Possible to extract all/most FF settings from TBB?

Discussion in 'privacy problems' started by Palancar, Nov 13, 2014.

  1. Palancar

    Palancar Registered Member

    Joined:
    Oct 26, 2011
    Posts:
    2,402
    This might seem like a strange question, but it interests me. I was trying to imagine how I could extract the FF settings from a TBB? Know it seems out there! Lets walk through what I am thinking together.

    There are times that TOR slows to a crawl (TBB or Whonix). Believe me I am on it hours a day. Much of the time I am merely reading around and doing things where I want to remain private, but its not really a security issue per se during those select times.

    I was thinking that if I could manage to extract the TBB FF settings, which would retain the same security config, it would be handy to have and use. I would use this FF inside of a VM - vpn2/3 in my chain. The TOR devs have done such a great job tightening up FF, so I figure why not capitalize on those settings? A multiple vpn chain is much faster than TOR, and assuming security is in place it would be fine for what I need to do.

    There clearly would be some security sacrifices by leaving TOR, which in and of itself is a three hop circuit that auto-rotates at 10 minute intervals. Also, no deep web outside of TOR on this end.

    About all I can think of is to list the features (https everywhere, canvas fingerprinting, etc...) and add them manually to a conventional FF instance.

    Anyone else have a better way to approach this?
     
    Last edited: Nov 13, 2014
  2. Palancar

    Palancar Registered Member

    Joined:
    Oct 26, 2011
    Posts:
    2,402
  3. TheWindBringeth

    TheWindBringeth Registered Member

    Joined:
    Feb 29, 2012
    Posts:
    2,171
  4. Palancar

    Palancar Registered Member

    Joined:
    Oct 26, 2011
    Posts:
    2,402
    That looks promising. They changed the folders of the TBB a couple of revisions ago. The links are dated Feb 14 of this year. I have to figure out how to add this edit from the link:

    ----
    Use Tor Browser without bundled Tor [*NIX]

    Add to /etc/environment...

    ## Deactivate tor-launcher,
    ## a Idalia replacement as browser extension,
    ## to prevent running Tor over Tor.
    ## https://trac.torproject.org/projects/tor/ticket/6009
    ## https://gitweb.torproject.org/tor-launcher.git
    export TOR_SKIP_LAUNCH=1

    ...and reboot.

    ----

    You would think that is simple enough to try! I don't have TBB installed. Its a standalone folder on my linux VM desktop. I have nothing to lose by editing in the command line once I can figure out how to find the correct file and path to add the edit in my terminal.

    Where to put: export TOR_SKIP_LAUNCH=1 ?

    I appreciate the steer and I am working on tracking this down. If one of you linux terminal "geeks" (LOL) knows where this goes please jump in.

    I just want to experiment with surfing using the TBB browser tweaks without the baggage of the TOR circuit, if only to say I've done it.
     
  5. TheWindBringeth

    TheWindBringeth Registered Member

    Joined:
    Feb 29, 2012
    Posts:
    2,171
  6. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
  7. Palancar

    Palancar Registered Member

    Joined:
    Oct 26, 2011
    Posts:
    2,402
    OK I got it working fine. Thanks for the steer MrBrian.

    How many of you guys have ever thought of running a locked down (security wise) TOR browser but didn't want to use TOR to do it? I offer the contention that using the TOR FF browser, which is very well crafted for privacy, is better than you can do on your own trying to jury rig a normal FF instance. So will it work well with a normal VPN connection? You bet it will!! My line is screaming along on vpn 2 as a trial. While the TOR browser configuration has great tweaks and bells compared to the normal FF instance, remember that it does nothing to hide your IP and stuff. I simply replaced the normal FF instance in my last VM at the end of a vpn chain. It is that chain that is handling the IP and routing. The TOR FF browser is simply there to try and keep the browser from betraying me by handing out information. e.g. fingerprinting, canvas stuff, etc......

    Runs great give it a try and see how you like it. If you screw up any edit (get confused) just delete the folder and paste over a new one from the clean one you kept!!

    So here is how to do it. Simple risk free approach.

    1. Download the TBB bundle to your desktop and extract it to a folder there.

    2. Keep that original TBB download clean and copy the TBB folder to your desktop for use.

    3. open TOR, which will verify all is working normally. With the browser open in the address window type ------ about:config
    you will see a warning but proceed anyway so you can edit the browser.

    4. In about:config set extensions.torlauncher.start_tor to false (its actually a toggle from true)

    5. Now go to the TOR button on the browser and click on it. Select preferences. There you will click on Transparent Torification and OK and then close the browser down.



    Thats it. BTW - for this post I did not edit out the warning flag that will still pop up when you open the browser. I left it there to remind myself that I am NOT on TOR. I spend lots of time on TOR so I left the warning page. I set my homepage for startpage so it comes up immediately after I close the warning flag page. You can edit this warning away if you want to. I am leaving it so I don't ever think I am on TOR when I am not.

    This runs slick!!
     
  8. inka

    inka Registered Member

    Joined:
    Oct 21, 2009
    Posts:
    426
    If the goal is to use TorBrowser as an firefox alternative/replacement, without ever using TOR:

    1) Install TorBrowserBundle
    2) launch TorBrowser
    3) navigate to the AddonsManager page and disable the TOR-related extensions, then close/shutdown the browser

    Afterward, launch TorBrowser via the "firefox.exe" within one of the TorBrowser install subdirectories (exact path has varied across TBB versions)

    I often run TorBrowser and stock Mozilla Firefox side-by-side, at the same time. They don't interfere with each other.
     
  9. Palancar

    Palancar Registered Member

    Joined:
    Oct 26, 2011
    Posts:
    2,402
    I have been using TBB without TOR enabled as indicated above. There are some instances when I must have the speed that isn't available in TOR. So the modified TBB at the end of a VPN chain works like a charm.

    I just don't feel like I have the personal expertise to take a normal FF instance and harden it to the level TBB has out of the box. Turning off TOR but keeping the "fine tuning" is kind of nice. Sure runs slick on my end.
     
  10. Lyx

    Lyx Registered Member

    Joined:
    Apr 4, 2009
    Posts:
    149

    Why not just use the JonDoFox profile (maybe on portable FF) ?

    I think JonDoFox profile is even more secure than TorBrowser (Noscript is better configured for example), although when specifically browsing the Tor network, Tor Browser is better than JonDoFox.

    https://anonymous-proxy-servers.net/en/jondofox.html
     
  11. Palancar

    Palancar Registered Member

    Joined:
    Oct 26, 2011
    Posts:
    2,402
    I feel really comfortable using TBB without TOR. The TBB is very securely configured and man is that browser bundle fast even on VPN3! Plus even though I have turned TOR off the browser is still a "self contained" folder on my linux VM desktop. I keep a clean copy and replace it daily in seconds!! Another thing is that I allow it to check TOR for updates so it will still notify me if the TOR dev's issue a new TBB version. I say let the TOR dev's use their expertise to lock down FF and I'll simply keep it updated as released by their schedule. Works nicely here.

    I still mostly use TOR/Whonix, such as for this post. There are times I need a speed or "usage" criteria that TOR circuits cannot deliver.
     
  12. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    @Palancar: are you using the same browser for Tor and non-Tor?
     
  13. Palancar

    Palancar Registered Member

    Joined:
    Oct 26, 2011
    Posts:
    2,402
    Yes - but a clarification: know that I spend most of my time on TOR itself and that is after VPN(s) in the circuit. There are those times when I need something that TOR can't do, mostly speed requisite events. When those times come along I use a normal TBB with TOR turned off via about:config settings. That browser activity is isolated in a specially reserved VM NAT'd to the host, which is still running over VPN tunnels. NEVER use any browser out in the open non-tunneled and/or outside of a VM for isolation!

    I have been thinking about how such a browser config would "fingerprint" to my psuedo id's. How many folks are running TBB in this fashion? More than you might think, but certainly not all that common. e.g. - my making this post using a normal TBB browser would show a typical/generic TOR user. Fine. When logged on downloading a file on the "configured" TOR-less TBB browser I might stand out just a bit with a fingerprint. Who knows where that might go?

    MrBrian, I would love to hear your thoughts on how this config might make me stand out. I don't use it too often but its part of my "tool belt" when needed, and it is needed. With TOR I can't use multiple VPN's and still pull 40-50 + meg through the pipe. I don't want to download a 2 Gig file at 3 meg. Know what I mean?
     
  14. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    I am concerned if sharing state between Tor and non-Tor browser usage would expose you to the likes of this.
     
  15. Palancar

    Palancar Registered Member

    Joined:
    Oct 26, 2011
    Posts:
    2,402
    That was a good read. I think I have that covered (hope anyway). TBB is pretty good at clearing out cookies. My non-TOR use of the TBB ONLY happens in a separate VM and that is behind no less than 2 VPN's obfuscating things from my ISP. Plus once used I blow away the TBB folder on the VM desktop and copy over a brand new virgin TBB non-TOR folder. In other words my non-TOR TBB browser is only used once so there is never a history or record of any kind.

    I am really banking on the fact that I attempt isolation via "tight" VM's. As long as nothing is able to break out and make it to the host I should be OK. Hoping!!!!!!!!!!!
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.