9

I've downloaded the TBB but it won't open because "TorBrowserBundle_en-US" is from an "unidentified developer". How do I solve this?

Improve this question
6
  • "Unidentified developer" happens when the .app hasn't been signed by a code-signing cert. Tor would have to register for a code-signing cert from Apple (pay apple). Instead, Tor signs with GPG. On the download page, you see a little link to "sig" just below the download button, to download an ASC file. You must ensure you get the installer, and the sig asc file, from an HTTPS connection, directly from www.torproject.org. (Don't accept any URL that doesn't start with https://www.torproject.org). Then verify the gpg signature.
    – Edward Ned Harvey
    Mar 17, 2016 at 14:14
  • Note that it says WARNING: This key is not certified with a trusted signature! There is no indication that the signature belongs to the owner. This is not ok. The verify gpg signature page says This means that GnuPG verified that the key made that signature, but it's up to you to decide if that key really belongs to the developer. The best method is to meet the developer in person and exchange key fingerprints. Since that's unrealistic, you must manually compare signature fingerprints (first the primary key, and then one
    – Edward Ned Harvey
    Mar 17, 2016 at 14:26
  • of the subkeys) listed on the verify gpg signature page, matches the key fingerprints that were displayed by your gpg --verify command.
    – Edward Ned Harvey
    Mar 17, 2016 at 14:27
  • I wrote all the above comments as comments, instead of an answer, because this topic is protected, and I don't have permission to post an answer.
    – Edward Ned Harvey
    Mar 17, 2016 at 14:28
  • After manually verifying the GPG signature of TorBrowser.app, do not change your security preferences to "allow apps downloaded from anywhere." Instead, allow that one particular app to run, by opening System Preferences > Security & Privacy, and clicking "Open anyway" for "TorBrowser.app", or by right-clicking TorBrowser.app and going to "Open" so you can override the security settings for that one app.
    – Edward Ned Harvey
    Mar 17, 2016 at 14:33

3 Answers 3

Reset to default
9

With some security configurations Apple's operating systems will refuse to run any application they haven't specifically vetted by Apple Corp.

You can get around this easily.

From Apple's OSX 10.8 support document:

You can choose to override your security settings and open the app anyway.

In the Finder, locate the app you want to open. Most apps can be found in the Applications folder. Press the Control-key and click the app icon. Choose Open from the pop-up menu. Click Open.

(The Mac OSX 10.9 support document has the same suggestion)

Reminder: any executable file from the internet is subject to tampering. Be sure to verify the gpg signature of the Tor file you downloaded before running it. Apple's Gatekeeper program (the feature that blocks the initial running of Tor) is designed to help ease the process of verifying binaries for most users but for third parties who are not registered (like the Tor foundation) it results in extra hassle.

Improve this answer
5
  • related - see tor.stackexchange.com/questions/1221/…
    – Ivar
    Jan 6, 2014 at 20:10
  • So one can't add the Tor Project's GnuPG key to Gatekeeper? As with Linux aptitude, for example.
    – mirimir
    Sep 30, 2014 at 22:05
  • @mirimir - even if you could add user specified keys to Gatekeeper, it would not be a good idea to trust a third-party proprietary tool from a company subject to U.S. law to vet your binaries.
    – Ivar
    Oct 2, 2014 at 19:34
  • 1
    If one trusts Apple enough to use their OS, trusting Gatekeeper to properly check signed binaries doesn't seem like too much of a stretch ;)
    – mirimir
    Oct 3, 2014 at 1:24
  • "Unidentified developer" does not mean anything about Apple "vetting" the developer. If you have a code signing certificate, and distribute signed code, you are an identified developer. The process to get a code signing cert is similar to getting an SSL cert, which torproject.org clearly has. The TorBrowser.app should be signed. I want to know why it's not.
    – Edward Ned Harvey
    Mar 17, 2016 at 14:02
1

Just add to reset the policy to "Apple only" (or whatever it was) afterward. The other answer is also wrong, it is fully possible to run what you develop with Xcode and also the Android Studio. Use System Preferences is a simple and easy way to do this. And of course you can download a key and patch it in manually also - but use the method that Apple endorses. The reason for this is to enable them to halt you should you try to launch something that someone else has managed to download on your Mac, and even created an icon - this is NOT MICROSOFT WINDOWS and we don´t want those policies!

Improve this answer
-1

Open system preferences, then security & privacy, and then enable the "anywhere" option in general settings.

Improve this answer
1
  • 6
    While your answer might be technically correct, it doesn't discuss any pitfalls. So what downside has enabling this settings? Is it safe to do? Your answer should include more information. Please have a look at how to write good answers.
    – Jens Kubieziel ♦
    Oct 1, 2014 at 10:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .