Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add extension support for Tor windows #2761

Closed
AshGrowem opened this issue Dec 30, 2018 · 38 comments · Fixed by brave/brave-core#7304
Closed

Add extension support for Tor windows #2761

AshGrowem opened this issue Dec 30, 2018 · 38 comments · Fixed by brave/brave-core#7304

Comments

@AshGrowem
Copy link

AshGrowem commented Dec 30, 2018

Description

Brave only has extensions in regular windows, not Private or Tor. Navigating to chrome://extensions/in Private window takes you back to chrome://extensions/ in regular window. Navigating to chrome://extensions/in Tor window takes you to blank page with Extensions is not available to Guest users. on it.

Brave version (brave://version info)

Brave 0.58.18 Chromium: 71.0.3578.98 (Official Build) (64-bit)
Revision 15234034d19b85dcd9a03b164ae89d04145d8368-refs/branch-heads/3578@{#897}
OS Mac OS X
JavaScript V8 7.1.302.31
Flash (Disabled)
User Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36
Brave 0.60.5 Chromium: 72.0.3626.28 (Official Build) dev (64-bit)
Revision 997b1040b63bac324e815797ba52be0cd8f616ed-refs/branch-heads/3626@{#461}
OS Mac OS X
JavaScript V8 7.2.502.13
Flash (Disabled)
User Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.28 Safari/537.36

Reproducible on current release:

  • Release: Yes
  • Dev: Yes
@AshGrowem AshGrowem changed the title Add extensions to private / tor windows Add extensions to private & tor windows Dec 30, 2018
@Techguyprivate
Copy link

Allowing extensions in private windows or tor may leave browsing history , traces, cache, cookies & other things . Look at the warning in the picture below. I don't know with high certainty though.
screenshot from 2018-12-30 15-41-46

@srirambv srirambv added feature/extensions needs-discussion Although the issue is clear, we haven't yet reached a decision about the right solution. labels Jan 1, 2019
@srirambv srirambv added this to the 1.x Backlog milestone Jan 1, 2019
@AshGrowem
Copy link
Author

AshGrowem commented Jan 5, 2019

@Techguyprivate Totally forgot about that hidden toggle, thanks a bunch! Only works for incognito, but it seems from the comments below that Tor extensions are being worked on

@rebron
Copy link
Collaborator

rebron commented Jan 8, 2019

cc: @posix4e do you have an update?

@posix4e
Copy link
Contributor

posix4e commented Jan 8, 2019

Yep we have been working for this and we have something soon. I'll have my friend helping speak up on the issue.

@durch
Copy link

durch commented Jan 8, 2019

For sure, started looking into adding privacy pass for tor

@posix4e
Copy link
Contributor

posix4e commented Jan 8, 2019

@durch Is my friend helping on the project.

@tildelowengrimm
Copy link
Contributor

The controls should eventually be the same for Tor windows — just another toggle. But to do that, we ned to get a way from from using guest windows as the basis for Tor, and rebuild them as another type of session more like regular private windows.

@posix4e
Copy link
Contributor

posix4e commented Jan 10, 2019

@tomlowenthal So confirming the steps are

  • Rewrite the tor browser mode to work like private mode and remove the existing tor code
  • Add the ability to add an arbitrary extension to brave tor
  • Add privacy pass extension by default in tor mode. Should we support it with other modes as well?

Do we wanna install this extension by default, or just keep brave users hitting a ton of captchas til they install the extension?

@AshGrowem
Copy link
Author

AshGrowem commented Jan 11, 2019

@posix4e I hate captchas and I wasn't even aware of Privacy Pass until you just now mentioned it, and now that you did I'm definitely installing! 😅

I think we can safely assume that users would prefer a default installed extension to having to solve numerous captchas to the point of frustration and then only possibly researching for a solution (most would probably remain ignorant like myself). TorBrowser does the same thing with the "HTTPS Everywhere" extension and many others. Also, Privacy Pass is BSD-3 open source.

Also I found this other well-reviewed and open source anti-CAPTCHA extension, Buster

@posix4e
Copy link
Contributor

posix4e commented Jan 11, 2019

After further the discussion we will

  • add in privacy pass support by default into tor mode, and hopefully spruce it up so it’s nice
  • we will simultaneously add extension support while keeping a close lookout for security and privacy related issues as we go

@moo-im-a-cow
Copy link

i came here to request extensions in tor just so that i could add privacy pass
tor mode on the light web is literally unusable because of the cloudflare recapcha, which most of the time doesnt even let you complete the capcha, because the ip had already been spamming them and they flat out blocked it

@tildelowengrimm tildelowengrimm added the priority/P4 Planned work. We expect to get to it "soon". label Jan 24, 2019
@rebron rebron removed this from the 1.x Backlog milestone Feb 7, 2019
@durch
Copy link

durch commented Feb 26, 2019

Just an update, we're ramping up here, hopefully we'll have something to show soonish :)

@proteo
Copy link

proteo commented Mar 5, 2019

Looking forward for this, thanks!

@rulatir
Copy link

rulatir commented Jun 8, 2019

Any progress since March 5?

@gilhrpenner
Copy link

Any progress?

@durch
Copy link

durch commented Jul 22, 2019

We have a PR to add the Privacy Pass extension here -> brave/brave-core#2576. Extensions in TOR are WIP here -> brave/brave-core#2724, once both of those wrap up PP will be a part of Brave and will be usable in both Private and Tor modes.

@rulatir
Copy link

rulatir commented Jul 31, 2019

"Once both of those wrap up" is a rather fuzzy estimate.

@rulatir
Copy link

rulatir commented Aug 23, 2019

"Once these two prerequisites that have been stalled for months without any sign of progress (apart from bumping the target milestone without explanation) are satisfied, we will have this feature like immediately-ish".

@SHHSSH
Copy link

SHHSSH commented Dec 4, 2019

Any update on this? We understand the preliminary cautions that should be taken, but for rather secure extensions e.g; NoScript, just as it's in TOR Browser. This would be an added benefit to be available in Brave TOR Windows.

@bsclifton
Copy link
Member

@NuBz-GeN there are a lot of things to work through and this does have a priority set (relative to other priorities). There was a person working on this over a year ago but that work had been put on hold.

cc: @darkdh who has been solving other Tor issues and @diracdeltas who is familiar with prior work done

@bsclifton
Copy link
Member

bsclifton commented Nov 10, 2020

I believe @darkdh is looking at this now - can you confirm? 😄

@darkdh
Copy link
Member

darkdh commented Nov 10, 2020

Currently working on moving tor from session profile to OTR profile (#12429) which will be the ground work for extension support. So I will work on this issue next.

@shengchl
Copy link

Wow, two years in and we finally nearing the point extensions are allowed in Tor private tab. Kudos to everyone!

Question: why extensions will not route their traffic through tor?

@bridiver
Copy link
Contributor

bridiver commented Dec 16, 2020

@shengchalover extensions operate in one of two modes: split or spanning. In split mode there is a separate extension process for regular, tor and private modes. In spanning mode there is a single process which is attached to the regular profile. The extension itself specifies spanning or split mode (spanning is the default) and many extensions wouldn't function properly if we forced them into split mode (another option we looked at). This is exactly how it works in Chrome for regular/private mode, they just don't bother to tell you about it. Our compromise was a warning so you at least know what you're getting in to if you allow it.
https://developer.chrome.com/docs/extensions/mv2/manifest/incognito/

@bridiver
Copy link
Contributor

also @shengchalover that warning only appears for spanning mode extensions

@shengchl
Copy link

@bridiver thanks for the input. Is that possible to create a separate toggle to force spanning mode extensions into split mode? Users can then test extensions individually and keep those that work properly. The warning would notify them that this toggle may break extension. Possibly a better option rather then allowing all spanning extensions to do what they want in Tor mode.

@bridiver
Copy link
Contributor

bridiver commented Dec 16, 2020

@shengchalover unfortunately forcing split mode requires quite a bit of upstream patching which was the other part of the reason we went with the warning. We just can't justify the maintenance cost of the patches for such a niche use case. Remember that this only applies if the extension itself is making any network requests or storing other data about your Tor browsing history. We always display the warning because we don't know if the extension is making any requests or not. In most cases the data that is not going over Tor shouldn't expose anything about what you are doing on Tor unless you have some really sketchy extensions ;)

@shengchl
Copy link

@bridiver I was mainly interested in the design considerations that lead to such warning, thanks for clarifying.

In a sense Brave positions itself as privacy preserving browser, so if some features harm the characteristics of the anonymizing layer a bit that should not be a big deal.

Having a Tor network one click away from the main browser window is very handy and eliminates the need for vpn in lots of cases. I am truly glad we now one step closer in making the tor-browsing experience more smooth. Can't wait to run PrivacyPass, 1Password and DarkReader in a Tor tab!

Thanks again for the hard work on bringing this proposal to life!

@rebron rebron removed the needs-discussion Although the issue is clear, we haven't yet reached a decision about the right solution. label Jan 25, 2021
@rebron rebron changed the title Add extensions to Tor windows Add extension support for Tor windows Jan 25, 2021
@stephendonner
Copy link

stephendonner commented Jan 28, 2021

Verified, following the testplan from brave/brave-core#7304

Brave 1.20.93 Chromium: 88.0.4324.96 (Official Build) dev (x86_64)
Revision 68dba2d8a0b149a1d3afac56fa74648032bcf46b-refs/branch-heads/4324@{#1784}
OS macOS Version 11.1 (Build 20C69)
  1. added https://chrome.google.com/webstore/detail/1password-extension-deskt/aomjjhallfgjeglblehebfpbcfeobpgk/related?hl=en to Brave Dev
  2. clicked on "hamburger" menu -> extensions
  3. clicked details
  4. enabled Allow in private

Screen Shot 2021-01-28 at 11 41 03 AM

  1. file -> New Private Window with Tor
  2. opened browser-profile folder, extensions, aomjjhallfgjeglblehebfpbcfeobpgk
  3. chose Duplicate, copied to ~/Downloads/
  4. opened 4.7.5.90_0
  5. edited manifest.json to have "incognito": "split", saved

Screen Shot 2021-01-28 at 11 07 57 AM

  1. enabled Developer mode toggle
  2. clicked Load unpacked, pointed to newly copied and modified manifest.json
  3. clicked on "hamburger" "menu -> extensions

Screen Shot 2021-01-28 at 11 32 51 AM

  1. file -> New Private Window with Tor
  2. signed in to 1Password in Brave
  3. loaded wellsfargo.com and confirmed that 1Password was available for the site, in the Tor Private Window

Screen Shot 2021-01-28 at 12 14 26 PM


Verification passed on

Brave | 1.20.93 Chromium: 88.0.4324.96 (Official Build) dev (64-bit)
-- | --
Revision | 68dba2d8a0b149a1d3afac56fa74648032bcf46b-refs/branch-heads/4324@{#1784}
OS | Windows 10 OS Version 2004 (Build 19041.746)

Enable the extension in Tor

image

Ensured the extension is accessible via TOR tab when Allow in private is enabled in the brave://extension details page
image

Spanning vs Split
Edit manifest.json and added "incognito": "split", and saved file,
Visit brave://extensions/ and turn on developer mode and click Load unpacked
image

Verified the warning message
image


Verification passed on

Brave 1.20.95 Chromium: 88.0.4324.96 (Official Build) beta (64-bit)
Revision 68dba2d8a0b149a1d3afac56fa74648032bcf46b-refs/branch-heads/4324@{#1784}
OS Ubuntu 18.04 LTS

Enable the extension in Tor

image

Ensured the extension is accessible via TOR tab when Allow in private is enabled in the brave://extension details page
image

Spanning vs Split
Edit manifest.json and added "incognito": "split", and saved file,
Visit brave://extensions/ and turn on developer mode and click Load unpacked
image

Verified the warning message
image

@jawadalkassim
Copy link

jawadalkassim commented Feb 10, 2021

Privacy Pass is not working in TOR and Private mode still stuck on CAPTCHA page but its working in Default normal mode
Screenshot from 2021-02-10 23-07-43

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment