Skip to content

Commit

Permalink
Merge branch 'develop' of github.com:micahflee/torbrowser-launcher in…
Browse files Browse the repository at this point in the history
…to develop
  • Loading branch information
micahflee committed Dec 13, 2022
2 parents 501d0d8 + 79c19e6 commit c315e3c
Show file tree
Hide file tree
Showing 8 changed files with 271 additions and 13 deletions.
5 changes: 1 addition & 4 deletions LICENSE
Original file line number Diff line number Diff line change
@@ -1,7 +1,4 @@
Tor Browser Launcher
https://github.com/micahflee/torbrowser-launcher/

Copyright (c) 2013-2021 Micah Lee <[email protected]>
Copyright (c) 2013-2022 Micah Lee <[email protected]>

Permission is hereby granted, free of charge, to any person
obtaining a copy of this software and associated documentation
Expand Down
2 changes: 1 addition & 1 deletion build_deb.sh
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
#!/bin/sh

VERSION=`cat share/torbrowser-launcher/version`
VERSION=$(cat share/torbrowser-launcher/version)

# clean up from last build
rm -r build deb_dist
Expand Down
2 changes: 1 addition & 1 deletion build_rpm.sh
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
#!/bin/sh

VERSION=`cat share/torbrowser-launcher/version`
VERSION=$(cat share/torbrowser-launcher/version)

# clean up from last build
rm -r build dist
Expand Down
255 changes: 255 additions & 0 deletions po/tr.po
Original file line number Diff line number Diff line change
@@ -0,0 +1,255 @@
# SOME DESCRIPTIVE TITLE.
# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
# This file is distributed under the same license as the PACKAGE package.
# Oğuz Ersen <[email protected]>, 2022.
#
msgid ""
msgstr ""
"Project-Id-Version: \n"
"Report-Msgid-Bugs-To: \n"
"POT-Creation-Date: 2021-11-27 08:41+0300\n"
"PO-Revision-Date: 2022-03-06 09:00+0300\n"
"Last-Translator: Oğuz Ersen <[email protected]>\n"
"Language-Team: Turkish <tr>\n"
"Language: tr\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"Plural-Forms: nplurals=1; plural=0\n"

#: common.py:159
#, python-brace-format
msgid "Error creating {0}"
msgstr "{0} oluşturulurken hata"

#: common.py:270
#, python-brace-format
msgid "Cannot create directory {0}"
msgstr "{0} dizini oluşturulamıyor"

#: common.py:273
#, python-brace-format
msgid "{0} is not writable"
msgstr "{0} yazılabilir değil"

#: common.py:280
msgid "Creating GnuPG homedir"
msgstr "GnuPG ana dizini oluşturuluyor"

#: common.py:371
#, python-format
msgid "Could not import key with fingerprint: %s."
msgstr "%s parmak izine sahip anahtar içe aktarılamadı."

#: common.py:378
msgid "Not all keys were imported successfully!"
msgstr "Tüm anahtarlar başarıyla içe aktarılmadı!"

#: __init__.py:71 launcher.py:528
msgid "Tor Browser Launcher"
msgstr "Tor Browser Başlatıcı"

#: __init__.py:72
msgid "By Micah Lee, licensed under MIT"
msgstr "Micah Lee tarafından, MIT lisansı altında lisanslandı"

#: __init__.py:73
#, python-brace-format
msgid "version {0}"
msgstr "sürüm {0}"

#: launcher.py:86
msgid "Downloading Tor Browser for the first time."
msgstr "Tor Browser ilk kez indiriliyor."

#: launcher.py:89
msgid ""
"Your version of Tor Browser is out-of-date. Downloading the newest version."
msgstr "Tor Browser sürümünüz güncel değil. En yeni sürüm indiriliyor."

#: launcher.py:110
msgid "Downloading over Tor"
msgstr "Tor üzerinden indiriliyor"

#: launcher.py:121
msgid "Tor Browser"
msgstr "Tor Browser"

#: launcher.py:140
msgid "Start"
msgstr "Başlat"

#: launcher.py:190
msgid "Yes"
msgstr "Evet"

#: launcher.py:194
msgid "Exit"
msgstr "Çıkış"

#: launcher.py:208 settings.py:147
msgid "Cancel"
msgstr "İptal"

#: launcher.py:247 launcher.py:268 launcher.py:277 launcher.py:316
#: launcher.py:319
msgid "Downloading"
msgstr "İndiriliyor"

#: launcher.py:258
msgid "Latest version: {}"
msgstr "En son sürüm: {}"

#: launcher.py:262
msgid "Error detecting Tor Browser version."
msgstr "Tor Browser sürümü algılanırken hata oluştu."

#: launcher.py:292 launcher.py:397
msgid "Verifying Signature"
msgstr "İmza Doğrulanıyor"

#: launcher.py:296
msgid "Extracting"
msgstr "Çıkartılıyor"

#: launcher.py:300
msgid "Running"
msgstr "Çalıştırılıyor"

#: launcher.py:304
msgid "Starting download over again"
msgstr "İndirme yeniden başlatılıyor"

#: launcher.py:316 launcher.py:335
msgid "(over Tor)"
msgstr "(Tor üzerinden)"

#: launcher.py:331
msgid "Downloaded"
msgstr "İndirildi"

#: launcher.py:439
msgid "Installing"
msgstr "Kuruluyor"

#: launcher.py:448
#, python-brace-format
msgid "Tor Browser Launcher doesn't understand the file format of {0}"
msgstr "Tor Browser Başlatıcı, {0} dosya biçimini anlamıyor"

#: launcher.py:479
msgid ""
"The version of Tor Browser you have installed is earlier than it should be, "
"which could be a sign of an attack!"
msgstr ""
"Kurduğunuz Tor Browser sürümü olması gerekenden daha eski ve bu bir saldırı "
"işareti olabilir!"

#: launcher.py:496
msgid "Downloading Tor Browser over again."
msgstr "Tor Browser tekrar indiriliyor."

#: launcher.py:568 launcher.py:582 launcher.py:591
msgid "Download Error:"
msgstr "İndirme Hatası:"

#: launcher.py:570
msgid "You are currently using a non-default mirror"
msgstr "Şu anda öntanımlı olmayan bir yansı kullanıyorsunuz"

#: launcher.py:572
msgid "Would you like to switch back to the default?"
msgstr "Öntanımlı olana geri dönmek ister misiniz?"

#: launcher.py:585
msgid "Would you like to try the English version of Tor Browser instead?"
msgstr "Bunun yerine Tor Browser'ın İngilizce sürümünü denemek ister misiniz?"

#: launcher.py:607
#, python-brace-format
msgid ""
"Invalid SSL certificate for:\n"
"{0}\n"
"\n"
"You may be under attack."
msgstr ""
"Şunun için geçersiz SSL sertifikası:\n"
"{0}\n"
"\n"
"Saldırı altında olabilirsiniz."

#: launcher.py:610
msgid "Try the download again using Tor?"
msgstr "Tor kullanarak indirme tekrar denensin mi?"

#: launcher.py:620
#, python-brace-format
msgid ""
"Error starting download:\n"
"\n"
"{0}\n"
"\n"
"Trying to download over Tor. Are you sure Tor is configured correctly and "
"running?"
msgstr ""
"İndirme başlatılırken hata oluştu:\n"
"\n"
"{0}\n"
"\n"
"Tor üzerinden indirmeye çalışılıyor. Tor'un doğru yapılandırıldığından ve "
"çalıştığından emin misiniz?"

#: launcher.py:626
#, python-brace-format
msgid ""
"Error starting download:\n"
"\n"
"{0}\n"
"\n"
"Are you connected to the internet?"
msgstr ""
"İndirme başlatılırken hata oluştu:\n"
"\n"
"{0}\n"
"\n"
"İnternete bağlı mısınız?"

#: settings.py:47
msgid "Tor Browser Launcher Settings"
msgstr "Tor Browser Başlatıcı Ayarları"

#: settings.py:51
msgid "Download over system Tor"
msgstr "Sistem Tor'u üzerinden indir"

#: settings.py:59
msgid "Force downloading English version of Tor Browser"
msgstr "Tor Browser'ın İngilizce sürümünü indirmeye zorla"

#: settings.py:69
msgid "Tor server"
msgstr "Tor sunucusu"

#: settings.py:85
msgid "Status: Installed"
msgstr "Durum: Kurulu"

#: settings.py:87
msgid "Status: Not Installed"
msgstr "Durum: Kurulu Değil"

#: settings.py:90
msgid "Install Tor Browser"
msgstr "Tor Browser'ı Kur"

#: settings.py:97
msgid "Reinstall Tor Browser"
msgstr "Tor Browser'ı Yeniden Kur"

#: settings.py:122
msgid "Mirror"
msgstr "Yansı"

#: settings.py:140
msgid "Save && Exit"
msgstr "Kaydet && Çık"
8 changes: 4 additions & 4 deletions ppa_release.sh
Original file line number Diff line number Diff line change
Expand Up @@ -12,18 +12,18 @@
# login = anonymous
# allow_unsigned_uploads = 0

VERSION=`cat share/torbrowser-launcher/version`
VERSION=$(cat share/torbrowser-launcher/version)

# Make a source pacakge
# Make a source package
rm -rf deb_dist
python3 setup.py --command-packages=stdeb.command sdist_dsc

# Sign it
cd deb_dist/torbrowser-launcher-$VERSION
cd "deb_dist/torbrowser-launcher-$VERSION"
dpkg-buildpackage -S
#dpkg-buildpackage -S -pqubes-gpg-client-wrapper -k927F419D7EC82C2F149C1BD1403C2657CD994F73
cd ..

# Push it to the ppa
dput ppa torbrowser-launcher_$VERSION-1_source.changes
dput ppa "torbrowser-launcher_$VERSION-1_source.changes"
cd ..
6 changes: 3 additions & 3 deletions security_design.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Tor Browser Launcher Security Design

This document could be improved. At the moment it's copy/pasted verbatum from a post to the [debian bug tracker](http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=752275).
This document could be improved. At the moment it's copy/pasted verbatim from a post to the [debian bug tracker](http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=752275).

## TLS/x.509 security

Expand All @@ -12,14 +12,14 @@ torbrowser-launcher doesn't rely on the CA infrastructure. The only TLS it does

Downgrade attacks shouldn't be possible, unless they're committed by Tor devs themselves. If an attacker captures a valid old request to https://check.torproject.org/RecommendedTBBVersions that claims that the current version is an older version than what's currently installed, torbrowser-launcher prevents it from installing. (And by "installing" I mean extracting to the user's home dir.)

However, there is the scenereo where the user has set a third-party mirror to download from instead of the default. The third-party mirror could serve a tarball and sig that have filenames of the latest version, but are actually an older version. This attack is mitigated by the fact that all mirror options use HTTPS -- though none of the mirror certs are pinned, so in this case it would rely on CA infrastructure. This is an edge case, and would only work against users who are using a non-default mirror, and who also have access to a trusted CA signing key.
However, there is the scenario where the user has set a third-party mirror to download from instead of the default. The third-party mirror could serve a tarball and sig that have filenames of the latest version, but are actually an older version. This attack is mitigated by the fact that all mirror options use HTTPS -- though none of the mirror certs are pinned, so in this case it would rely on CA infrastructure. This is an edge case, and would only work against users who are using a non-default mirror, and who also have access to a trusted CA signing key.

## Installing Tor Browser system-wide

You cannot install Tor Browser system-wide. It's released by the Tor Project as a bundle. There's a lot of code in there that specifically prevents it from touching any other files outside of it's own directory. All files need to be owned by current user, and it's designed to be runnable off of a USB stick. A long time ago I put a bunch of work into tearing apart the "bundle"-ness of TBB to make it installable systemwide, and concluded it wasn't practical without the Tor devs releasing it as such. If you could install it systemwide, there would be no reason for torbrowser-launcher -- it could then just be a normal debian package.

## What secret keys/access attackers need to succeed

Yes, attackers that 1) have access to the trusted keys included with torbrowser-launcher and 2) have access to modify files on https://www.torproject.org/ or have access to its TLS key are able to get arbitrary code exec as the current user when they open Tor Browser. This may or may not include any of the Tor devs whose keys are included.
Yes, attackers that 1) have access to the trusted keys included with torbrowser-launcher and 2) have access to modify files on https://www.torproject.org/ or have access to its TLS key are able to get arbitrary code exec as the current user when they open Tor Browser. This may or may not include any of the Tor devs whose keys are included.

But like Holger said above, this is a feature, not a bug. This is the whole purpose of torbrowser-launcher, so users can automatically install TBB updates that are signed by Tor devs.
3 changes: 3 additions & 0 deletions share/applications/torbrowser-settings.desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,11 +10,13 @@ Name[pt_BR]=Navegador Tor (Configurações do Lançador)
Name[ru]=Tor Browser (настройки запуска)
Name[sv]=Inställningar för Tor Browser Launcher
Name[be]=Налады запускальніка Tor Browser
Name[tr]=Tor Browser Başlatıcı Ayarları
GenericName=Tor Browser Launcher Settings
GenericName[da]=Indstillinger for Tor Browser-opstarter
GenericName[hr]=Tor preglednik – postavke pokretanja
GenericName[hu]=Tor-böngésző indító beállításai
GenericName[be]=Налады запускальніка Tor Browser
GenericName[tr]=Tor Browser Başlatıcı Ayarları
Comment=Tor Browser Launcher Settings
Comment[cs]=Tor Browser Launcher nastavení
Comment[da]=Indstillinger for Tor Browser-opstarter
Expand All @@ -26,6 +28,7 @@ Comment[pt_BR]=Navegador Tor (Configurações do Lançador)
Comment[ru]=Tor Browser (настройки запуска)
Comment[sv]=Inställningar för Tor Browser Launcher
Comment[be]=Налады запускальніка Tor Browser
Comment[tr]=Tor Browser Başlatıcı Ayarları
Exec=torbrowser-launcher --settings
Terminal=false
Type=Application
Expand Down
3 changes: 3 additions & 0 deletions share/applications/torbrowser.desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,13 @@ Name[hr]=Tor preglednik
Name[hu]=Tor-böngésző
Name[pt_BR]=Navegador Tor
Name[sv]=Tor Browser
Name[tr]=Tor Browser
GenericName=Tor Browser
GenericName[be]=Tor Browser
GenericName[da]=Tor Browser
GenericName[hr]=Tor preglednik
GenericName[hu]=Tor böngésző indító
GenericName[tr]=Tor Browser
Comment=Launch Tor Browser
Comment[be]=Запуск Tor Browser
Comment[cs]=Spustit Tor Browser
Expand All @@ -20,6 +22,7 @@ Comment[da]=Start Tor Browser
Comment[hu]=Tor böngésző indító
Comment[pt_BR]=Navegador Tor
Comment[sv]=Starta Tor Browser
Comment[tr]=Tor Browser Başlat
Exec=torbrowser-launcher %u
Terminal=false
Type=Application
Expand Down

0 comments on commit c315e3c

Please sign in to comment.