2

I am trying to use the website Lang-8 (a social networking site for language learning) with tor browser. I can create an account but I cannot log in. Whenever I enter my user name and password, I am redirected back to the welcome page of the site and I do not appear to be logged in.

I do not get any kind of error message, so I don't think that the site is deliberately blocking tor.

I thought that maybe https-everywhere is to blame, but I still cannot log in even if I disable it.

I have tried both Tor Browser version 3.6.6 and 4.0-alpha-3 but I cannot log in to lang-8 with either.

Has anybody had any success using lang-8 with Tor Browser?

Update:

It seems that NoScript is causing the problem. If I disable the NoScript extension in Tor Browser (via the Addons menu item in Firefox), I can log in to lang-8. Of course, turning off NoScript is not a viable long-term solution. I tried turning on NoScript again, but adding a regexp matching lang-8 urls to the NoScript XSS protection whitelist, but this didn't help.

I have filed a bug report on trac.torproject.org related to this issue.

Improve this question
4
  • Currently you are using two profiles. You can try to regain access to the first profile: tor.stackexchange.com/users/account-recovery and/or you can ask the administrators to merge the two profiles.
    – pabouk - Ukraine stay strong
    Commented Oct 4, 2014 at 9:13
  • I tried to merge the accounts but I don't know if it worked.
    – lang8tor
    Commented Oct 4, 2014 at 9:32
  • This seems to be a problem with Tor Browser. I tested it with Tor Browser and another Firefox (with and without HTTPS Everywhere). Only with Tor Browser it didn't work. Someone has to investigate a bit deeper on why this is the case. For progress you might also want to look here: trac.torproject.org/projects/tor/ticket/13332
    – Jens Kubieziel
    Commented Oct 4, 2014 at 9:36
  • Yes, I filed the bug report. As I mentioned there, and in an as-yet unapproved edit to this question, the problem seems to be caused by NoScript, not https-everywhere.
    – lang8tor
    Commented Oct 4, 2014 at 9:51

1 Answer 1

Reset to default
1

All details can be found in the bug report #13332.

The problems comes from the Secure Cookie Management of NoScript. The default installation leaves this to false, while Tor Browser sets it to true. This way not all cookie go along their way and the user can't login.

The NoScript FAQ recommends to either disable Secure Cookie Managment for this site or to investigate further and send the authors of NoScript a report.

Improve this answer
1
  • 1
    The problem is that if I disable Secure Cookie Managment for one site, it changes the request profile of my Tor Browser instance and makes me fingerprintable. (For example a malicious exit node could inject references to resources hosted at websites known to be broken by the secure cookies feature and detect ones I use, based on which ones I send cookies to). A better solution would be for Tor Browser to disable the Secure Cookies feature, or make it whitelist based (so that it is only enabled for a list of sites where it is known to work, this list being distributed with Tor Browser).
    – lang8tor
    Commented Oct 16, 2014 at 13:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .