1

I run Tor Browser 4.0.8 on Windows. I've noticed since the upgrade from Tor Browser 3.x.x that Tor Browser now has an Auto-update function very similar to Firefox (see pictures).

Tor Browser update flag Tor Browser Update Window

Does using this update window pose any security or performance threat when compared to the traditional method of going to Tor Project's website and downloading the installer file?

1

Using the auto-update feature is the recommended way to keep your TBB installation current. Use it.

  • Do you have a source for that info? – Milliron X Apr 16 '15 at 15:24
0

As far as I am aware, the TBB auto-update functionality does so over SSL and has some form of signature checking in place to prevent against MiTM attacks injecting malicious code into an update (a good example of such an attack is bdfproxy).

To verify this, I would advise installing TBB in a VM, running Wireshark, and waiting for the auto-updater to kick off and monitoring its traffic to check if it IS doing so over HTTPS. I intend on doing this once I have a bit of free time, but if you get there first, go for it :)

TL;DR: Probably does not introduce risk, unless someone MiTM's you during the update and gets around SSL/Sig checking stuff that I believe is in place. However, best verify.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.