0

My HIPS firewall was giving Warnings that firefox.exe in the installed i.e; extracted TOR Browser bundle was unsinged.

I checked using properties of the firefox.exe and sure enough there is no signature.

However the TOR Browser bundle installer had a signature.

Note that I am not talking about the GPG signature. I am talking about the Windows signature which is based on a few signing authorities.

Is this a compromised installation?

Note to users. Add signature tag to this question

Improve this question

1 Answer 1

Reset to default
1

Yes, it is unsigned.

Signing was originally added by ticket #3861 however this only signed the installer and not all the binaries inside of the installer.

There was a ticket created from that, #15687 which was considering signing all the binaries to make it compatible with the Windows AppLocker security mechanism.

So this has been considered but it seems to have stalled some years ago.

One consideration might be that signing binaries break reproducable builds, since signing the binary in done within the executable file itself, it changes the data and any cryptographic hash of the file. If someone else tried to create a firefox.exe by following the Tor Browser build process, the end result they received would look different from that which the Tor Project distributes making it hard to verify that the distributed version matches the reproducible build.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .