What is the safest way to keep TBB up to date?

Question

In the past these questions were asked about updating Tor Browser Bundle:

1. How can I switch from one Tor Browser Bundle version to another?
2. How do I keep my Tor Browser Bundle current?

For a while now we have had an updater, what I would like to know is: Is it still safer to download and verify the tarball & sig from the downloads page and copy the directory that contains your entry guards into the new Browser (once you have extracted it) than it is to just run the updater?

Not taking the convenience of the updater into account.

My main concern being that unless I am mistaken it is harder to verify that you were not the victim of a MitM attack during the update if you use the updater.

To summarize: I am unsure of how the updater verifies the integrity of updates, but how does it compare from a security perspective against the old way described in the linked questions?

Answer 1

This link to the Tor Browser design document contains the following description of how the Tor developers have ensured the updates from the updater cannot be tampered with.

5.4. Update Safety

We make use of the Firefox updater in order to provide automatic updates to users. We make use of certificate pinning to ensure that update checks cannot be tampered with, and we sign the individual MAR update files with an offline signing key.

The Firefox updater also has code to ensure that it can reliably access the update server to prevent availability attacks, and complains to the user after 48 hours go by without a successful response from the server. Additionally, we use Tor's SOCKS username and password isolation to ensure that every new request to the updater (provided the former got issued more than 10 minutes ago) traverses a separate circuit, to avoid holdback attacks by exit nodes.

This document shows the Tor developers have gone to great lengths to ensure the integrity of the updates provided by the updater and we can feel quite safe making use of this feature.