I've downloaded the TBB but it won't open because "TorBrowserBundle_en-US" is from an "unidentified developer". How do I solve this?

  • "Unidentified developer" happens when the .app hasn't been signed by a code-signing cert. Tor would have to register for a code-signing cert from Apple (pay apple). Instead, Tor signs with GPG. On the download page, you see a little link to "sig" just below the download button, to download an ASC file. You must ensure you get the installer, and the sig asc file, from an HTTPS connection, directly from www.torproject.org. (Don't accept any URL that doesn't start with https://www.torproject.org). Then verify the gpg signature. – Edward Ned Harvey Mar 17 '16 at 14:14
  • Note that it says WARNING: This key is not certified with a trusted signature! There is no indication that the signature belongs to the owner. This is not ok. The verify gpg signature page says This means that GnuPG verified that the key made that signature, but it's up to you to decide if that key really belongs to the developer. The best method is to meet the developer in person and exchange key fingerprints. Since that's unrealistic, you must manually compare signature fingerprints (first the primary key, and then one – Edward Ned Harvey Mar 17 '16 at 14:26
  • of the subkeys) listed on the verify gpg signature page, matches the key fingerprints that were displayed by your gpg --verify command. – Edward Ned Harvey Mar 17 '16 at 14:27
  • I wrote all the above comments as comments, instead of an answer, because this topic is protected, and I don't have permission to post an answer. – Edward Ned Harvey Mar 17 '16 at 14:28
  • After manually verifying the GPG signature of TorBrowser.app, do not change your security preferences to "allow apps downloaded from anywhere." Instead, allow that one particular app to run, by opening System Preferences > Security & Privacy, and clicking "Open anyway" for "TorBrowser.app", or by right-clicking TorBrowser.app and going to "Open" so you can override the security settings for that one app. – Edward Ned Harvey Mar 17 '16 at 14:33

With some security configurations Apple's operating systems will refuse to run any application they haven't specifically vetted by Apple Corp.

You can get around this easily.

From Apple's OSX 10.8 support document:

You can choose to override your security settings and open the app anyway.

In the Finder, locate the app you want to open. Most apps can be found in the Applications folder. Press the Control-key and click the app icon. Choose Open from the pop-up menu. Click Open.

(The Mac OSX 10.9 support document has the same suggestion)

Reminder: any executable file from the internet is subject to tampering. Be sure to verify the gpg signature of the Tor file you downloaded before running it. Apple's Gatekeeper program (the feature that blocks the initial running of Tor) is designed to help ease the process of verifying binaries for most users but for third parties who are not registered (like the Tor foundation) it results in extra hassle.

  • related - see tor.stackexchange.com/questions/1221/… – Ivar Jan 6 '14 at 20:10
  • So one can't add the Tor Project's GnuPG key to Gatekeeper? As with Linux aptitude, for example. – mirimir Sep 30 '14 at 22:05
  • @mirimir - even if you could add user specified keys to Gatekeeper, it would not be a good idea to trust a third-party proprietary tool from a company subject to U.S. law to vet your binaries. – Ivar Oct 2 '14 at 19:34
  • 1
    If one trusts Apple enough to use their OS, trusting Gatekeeper to properly check signed binaries doesn't seem like too much of a stretch ;) – mirimir Oct 3 '14 at 1:24
  • "Unidentified developer" does not mean anything about Apple "vetting" the developer. If you have a code signing certificate, and distribute signed code, you are an identified developer. The process to get a code signing cert is similar to getting an SSL cert, which torproject.org clearly has. The TorBrowser.app should be signed. I want to know why it's not. – Edward Ned Harvey Mar 17 '16 at 14:02

Open system preferences, then security & privacy, and then enable the "anywhere" option in general settings.

  • 5
    While your answer might be technically correct, it doesn't discuss any pitfalls. So what downside has enabling this settings? Is it safe to do? Your answer should include more information. Please have a look at how to write good answers. – Jens Kubieziel Oct 1 '14 at 10:46

protected by Community Sep 30 '15 at 7:46

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.