OnionBrowser for iOS -- how secure is it?

Question

Currently it seems there are no torproject.org "officially sanctioned" solutions for iOS. However, there is a browser called OnionBrowser that passes check.torproject.org and is able to access hidden services on the tor network.

So my question is, do we know how secure it is compared to running tor from Vidalia or even Orbot? Aside from the following warnings provided by OnionBrowser:

Caveats: HTML5 <video> tags will leak <video>-related DNS queries and data transfer outside of Tor.

Javascript cannot be disabled, HTML5 Geolocation API cannot be disabled.

I guess one concern I have is how often the other tor software is updated and the inherent lag with availability of updates from both the developer and the App Store itself.

Otherwise is there anything I should know about using this to access Tor? Is it ill-advised in scenarios where security or anonymity is important?

Answer 1

As long this these issues are open...

Caveats: HTML5 <video> tags will leak <video>-related DNS queries and data transfer outside of Tor.

Javascript cannot be disabled, HTML5 Geolocation API cannot be disabled.

I'd say:

• Okay for circumvention, when anonymity isn't desired.
• Okay for adding hay to the haystack (Tor). Your contribution of causing more Tor traffic is appreciated. The more legitimate traffic, the better anonymity for everyone.
• Okay for very weak anonymity, against adversaries who are not that serious, not using HTML5 <video> and HTML5 Geolocation AP for tracking.
• Not safe, when you want to be in comparison as anonymous as a Tor Browser Bundle user.

Whether underlying proprietary operating systems such as iOS or Microsoft Windows can provide meaningful security/anonymity is another question. Not sure if a good question for the tor-talk mailing list or tor.stackexchange.

Answer 2

As you've written it isn't an official application, so that means that it can have security bugs which won't be addressed by the core Tor team.

We don't know how to verify the security of the included versions of Orbot and Vidalia - they pass check.torproject.org, but without analysing the source code there's no way to ensure there isn't a gap anywhere that would allow somebody to get your location.

Answer 3

There are now many Tor Browsers on the iOS App Store, some are clones/forks of the open source Onion Browser.

To address your release cycle question, iOS apps currently have a two week review period. On top of that a new tor version would have to be incorporated into the app and tested, so it will be three weeks to release. That said, iOS owners update their software promptly, or automatically, so the new version would be in use within a month. TOR browser bundle users normally take longer to upgrade, and there is a large user base on versions older than the most recent.

IOS TOR browsers are all built using the iOS components UIWebView and NSURLProtocol. UIWebView is the web component. NSURLProtocol is used to redirect web requests to TOR, or any other app specific code.

The HTML5 geolocation API can not be disabled in UIWebView but it will prompt the user each time the page requests the location.

An important issue when deciding whether an iOS app can be trusted is whether you trust the developer. The only suggestion here is to periodically check the app using IP address tools including the site referenced below.

Finally, iOS browsers can leak the IP address because of a bug, or feature, of UIWebView which has it bypass NSURLProtocol for HTML5 video and XMLHTTPRequests (used for AJAX web sites).

Xorden.net has documented examples of iOS TOR browsers that leak the user's real IP address.

One iOS browser that doesn't suffer from this IP address leakage issue due to HTML5 video tags or XMLHTTPRequests is Safe Browser Secure. (Disclosure: this is mine.) Some other iOS TOR browsers block HTML5 video completely.