If all TBB versions have the same user-agent/fingerprinting, then how does torcheck check if TBB is up to date? How the "know if I'm up to date" system works?
check.torproject.org does not test the version of your TBB (Tor Browser Bundle). The test is performed by the TBB itself and the information is explicitly passed to the server.
In the Firefox preferences check the Home Page setting. When TBB is up to date you will see:
when TBB is out of date, you will see:
So TBB itself (precisely said Torbutton) downloads list of recommended TBB versions, compares the installed version to it and tells the check.torproject.org server if it is up to date by the
uptodate parameter in the URL. The check is performed by the Torbutton Firefox extension and then the Home Page is updated accordingly. See torbutton.js.
If check.torproject.org was able to directly see your TBB version then it would be a very serious security flaw.
check.torproject.org has a manually updated list of "recommended" Tor Browser Bundle versions. It is trivial to check TBB's version against this list.
The Tor Browser Bundle's own version number is updated whenever any of its components are updated. The User-Agent string is not used at all. The actual version check is done by the Torbutton component.
I'm still confused. How does torcheck know my TBB version if the user-agent is just "Mozilla/5.0 (Windows NT 6.1; rv:17.0) Gecko/20100101 Firefox/17.0". In TBB, Help-->About, it says "17.0.9". But user-agent just leaves 17.0. Suppose FF 17.0.8 is vulnerable and 17.0.9 is not. How does torcheck know if I have to update, if the user agent doesn't give precise version numbers? Oct 16, 2013 at 7:05
The Tor Browser Bundle's own version number is updated whenever any of its components are updated. The User-Agent string is not used at all. The actual version check is done by the Torbutton component. Oct 16, 2013 at 7:08