A sandboxed version of the Tor Browser was released over the weekend, and while there are still some rough edges and bugs – potentially major, according to the developer– it could be the first step toward protecting Tor users from recent de-anonymization exploits.
Yawning Angel, a longtime Tor developer, unveiled version 0.0.2, in a post to the Tor developers mailing list on Saturday.
Official binaries, available only for Linux distributions, won’t be out until later this week. Until then, if prospective users want to try it out themselves, they can build it by downloading the code on GitHub, according to the developer.
While the alpha release of a piece of software wouldn’t usually merit much attention, the fact that Tor Browser has been targeted with several exploits intended to unmask users over the past two years makes it a welcomed announcement for users who value their privacy.
Developers with both Firefox and the Tor Browser, which is partially built on open source Firefox code, had to scramble last month to fix a zero-day vulnerability that was being exploited in the wild to unmask Tor users.
The FBI targeted Tor Browser users in 2015 after officials with the service seized servers belonging to a child pornography site called Playpen. Instead of shuttering the site, the FBI used a network investigative technique to harvest the IP and MAC addresses of Tor users who visited the site for 13 days.
In the sandboxed version of Tor, exploits against the browser are confined to the sandbox, limiting the disclosure of information about whatever machine the browser is running on. Data like files and legitimate IP and MAC addresses is hidden as well.
The browser has come a long way to even get to alpha mode; In October, when Yawning Angel discussed the prototype in a Q&A with the Tor Project, he called it “experimental,” “not user friendly” and something that only worked on his laptop. The developer first mentioned that he was tinkering with a sandboxed version of the browser back in September, although at that point the concept was even more rudimentary.
Yawning Angel has sandboxed the Tor Browser! https://t.co/5pbBvJgUn4 pic.twitter.com/q8lHA6Fib6
— The Tor Project (@torproject) October 11, 2016
The browser is built around bubblewrap, a sandboxing utility for Linux designed to restrict an application’s access to parts of the operating system or user data. Since it is an alpha release however, Yawning Angel is stressing users not to assume the browser isn’t without its flaws.
“There are several unresolved issues that affect security and fingerprinting,” the developer wrote in a README packaged with code for the sandboxed Tor Browser on GitHub. Users seeking strong security should pair the sandbox with a Linux-based operating system designed to thwart exploit and malware attacks, such as Qubes, Subgraph, or Tails, he adds.
While major browsers such as Chrome, Edge and Safari operate in secure sandboxes, developers with Tor haven’t had the time to build a sandbox until now. In the Q&A that Yawning Angel gave in October, he acknowledged this is his third time trying to write code for the sandbox and that the process is “incredibly complicated” and not without “lots of design problems.”
“We never have time to do this. We have a funding proposal to do this but I decided to do it separately from the Tor Browser team. I’ve been trying to do this since last year,” Yawning Angel said at the time.
