1

I run Tor Browser 4.0.8 on Windows. I've noticed since the upgrade from Tor Browser 3.x.x that Tor Browser now has an Auto-update function very similar to Firefox (see pictures).

Tor Browser update flag Tor Browser Update Window

Does using this update window pose any security or performance threat when compared to the traditional method of going to Tor Project's website and downloading the installer file?

Improve this question

2 Answers 2

Reset to default
1

Using the auto-update feature is the recommended way to keep your TBB installation current. Use it.

Improve this answer
1
  • Do you have a source for that info?
    – Milliron X
    Apr 16, 2015 at 15:24
0

As far as I am aware, the TBB auto-update functionality does so over SSL and has some form of signature checking in place to prevent against MiTM attacks injecting malicious code into an update (a good example of such an attack is bdfproxy).

To verify this, I would advise installing TBB in a VM, running Wireshark, and waiting for the auto-updater to kick off and monitoring its traffic to check if it IS doing so over HTTPS. I intend on doing this once I have a bit of free time, but if you get there first, go for it :)

TL;DR: Probably does not introduce risk, unless someone MiTM's you during the update and gets around SSL/Sig checking stuff that I believe is in place. However, best verify.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .