsize(Vidalia,Browser/others?)-getBlackFullscreenOOOPS
is still alive)-:. AMD CPU with onboard GPU graphic.

"Oh no! Something has gone wrong.
A problem has occured and the sytem can't recover.
Please log out and try again.
|Log Out|"

Why very simple desktop operation -change window size- is crashing Linux?
I have never seen this kind of error on other Linux distro.

You're probably not going to

You're probably not going to get support on the Tor Browser blog; maybe try checking out the [geshifilter-code]https://tails.boum.org/support/index.en.html[/geshifilter-code] "Get in touch with us" section.

i dont know wat happened but

i dont know wat happened but whn i updated 5.0.4 it now its not working on my mac it says check proxy setting so any suggestions

Still don't know how to use

Still don't know how to use it.

Bug found: you can't read. :)

"Tor browser unexpectedly

"Tor browser unexpectedly exited. This might be due to a bug in Tor itself. another program on your system. or faulty hardware. until you restart Tor. the Tor Browser will not able to reach any websites. If the problem persists. please send a copy of your Tor Log to the support Team.

Restarting Tor will not close your browser tabs."

Restarting Tor just repeats the above message.

Windows 8.1

Is there still a Tor Process

Is there still a Tor Process running somewhere on your system?

I thought Tor Browser didn't

I thought Tor Browser didn't save any stuff to disk but now I see these files whitin ~/tor-browser_en-US/Browser/.local/share/gvfs-metadata/
that list all URIs I have downloaded. It seems Firefox try to offer a directory to save things based on these lists.

Same issue a year ago:
https://www.reddit.com/r/TOR/comments/24tdnf/tor_browser_bundle_apparen…

Thanks, this is

Thanks, this is https://bugs.torproject.org/17560.

Ver 5.0.4: Clicking on the

Ver 5.0.4: Clicking on the green onion S-T-I-L-L does not show the server chain the majority of the time. Why is this STILL broken?

Hard to say without more

Hard to say without more information. But I guess you are running into https://bugs.torproject.org/16990 which should be fixed in the next release.

Yes, very likely. It looks

Yes, very likely. It looks like it's being investigated pretty well. Thanks!

Hi My tor browser is being

Hi
My tor browser is being cloned or taken over By a chrome version!
I have been trying to delete "the My browser" application, but to no avail
Am I doing anything wrong, How can I dump this clone?
thanks
Bryan or toffeecat@mail .com

how do you explain this

how do you explain this https://metrics.torproject.org/networksize.html?graph=networksize&start…

Tor 5.0.4_32 bit_EN won't

Tor 5.0.4_32 bit_EN won't install in Manjaro Linux Xfce 32 bit. It's not on Manjaro repositories but can be selected by enabling the AUR repository. The problem is that the last source package can't be built because the Open PGP public key is missing. Retrying to build gives the same error. Note that Manjaro uses Pamac, a Gtk 3 frontend for libalpm, and so it auto builds the AUR repository packages (the Manjaro repositories have only pre-built packages). But the problem is in Tor own files. I downloaded the Tor tar-xz package, extracted as user (no root in any step) and it gave me an error on extraction but still extracted the archives. Running the Tor Browser desktop configuration file, again as a user, launches Tor and everything looks peachy... Except I don't like this arrangement nor the extraction error. The AUR package can't be built because one of the public keys is missing? This is not how Tor should work, and so I can't trust the safety of my extracted tarball, nor the resulting installation, although I'm using it because there are no alternatives (I don't want to use the package in my native language!). Can you please try and look into this issue? Many thanks! R.P.

ok ; it is more a manjaro

ok ; it is more a manjaro user problem than a tor problem.
do not enable AUR repository ; do not accept error on extraction ;

Download tor linux AND the sig file then verify from the terminal the integrity of the package ; the sig file is on the download page - open an empty document then copy & paste the sig file.
there are on your download folder two files now , a torxz and its sig so go there by this command ;
$ cd /home/USER/Downloads

and let's verify by this one the safety of your downloaded package
$ gpg --verify tor-browser-linux32-5.0.4.sig tor-browser-linux32-5.04_en-US.tar.xz

a key (ID) appears on the screen ; now, add this key (e.g D40814E0) by this command
$ gpg --keyserver x-hkp://pool.sks-keyservers.net --recv-keys ID D40814E0

of course you can do that also
$ gpg --fingerprint D40814E0

now jf you do that
$ gpg --verify tor-browser-linux32-5.0.4.sig tor-browser-linux32-5.04_en-US.tar.xz
it will write GOOD SIGNATURE

Since the update I cannot

Since the update I cannot access a lot of sites or Chats? I get a Rotten Onion message stating US Jurisdiction prevents forwarding to site?

thank you. Love Tails

thank you.

Love Tails

hi. how risky is to use old

hi. how risky is to use old tbb of 3.x.x OR 4.x.x . I know its bad... but does it automatic mean that you get hacked very easy?

5.0.4 just won't open. 3

5.0.4 just won't open. 3 instances of Firefox open in the task manager, any ideas? Running on windows xp

Tor 5.04 worked the first

Tor 5.04 worked the first time I used it. Then it wouldn't open. I also got several Firefox.exe in the task manager. Couldn't end the processes. My tor is stored on a flash drive. Deleting the Tor Browser is a pain. Deleti9ng the folder doesn't delete everything. Firefox remains. Because the firefox.exe is running, it won't let me eject my flash drive, safely. But I did, and then I restart my computer. Then I insert the flash drive and then right click on the Tor Folder and it is finally gone. I reinstalled Tor Browser 5.04 2 more times and I can't get it to open at all. So I deleted it two more times.

hello please how can i

hello please how can i remove this tor from my pc
today it came on my pc and destroyed totalz the function of my pc
please help me to remove this tor or rsa 2048 from my pc
thanks

you can make a donation

you can make a donation first and give your pc to a tor user (me e.g.) lol.

browser.safebrowsing.download

browser.safebrowsing.downloads.enabled should be set by default to false

Wrong Exit Nodes v.

Wrong Exit Nodes

v. 5.0.4
ExitNodes {FI} takes me to Romania instead of Finland.

Checked this several times/days.
Very strange.
This did not happen with v.5.0.3