Privacy threat due to 2 out-of-the-box bugs in ubuntu 13.10 Unity Tor Browser

[bashiergui]

1. The Tor Browser launcher is confusingly mixed up with Firefox.
2. The Vidalia Control Panal doesn't get its own launcher.

I don't understand the issue. Are you using a regular browser simultaneously with a Tor browser? That's a bad idea because it's easy to confuse the two browsers and there are various attacks that could identify you.


When I start up the Tor browser bundle I do it on the command line with

./start-tor-browser

That launches the vidalia control panel and then the firefox Tor browser. I have no issues or concern with this setup.

[Damico]

Are you using a regular browser simultaneously with a Tor browser?

All three scenarios are bad on ubuntu:
1. Using both Tor Browser Bundle & native Fireofox (they're mixed up together)
2. Using just Tor (you don't know if you're using Tor or if you're using Firefox without doublechecking every single time)
3. Using just Firefox (again, you can't tell - since only on Ubuntu, they're mixed up together).

Of course, the safest thing to do, since Ubuntu mixed them up, is to install one or the other.
That necessitates having to boot to two different operating systems, one with JUST Firefox, the other with JUST the Tor Browser Bundle.
From a security standpoint, that might not be a bad idea (having a separate OS just for privacy); but the point is that it shouldn't have to be this hard to keep Tor separate from Firefox.
And, it's only this hard, on Ubuntu.

That's a bad idea because it's easy to confuse the two browsers and there are various attacks that could identify you.

Not on all other operating systems.
On Windows, for example, the two icons don't look at all the same. So, you KNOW which one you're opening up from the get go.
Plus, if both are running and iconified, the icons are extremely different, so, again, you KNOW which one you're opening up.
Once you open them up, they look similar - but switching between them is clear on all other operating systems other than on Ubuntu.
[QUOTE=bashiergui;12910439]

When I start up the Tor browser bundle I do it on the command line with

./start-tor-browser

That launches the vidalia control panel and then the firefox Tor browser. I have no issues or concern with this setup.

OK. So now you have the Tor Browser Bundle started.
Let's say you're a busy man, and you have a few windows open, some of which are Firefox windows.
How do you tell the difference between them?
(And, it's cheating to say you only have a single browser window open - because if we all used only one application at a time, we don't need launchers and graphical desktops in the first place.)

Also, do you realize that you can't pin the Tor Browser Bundle to the desktop on Ubuntu?
So, sure, you can launch it from the command line - but what is the point of the desktop icons then? For show?

Also, do you realize that you can't discern between an existing Firefox and an existing Tor browser when both are iconified?
There is no way to tell the difference between the two on Ubuntu, but, they're clearly different on all other operating systems.
It's mostly at this point that Ubuntu becomes the problem instead of the solution.

If you're not clear what I'm pointing out, it's best to open up a couple Firefox processes and then a Tor Browser Bundle process.
Then simply try to tell the difference between them, as you switch from one to the other.
Then, do that same feat on all other operating systems.

The moment you try it on any other operating system, you'll see what the problem is. Instantly.

[seth-arnold]

The moment you try it on any other operating system, you'll see what the problem is. Instantly.

Can you attach screenshots to one of the bug reports? I can't figure out what you're trying to say and I suspect a handful of screenshots will elucidate much. Spending a few hundred dollars on a Windows license isn't on the top of my todo list..

[Damico]

Can you attach screenshots to one of the bug reports? I can't figure out what you're trying to say and I suspect a handful of screenshots will elucidate much. Spending a few hundred dollars on a Windows license isn't on the top of my todo list..

OK. I will snapshot a run on Windows and then another run on Ubuntu and show the difference and attach the screenshots to the bug report.

[bashiergui]

I've used the Tor browser bundle on Windows & Ubuntu. I understand what you're saying. If you want to create a shortcut/ icon for starting the TBB on Ubuntu, I'm sure you can find a tutorial somewhere (I remember seeing one a while back, probably stackexchange but can't remember). The beauty about Linux is that you can customize it as you want.

Seems like more of a feature request than a bug report, but nonetheless it should be filed with Tor, not Ubuntu, as others have said.


As for keeping the browsers separate I am suggesting that you consider your practices when you use a Tor and non-Tor browser simultaneously. You could be compromising your privacy because there are some timing attacks that could reveal your identity.

[Frogs Hair]

As for keeping the browsers separate I am suggesting that you consider your practices when you use a Tor and non-Tor browser simultaneously. You could be compromising your privacy because there are some timing attacks that could reveal your identity.

Exactly ! From the website and notice it states helps rather than promising anonymity.

Tor is free software and an open network that helps you defend against traffic analysis, a form of network surveillance that threatens personal freedom and privacy,