Exit Zen
2
English type: Plain text
[[!meta title="Iceweasel exposes a rare User-Agent"]]
0/540 · 54
5
English type: Plain text
A Torbutton bug ([[!debbug 595375]]) makes Iceweasel expose a recognizable User-Agent when the "Spoof US English Browser" setting is disabled, which is the case in T(A)ILS 0.5.
0/1760 · 176
6
English type: Title #
Impact
0/100 · 6
7
English type: Plain text
System administrators, webmasters and anyone able to read the logs of a website are able to single out, amongst the visitors, the ones that are using an affected Torbutton extension *and* have explicitly disabled the "Spoof US English Browser" setting.
0/2520 · 252
8
English type: Plain text
While T(A)ILS users are obviously not the only ones in this case, such a bug eases fingerprinting.
0/980 · 98
9
English type: Plain text
The client IP address recorded in the webserver logs for such a connection is the one of the Tor exit node used by the T(A)ILS user at this time.
0/1450 · 145
10
English type: Title #
Solution
0/100 · 8
11
English type: Plain text
Upgrade to T(A)ILS 0.6.
0/230 · 23
12
English type: Title #
Mitigation on T(A)ILS 0.5
0/250 · 25
13
English type: Plain text
The following steps need to be done immediately after boot, **before** running Iceweasel.
0/890 · 89
14
English type: Plain text
Run the following command in a terminal:
0/400 · 40
16
English type: Plain text
... this opens a text editor. Delete the line that says:
0/560 · 56
17
English type: Plain text
user_pref("extensions.torbutton.spoof_english", false);
0/570 · 57
18
English type: Plain text
... then save and quit. You can now run Iceweasel.
0/500 · 50
19
English type: Plain text
Beware! Changing this setting in the Torbutton preferences window is **not** effective.
0/870 · 87
20
English type: Title #
Affected versions
0/170 · 17
21
English type: Plain text
Torbutton 1.2.5, included in T(A)ILS 0.5
0/400 · 40
The translation has come to an end.