Hacker News Reader

Comment by comex | Hacker News Reader

FBI has, in one case where the exploit was spotted and made public (and they probably knew it would be, since it was deployed so widely), exploited an out-of-date version of TorBrowser. No guarantee that they don't use zero-days elsewhere or won't in the future.

This is why I think TorBrowser should switch to Chromium. Whatever you have to say about Google, Chromium is unambiguously more secure than Firefox.

View on HN

Unfortunately, quite a lot of browser changes are required to prevent information leaks when using Tor, and it's not clear that Chromium can feasibly be made suitable or where the developer time to do it would come from. (That's I think part of the reason TorBrowser is based on Firefox ESR - they can't keep up with the new features otherwise. I don't believe Chromium has equivalent extended-support releases; in order to get security fixes you have to upgrade to new versions with new features and new information leaks.)

If you screw up and miss something, the FBI might not even need to exploit a bug in order to find users' IP addresses, they could just use documented browser features to get users to connect to their honeypot using their real IP addresses.

This is an artifact of how Tor works. VPN services don't suffer from this issue because all traffic gets routed via the VPN at the operating system level.

Even then there's the issue of various browser and OS fingerprinting attacks which the current Tor Browser goes to significant effort to prevent. Tor actually supports a VPN-like mode, at least on Linux, but it can only protect against some classes of attack.

Right. I don't believe that process sandboxing would have prevented what the FBI wanted to do here: unmask the identities of Tor users. I would be surprised if compromising a renderer at the moment didn't give you access to enough information for law enforcement to figure out who was accessing the site. (See the list of current leaks on the Site Isolation description [1] just to name a few.)

As a practical example, the FBI could slurp usernames and passwords from other sites the user has been to, then subpoena them to determine if they'd ever logged in without Tor, and so forth.

[1]: http://www.chromium.org/developers/design-documents/site-iso...

If you actually care about security and privacy, then there are plenty of Firefox extensions that go far beyond what can be done with Chromium. Even just adding NoScript to Firefox closes whatever gap still exists.

(Aside from the process-per-tab model, what's Chromium got out of the box that Firefox still lacks?)

NoScript equivalent for Chrome is "HTTP Switchboard"

Only superficially, and even then, they're not really equivalent. HTTP Switchboard has some blocking features that NoScript users need to use things like AdBlock Plus and RequestPolicy to get. NoScript's features aside from script and plugin blocking are completely beyond the scope of HTTP Switchboard, and some of them are completely unique to NoScript.

Hardly, but chrome does has an option to disable Javascript on a per site basis, similar to NoScript.

Sandboxed processes. There are limits to what code running in chrome can do. AFAIK firefox provides no such guarantees.

Firefox is moving in that direction at least: https://wiki.mozilla.org/Electrolysis

It's certainly true that using NoScript prevents most browser exploits (though not all), and that if you're strongly concerned about privacy, you should use it. And make sure not to disable it for any trusted darknet sites, since as this article reminds, they have a habit of being compromised... I'm not trying to be sarcastic - this is totally reasonable for many use cases.

But the default browser bundle leaves JavaScript enabled by default for good reasons[1], and if you want higher security with JavaScript enabled and/or against non-JS exploits, Chrome's process sandbox is a big deal, and will probably keep it significantly more secure than Firefox for a good amount of time.

The TorBrowserBundle is based on Firefox ESR. This is a stable release with extended support for security patches. There is no equivalent for Chromium, which is essentially the unstable track of the Chrome browser.

Unambiguously? This seems like a strong statement. What makes you say that?

Until Firefox tightens their sandbox, I believe any exploit can still use system calls to directly create TCP sockets.

Chrome forces sandboxed processes to use its network stack; if that's been configured to use Tor, it shouldn't end up revealing your IP and therefore identity.

comex's statement is correct. Chrome/Chromium was designed from the ground up for fine-grained sandboxing of renderers and extensions; Firefox's single-process design currently prevents it from implementing any similar layered defense.

Mozilla acknowledges as much with the mission statement of their Electrolysis project:

https://wiki.mozilla.org/Electrolysis

Hopefully Firefox's situation will improve in the near future—at the very least, we'll all benefit if Chrome has a viable competitor. But in the meantime Firefox absolutely is behind Chrome in the security department.

I think they should consider opening a conversation with Mozilla and see what can be worked out.

Reply on news.ycombinator.com