1
  1. what is the reason behind http/2 being disabled by default in the tor browser?
  2. What are the security and privacy impacts for the same?
Improve this question
1
  • I would like to get more information about this issue.
    – john smith
    Commented Sep 12, 2019 at 15:37

1 Answer 1

Reset to default
1

From https://www.torproject.org/projects/torbrowser/design/

Design Goal: SPDY and HTTP/2 connections MUST be isolated to the URL bar domain. Furthermore, all associated means that could be used for cross-domain user tracking (alt-svc headers come to mind) MUST adhere to this design principle as well.

Implementation status: SPDY and HTTP/2 are currently disabled by setting the Firefox preferences network.http.spdy.enabled, network.http.spdy.enabled.v2, network.http.spdy.enabled.v3, network.http.spdy.enabled.v3-1, network.http.spdy.enabled.http2, network.http.spdy.enabled.http2draft, network.http.altsvc.enabled, and network.http.altsvc.oe to false.

It looks like there's issues with HTTP/2 being able adhere to the URL-bar domain isolation that Tor Browser does.

Improve this answer
1
  • How does it affect the privacy of the tor browser users? Can you please give me a brief explanation about the URL bar domain isolation?
    – Aswin Kumar
    Commented Apr 9, 2018 at 6:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .