Classyshark3exydus found five trackers inside Tor browser

I never opposed an open source philosophy.
The only thing am not agree with is a naming of the certain custom builds like Lineage"OS" or Divest"OS", because the underlying OS is still Android OS.
I’m a former CyanogenMod user, Lineage “OS” is a fork, it’s fine, but to call it an Operating System, isn’t right, in my opinion.
No one calls Linux’s or BSD’s flavors somethingOS it is Debian or Arch or even Fedora(RedHat), with one little exception of CentOS because it’s Red Hat is an exception anyway.
You can build your very own Kernel, and call it whatever your like OS, otherwise name it without an “OS” in it.

@Fermion

naming

Now belaboring the obvious and insignificant…

Everyone is entitled to their opinion…but a little market research,

AliOS, CalyxOS, ColorOS, CopperheadOS, Emteria.OS, Fire OS, Funtouch OS, Flyme OS, GrapheneOS, Indus OS, LeWa OS, LineageOS, OriginOS, OxygenOS, Resurrection Remix OS, Smartisan OS,

or 16 of about 31 “notable” custom Android distributions listed on Wikipedia disagree, FWIW. (careless, quick count) Feel free to go convince those developers…

@Moz

I see issues from 2 or 3 years ago and the tickets aren’t marked as closed so they may have responded but not with a fix

Odd, I see 3 of 4 are closed. The open one “needs information” so will probably be closed if there isn’t follow up.

This closed one may be of particular interest because it discusses Adjust and Leanplum in mobile Tor Browser, which are listed in the OP. Except it was for “Orfox.”

I didn’t doubt that.
While 16 out of 20 Homosapiens jumping from the roof of the Empire State Building,
I prefer to find myself among the four remaining, discussing our bright future.

Off topic again. No idea how to stop this.

" Georg Koppen @gk · 2 years ago

Developer

We are closer to moving Orfox users to Tor Browser for Android. We therefore won’t spend time investigatig and fixing Orfox bugs anymore.

There it is, the beginning of the end. Does this mean that they’ve been aware of it since 2018 but still did nothing about it even when killing off the perfectly good Orfox? Orbot with Orfox was generations ahead of what the official Tor team have come out with. I did email Guardian Project (developers of orbot and orfox) about the trackers but they haven’t gotten back as of yet. Tor just published an expenses document showing they spent over 4 million on development in the last tax year and this is how one of the easiest to code and most needed variants has ended up.

I accept I was wrong about closed and opened tickets, my mistake

@Moz , In the following two comments, after the one you quoted, they say things very much like what has already been said here: inherited and deactivated code, but included libraries; a guess that Mozilla removed the stuff.

@Fermion Until you file a new Issue with Tor Project, to see how they respond in that (more appropriate) public forum, we have nothing more to discuss here. I’ll finish with this short list of a few of your false or unsupported statements, which should have clued me in much sooner:

  • No other app I ever used from F-droid had any trackers.
    Fact: F-Droid itself has the ACRA tracker, according to ClassyShark3xodus.

  • No, I don’t want to discuss it with Guardian people because they did it on purpose.
    No evidence provided.

  • Like I already said, the goal is to raise the question, because I didn’t find any discussions regarding this mater on public forums.
    Fact: Tor Project has at least 4 previous issues discussing this or closely related issues on public issue trackers.

This has been discussed many times including here, but it’s erroneous to conflate bug reporting with telemetry or analytics. I don’t know if CSE itself makes this distinction or not, but one should not just assume all “trackers” are equal or even necessarily evil, it depends on what the app is using them for.

In F-Droid’s case they don’t even do anything unless the user explicitly opts in, but CSE and similar tools aren’t intelligent enough to tell that. Exodus/CSE isn’t an anti-spyware tool, it can’t tell you if an app is “evil” or not, it literally just looks for funny class signatures.

You don’t worry about those trackers and yet you are here for some mysterious reason.

You also use well known keywords/markers like “Paranoid” and “Criminal”
Those markers are used only by the brainwashed or by the professional agents provocateur.

In both cases there’s nothing to discuss with you anyway.

No commentary needed.

Failed try to discredit FOSS.

A little sales pitch.

Some sales pitch again.

Am agree with you on that.

The community here is already convinced that the trackers are evil, you both trying to convince otherwise using discussion tactics.

@Fermion

I’m going to assume you’re trolling at this point and disengage from
this “conversation”.

Either way, thank you for participation and for disengagement, I hope @anon46495926 will follow you.

It looks like my last comment got deleted for unknown reasons. All in all we are currently no closer to a solution than we were at the beginning. We know it contains trackers and telemetry by admission of Tor themselves but they are apparently deactivated, which nobody can verify. Compiling from source isn’t an option for the none savvy and ultimately puts you at huge fingerprinting risk, for which you have to personally accept as you may be the only person in the world running that configuration

Can disabled trackers, under some circumstances, work ?
And here about the TOR’s vulnerabilities :

1 Like

Yes, it is highly likely that the “disabled” code could be re-enabled by visiting a malicious host of perhaps even passing through a malicious exit node. The fact the code is there means it can be leveraged. Tor could remove this risk by fully removing the codes, but they don’t want to. I also wouldn’t pay much attention to what Tor say about vulnerabilities, most of the ones put into use aren’t predicted by team Tor and often bypasses are enabled by changes made by the noscript developers, which is good for Tor since it completely negates them from blame. If Tor cared then it would come back with 0 trackers/tracker code and no traces of telemetry at any security setting level. They have millions and they spend millions. It’s not out of their abilities, just their interests.

RestorePrivacy

Uses getclicky for visitor analytics or whatever.

Doesn’t take advertising… but… uses affiliate links. For VPN services. No wonder they don’t like a free competitor like Tor Browser…

Domain restoreprivacy.com is clean, according to:
VirusTotal
https://sitecheck.sucuri.net/
with reliable encryption algorithms, according to:
SSL Server Test (Powered by Qualys SSL Labs)
,and the data provided in this article are facts, not someone’s fantasies.

Clean of malware != Clean of trackers

1 Like

Yes it is.
I think :
malware == trackers

Tell that to antivirus companies then. In fact, that website has clicky “spyware”.
Which, according to their comparisons, is worse than Google

Well then, excuse me for not finding the repost of this article on a “clean site”.

You are arguing over whether a website has trackers in response to an anonymity app which has been proven to contain trackers? This is a new level, I am impressed and disappointed at the same time.

No, just these users did not like the facts entrusted in the article on which I gave a link and these users decided to discriminate my post that the site was contained to contain this article - malicious.
And, sorry for offtop.

1 Like