1. what is the reason behind http/2 being disabled by default in the tor browser?
  2. What are the security and privacy impacts for the same?
  • I would like to get more information about this issue. – john smith Sep 12 '19 at 15:37

From https://www.torproject.org/projects/torbrowser/design/

Design Goal: SPDY and HTTP/2 connections MUST be isolated to the URL bar domain. Furthermore, all associated means that could be used for cross-domain user tracking (alt-svc headers come to mind) MUST adhere to this design principle as well.

Implementation status: SPDY and HTTP/2 are currently disabled by setting the Firefox preferences network.http.spdy.enabled, network.http.spdy.enabled.v2, network.http.spdy.enabled.v3, network.http.spdy.enabled.v3-1, network.http.spdy.enabled.http2, network.http.spdy.enabled.http2draft, network.http.altsvc.enabled, and network.http.altsvc.oe to false.

It looks like there's issues with HTTP/2 being able adhere to the URL-bar domain isolation that Tor Browser does.

  • How does it affect the privacy of the tor browser users? Can you please give me a brief explanation about the URL bar domain isolation? – Aswin Kumar Apr 9 '18 at 6:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.