0

I noticed Tor Browser updates were really fast, while overall connection speed was more Tor-like.

Improve this question

1 Answer 1

Reset to default
0

It does download through Tor. See the Tor Browser Design Document.

We make use of the Firefox updater in order to provide automatic updates to users. We make use of certificate pinning to ensure that update checks cannot be tampered with by setting security.cert_pinning.enforcement_level to 2, and we sign the individual MAR update files with keys that get rotated every year.

The Firefox updater also has code to ensure that it can reliably access the update server to prevent availability attacks, and complains to the user after 48 hours go by without a successful response from the server. Additionally, we use Tor's SOCKS username and password isolation to ensure that every new request to the updater (provided the former got issued more than 10 minutes ago) traverses a separate circuit, to avoid holdback attacks by exit nodes.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .