Starting Tor Browser directly without Tor Browser Starter by Whonix ™.

Open a terminal.

To start Tor Browser in debugging mode, run. ^[54]

~/.tb/tor-browser/Browser/start-tor-browser --debug

Successful Tor Browser Connection[edit]

If Tor Browser successfully launches and connects to the Tor network, Check Torproject ^[archive] should show the following message.

Figure: Successful Tor Network Check in Whonix ™

File Downloads[edit]

Warnings[edit]

Whonix ™ protects against the threats outlined below, such as files that inadvertently or maliciously attempt to reveal the real IP address of the user, or third-party, external applications that can leak information outside of Tor. Despite this protection, it is recommended to always follow best safety practices.

Do not Open Documents Downloaded via Tor while Online[edit]

The Tor Project explicitly warns against opening documents handled by external applications. The reason is documents commonly contain Internet resources that may be downloaded outside of Tor by the application that opens them. ^[55]

This warning is not strictly relevant to the Whonix ™ population since all traffic is forced over Whonix-Gateway ™ and the IP address will not leak. Nevertheless, for better safety files like PDFs and word processing documents should only be opened in offline VMs.

Malicious files or links to files pose a greater threat and can potentially compromise your system. Therefore, follow the wiki advice and avoid opening random links or files in Whonix-Workstation ™. Instead:

• Qubes-Whonix ™: It is preferable to sanitize the PDF ^[archive] or open the file or link in a Disposable.
• Non-Qubes-Whonix ™: The file should only be opened in a separate, offline Whonix-Workstation ™.

Do not Torrent over Tor[edit]

See File Sharing.

Secure Downloads[edit]

Preventing SSLStrip Attacks[edit]

A common misconception is that a secure, green padlock and a https:// URL makes any download from that particular website secure. This is not the case because the website might be redirecting to http. In fact, an SSLstrip attack ^[archive] might succeed if a link is pasted or typed into the address bar without the https:// component (e.g. torproject.org instead of https://torproject.org [archive]) -- the reason is a padlock is not visible; it just appears empty. ^[56]

To avoid this risk and similar threats, always explicitly type or paste https:// in the URL / address bar. The SSL certificate button or padlock will not appear, but that is nothing to be concerned about. Unfortunately, few people follow this sage advice; instead most mistakenly believe pasting or typing www.torproject.org into the address bar is safe.

Other Precautions[edit]

For improved safety when downloading files or installing software, follow the advice below.

Table: Software and File Download Advice

Navigating Tor Browser Downloads[edit]

For those who regularly download Internet files, Tor Browser's default download folder is inconvenient. For example, if the sample image below was downloaded with Tor Browser, the download path is /home/user/.tb/tor-browser/Browser/Downloads by default. It is time-consuming to navigate to this folder so far down the directory tree.

Figure: Default Tor Browser Download Folder

To make things simpler, the following steps change Tor Browser preferences so files are saved directly inside /home/user/Downloads.

User files will now be downloaded to the /home/user/Downloads folder. Navigate to this folder using either file manager or terminal.

Prioritize Onion Connections[edit]

The release of Tor Browser v9.5 provides a new Onion Location function: ^[57]

Website publishers now can advertise their onion service to Tor users by adding an HTTP header. When visiting a website that has both an .onion address and Onion Location enabled via Tor Browser, users will be prompted about the onion service version of the site and will be asked to opt-in to upgrade to the onion service on their first use.

This feature has been implemented across the entire whonix.org ecosystem, including the homepage, wiki, forums, phabricator and repository. ^[58]

Figure: Onion Location Indicator for Whonix ™ Forums

Once the "Always Prioritize Onions" option is set in Tor Browser, the relevant onion resource will always be preferred in the future. If you want to only upgrade to the onion resource one time, click "Not Now" and then press the "Onion Available" button one more time. This browser feature is located in about:preferences#privacy and can be changed at any time. ^[59]

Figure: Prioritize the Onion Site

Figure: Prioritized Whonix ™ Onion Forums

Security impact: none. ^[60]

For security improvement it might help to force connections to onions for websites that are reachable over clearnet and onion. This is currently only documented for Forcing .onion on Project but undocumented for arbitrary websites. Doing so would be possible as per Free Support Principle.

Browser Language[edit]

In 2021, the stable and experimental Tor Browser binaries with additional language packs support 34 languages. Recent additions include: Catalan, Irish, Indonesian, Icelandic, Norwegian, Danish, Hebrew, Swedish, Traditional Chinese, Macedonian and Romanian. ^{[61] [62] [63]} For instructions on changing the Tor Browser interface to a language other than English, see Tor Browser Language. ^[64]

Local Connections[edit]

Sometimes it is necessary to access the local application interface on 127.0.0.1 in order to run specific applications like I2P. ^[65] Due to potential fingerprinting and information leakage risks, this behavior is no longer possible in Tor Browser unless an exception is configured. ^{[66] [67]}

To configure an exception for local connections in Tor Browser: ^[68]

Preferences → General Tab → Network Proxy | Settings... → No Proxy for: "127.0.0.1" → click "OK"

The configured exception means a small trade-off in privacy, but it is much safer than using another browser (see Local Connections Exception Threat Analysis).

Recommendations[edit]

For better anonymity:

• Browse with JavaScript disabled in Tor Browser and enable it only when needed. Disabled JavaScript mitigates these browser fingerprinting issues completely.
• Set passwords for web interfaces listening on the localhost.
• Run sensitive daemons with local WebGUIs on a separate, dedicated Whonix-Workstation ™ and virtual network instance. TODO: expand or link how to do that

Bypass Tor Censorship[edit]

A number of websites or services actively block Tor users ^[archive] via:

• A DNS query-based list used to tag IP addresses.
• Blocking software like Akamai ^[archive] and Cloudflare ^[archive].
• Other individual blocks.

There are various ad-hoc methods available to try and circumvent blocks. In most cases it is unnecessary to create a tunnel which pairs Whonix ™ with other protocols (such as a VPN) in order to access the content.

The following services fetch content via other websites, which is a privacy trade-off. Further, only some services are effective with embedded, non-static content or support specific file types like PDF, .exe and mp3. ^[69]

Table: Tor Censorship Circumvention Options ^[70]

The Tor community also recommends: ^[73]

To avoid captchas that are sometimes required when visiting YouTube, use hooktube.com/ (behind Cloudflare).

imgur.com blocks Tor uploads, to upload images on an imgur domain go to a stackexchange website (for example tor.stackexchange.com), click on Ask a Question, use the image upload tooltip to upload the image, the resulting url will have a i.stack.imgur.com/... form.

Harden Tor Browser[edit]

Anonymity and safety can be materially improved via: AppArmor, Firejail confinement, Tor Browser settings, sandboxing, multiple Tor Browser instances, and operation of Whonix-Workstation ™ Disposables (Qubes-Whonix ™) or multiple Whonix-Workstation ™.

Tor Browser provides reasonable security in its stock configuration. However, mitigating the risk of Tor Browser security breaches makes sense, because it is an untrusted application with a huge attack surface; it is frequently attacked successfully in the wild by adversaries.

Table: Tor Browser Hardening Options

sudo apt update

sudo apt install apparmor-profile-torbrowser

sudoedit /etc/torbrowser.d/50_user.conf

tb_hardening=true

Update Tor Browser[edit]

Introduction[edit]

Unfortunately, updating Tor Browser is more complex than regular system updates due to technical limitations outside of Whonix ™ control. ^[88] However, the following instructions will keep Tor Browser up-to-date at all times.

There are three options for updating Tor Browser in Whonix ™:

1. The Whonix ™ Tor Browser Downloader. ^[89]
2. The Tor Project's Tor Browser Internal Updater. ^[90]
3. Tor Browser manual updates.

The first two methods are suitable in most circumstances. Manual updates are only required if the Whonix ™ Tor Browser update script ever breaks. Never continue to use an outdated version of Tor Browser, otherwise serious security flaws may degrade anonymity or result in a VM compromise. ^[91]

Tor Browser Downloader by Whonix ™[edit]

Configuration[edit]

Manual Download Version Choice[edit]

If the online detected version (for example INFO: Online detected version: 10.5) is different from the version number intended for download, it is possible to manually choose the download version on the command line. This can be useful when a new version of Tor Browser has been released but the version file ^[92] has not been updated yet by The Tor Project. The version file which is used to programmatically detect the latest Tor Browser version is usually updated a few days after new releases. ^[93]

Syntax:

tbb_version=version.number update-torbrowser

Example:

Note: Replace 10.5 with the actual version number.

tbb_version=10.5 update-torbrowser

Onion Download[edit]

It is possible to download over onion rather than clearnet.

To permanently set downloads over onion, apply the following instructions.

sudoedit /etc/torbrowser.d/50_user.conf

tb_onion=true

Alternatively, the following command could be used to download over onion only once.

update-torbrowser --onion

Alpha Version[edit]

It is possible to configure the downloading of alpha rather than stable Tor Browser versions. Becoming a tester is a helpful way to contribute to Whonix ™.

To permanently enable downloading alpha versions, apply the following instructions.

sudoedit /etc/torbrowser.d/50_user.conf

tbb_download_alpha_version=true

Alternatively, the following command could be used to download the alpha version only once.

update-torbrowser --alpha

Installation Process[edit]

Note: Tor Browser Downloader (Whonix ™) is really just a downloader, not an updater. This means it is incapable of retaining user data such as bookmarks and passwords. In order to preserve data, use the Internal Updater method instead.

To use Tor Browser Downloader (Whonix ™), follow these instructions in Whonix-Workstation ™.

update-torbrowser

Download Confirmation Notification[edit]

This step is designed to keep Whonix ™ users safe, since at present there is no reliable and secure way for a program to determine the latest stable version of Tor Browser with reasonable certainty. ^{[95] [96]} When the version format changes, the automated parser of version information could falsely suggest:

• An earlier stable version that is still considered secure.
• An alpha series release.
• A beta Tor Browser build.
• A release candidate or nightly Tor Browser build.

Alternatively, one might be targeted by a denial of service, indefinite freeze or rollback (downgrade) attack. ^{[97] [98]}

To counter these threats, user intelligence is utilized as a sanity check. The Download Confirmation Notification provides a way to detect such situations and abort the procedure. In this instance, it is recommended to rotate the Tor circuits and attempt the download process again.

Version numbers that are visible under Online versions come from an online resource. The Tor Browser RecommendedTBBVersions ^[archive] versions file is provided by The Tor Project, and is parsed by Whonix ™ Tor Browser Downloader. The Whonix ™ downloader will indicate that no upgrade is required if the installed Tor Browser version matches the up-to-date online version.

TODO: expand.

Installation Confirmation Notification[edit]

This step is also designed to protect users, since at present there is no reliable and secure way for a program to determine (with reasonable certainty) if the Tor Browser download was targeted by an indefinite freeze or rollback attack. ^{[99] [100]}

When verifying cryptographic signatures, several important aspects must be considered:

• The signature should be made by a trusted key.
• Trusted keys will have signed other files in the past. It is also necessary to check if the right file was received, and not just any file that was signed by a trusted key.
• Even if the correct file type is received, ^[101] it is necessary to check it has a current signature attached and not a historical one. This step counters the threat of indefinite freeze and rollback attacks.

By the time the Installation Confirmation Notification is visible, the verification of the signature (and hash) will have already succeeded. However, the signature creation dates in the figure below must be carefully examined to confirm that an indefinite freeze or downgrade attack did not occur.

Previous Signature Creation Date: When Tor Browser was previously installed by tb-updater, the creation date of the accompanying signature that signed Tor Browser will have been stored. The Previous Signature Creation Date field displays that date.
Last Signature Creation Date: This field displays the date of signature creation for the downloaded file.

Figure: Tor Browser Installation Confirmation

^{[102] [103]}

Note: Tor Browser local version number detection is not currently implemented ^[archive] in Whonix ™.

TODO: expand.

In Qubes-Whonix ™[edit]

Unfortunately, updating Tor Browser is more complex than regular system updates due to technical limitations outside of Whonix's control. ^[104] Apply the following instructions to keep Tor Browser up-to-date at all times.

New App Qubes and Disposables[edit]

In Qubes-Whonix ™, Tor Browser Downloader by Whonix ™ (update-torbrowser) automatically runs when the Whonix-Workstation ™ Template (whonix-ws-16) package tb-updater is updated. Therefore, running Tor Browser Downloader by Whonix ™ inside the Template (whonix-ws-16) ensures that new App Qubes and Disposables are created with a copy of the latest Tor Browser version.

If the Tor Browser Downloader by Whonix ™ package tb-updater has not been updated yet, it is advised to manually run it in the Whonix-Workstation ™ Template (whonix-ws-16). For instructions, see Tor Browser Downloader by Whonix ™.

Disposable Template[edit]

For further information on installing, updating and using Tor Browser in Qubes Disposables, see: How to use Disposables in Qubes-Whonix ™.

Existing App Qubes[edit]

Follow these steps to update Tor Browser in an existing Whonix-Workstation ™ App Qube such as anon-whonix:

1. Start Tor Browser: Qubes Start Menu → Whonix-Workstation ™ App Qube (commonly called anon-whonix) → Tor Browser
2. Use Tor Browser Internal Updater.

Summary[edit]

Tor Browser Downloader (by Whonix ™ developers):

Tor Browser Downloader (by Whonix ™ developers) is useful to run in:

• Whonix-Workstation ™ Template (whonix-ws-16): to ensure that new App Qubes and Disposables are created with a copy of the latest Tor Browser version.
• Whonix-Workstation ™ App Qube (anon-whonix): to re-install the latest Tor Browser version in existing Whonix-Workstation ™ App Qubes.

Tor Browser Downloader (by Whonix ™ developers) less useful to run in:

• Disposables: because upgrades won't persist

Tor Browser Downloader (by Whonix ™ developers) should not be run in:

• Disposable Template (whonix-ws-16-dvm)

Tor Browser:

Tor Browser is useful to run in:

• Whonix-Workstation ™ App Qube (anon-whonix)
• Dispoables

Tor Browser should not be run in:

• Whonix-Workstation ™ Template (whonix-ws-16)
• Disposable Template (whonix-ws-16-dvm)

Expired Key[edit]

Tor Browser Downloader (by Whonix ™ Developers):

• Can only automate what is supported by upstream, The Tor Project anyhow.
• Is fully optional. A usability feature. It does not do anything that could not also be done manually by the user.

First, exercise: verify Tor Browser according to upstream instructions ^[archive]. Unspecific to Whonix ™. If that is not possible, if that includes "key expired" then nothing that can be fixed in Whonix ™.

Tor Browser Internal Updater[edit]

Tor Browser upgrades are possible from within the browser using Tor Browser Internal Updater (by The Tor Project). ^[107] When a new Tor Browser version is available but the browser has not completed an automatic upgrade in the background (the default), a warning prompt appears recommending a manual upgrade. To upgrade, either:

• Enter about:preferences in the URL bar → Scroll down to "Tor Browser Updates" → Click "Check for updates"; or
• Open Menu → Help → About Tor Browser → Wait until the download finishes → Restart to update Tor Browser

Figure: Tor Browser Update Notification

Using Tor Browser Internal Updater automatically makes use of its built-in software signatures verification feature. ^[108] Manual software resignation verification is not required when using this update method.

Tor Browser Manual Update[edit]

Modern Tor Browser releases are generally easy to install and update on well-supported platforms like Whonix ™, leading most to have a comfortable and reliable experience over long periods. However, if/when Tor Browser "breaks", some might find it difficult to perform a manual installation. ^[109]

Whonix ™ Bugs[edit]

Sometimes Tor Browser Downloader inside Whonix-Workstation ™ breaks because torproject.org changes the way Tor Browser can be downloaded or verified. This program is maintained by the Whonix ™ contributors and The Tor Project is not responsible for necessary fixes. Generally, Whonix ™ news ^[archive] will be published within a few days with working instructions on how to fix the problem. If this does not happen, then Whonix ™ developers are unaware of the issue.

Any bugs should be discussed in the Whonix ™ User Help Forum ^[archive]. To date, no bugs were ever discovered in Tor Browser that were directly related to Whonix ™ code and which might cause serious problems such as website pages failing to load.

Prerequisite Knowledge[edit]

The manual Tor Browser download procedure assumes essential knowledge of:

• Software Verification: The Tor Browser package must be verified with PGP, using the associated file signature and Tor signing keys (relevant links are provided). ^[110]
• Troubleshooting: If Tor Browser problems occur in Whonix ™ such as webpages failing to resolve, then:
  • The same tests should be performed on the host (Non-Qubes-Whonix) or in a non-Whonix ™ VM (Qubes-Whonix ™); see Non-Whonix ™ Tor Browser. This step helps to determine whether the problem is related to Whonix ™ or not.
  • It is also sensible to search for the problem on torproject.org's bug tracker ^[archive] and report a bug upstream if it has not been notified yet. In that case, when upstream (TPO) fixes the issue, the issue will most likely also get fixed in Whonix ™.

Unsafe Tor Browser Habits[edit]

It is important to develop a set of safe habits when communicating, browsing or downloading with Tor Browser. Even the world's premier anonymity software cannot protect people if they shoot themselves in the foot.

The following is an inexhaustive list of unsafe behaviors. It is recommended to also read the Whonix ™ Tips on Remaining Anonymous entry, along with Tor Project documentation ^[archive] before using Tor Browser for serious activities necessitating anonymity.

Table: Unsafe Tor Browser Habits

Whonix ™ Tor Browser Differences[edit]

Does Whonix ™ Change Default Tor Browser Settings?[edit]

Tor Browser changes implemented by Tor developers are sometimes mistakenly attributed to Whonix ™ developers: ^{[129] [130]}

I've been looking for how to fix some bad default settings in the Whonix ™ tor browser. Namely, they removed NoScript from the toolbar, so that the NoScript cannot be used as intended.

As noted in the Whonix ™ Tor Browser Differences entry, Whonix ™ does not:

• change Tor Browser's internal updater checking mechanism;
• change or remove proxy settings by default; or
• modify Tor Browser's startup script, default settings and so on.

In fact, the NoScript URL bar change was a conscious decision by Tor developers which became part of a recent release: ^{[131] [132] [133] [134] [135]}

Quote Tor Browser developer Nicolas Vigier (@boklm ^[archive]):

NoScript and HTTPS Everywhere are still present in the URL bar if you upgraded from an older version. They are not present if you did a new install with a recent version.

If you want to turn off javascript, then you can change the security level. There is also nothing preventing you from adding NoScript on the toolbar even if it is not there by default.

Tor Browser Bundle versus Whonix ™ Tor Browser[edit]

The regular Tor Browser Bundle and Whonix ™ Tor Browser slightly differ. The reason is Tor Browser must be adjusted by Whonix ™ to work behind Whonix-Gateway ™.

The main Whonix ™ Tor Browser differences can be summarized as follows: ^[136]

• Environmental variable adjustments. ^[137] Despite environmental variable adjustments, the network and browser fingerprint remain the same.
• tor-launcher (Tor connection wizard) will not be shown in Whonix-Workstation ™ Tor Browser. Instead, Anon Connection Wizard is available in Whonix-Gateway ™.
• The Tor Circuit View and Open Network Settings functions have been disabled. The former is unsupported for security reasons, ^[138] while the latter would have no effect since Tor must be configured in Whonix-Gateway ™.
• The default landing page after Tor Browser starts is set to a local Whonix ™ resource through an environment variable. ^[139]
• Tor over Tor scenarios are prevented in Whonix-Workstation ™. ^[140]
• Extracted to folder ~/.tb/tor-browser.

Whonix ™ does not:

• Change Tor Browser's Internal Updater checking mechanism.
• Modify Tor Browser's startup script, default settings and so on. ^[141]
• Change or remove proxy settings by default.

Tor Browser Functionality on Different Platforms[edit]

The reason is this comparison includes a host of platform-specific differences which confound the result. For example, a more valid comparison would examine the differences between:

• TBB in Debian (real Debian, not in Qubes) versus Tor Browser in Non-Qubes-Whonix ™.
• TBB in a Qubes App Qube based on a Debian Template versus Tor Browser in Qubes-Whonix ™.

Similarly, these comparisons would be helpful in order to help with TBB (non-Whonix ™) development:

• TBB in Debian (real Debian, not in Qubes) vs TBB in Windows.
• TBB in different Linux distributions.
• TBB in different Windows platforms.

Troubleshooting[edit]

Tor Browser Crash Errors[edit]

Occasionally, Tor Browser might crash. Either:

• At browser startup. For example, after a new Tor Browser update is released, errors might occur upon launch. ^{[143] [144]}
• At browser runtime. ^[145]

ERROR: Tor Browser ended with non-zero (error) exit code!

Tor Browser was started with:

/home/user/.tb/tor-browser/Browser/start-tor-browser --allow-remote /usr/share/homepage/whonix-welcome-page/whonix.html

Tor Browser exited with code: 1 

To see this for yourself, you could try: 
Start Menu -> System -> Xfce Terminal 
Then run: 
torbrowser

Even though this is happening inside Whonix ™, the cause is most often unrelated to Whonix ™ code. Tor Browser is developed by The Tor Project ^[archive], which is an independent entity. The is the norm in Linux distributions. To learn more about such relationships see Linux User Experience versus Commercial Operating Systems.

Whonix ™ does integration work to get Tor Browser into the platform. To use a simple analogy, Whonix ™ stays "on the outside". Very few internal modifications are made to Tor Browser as described in the Whonix ™ Tor Browser Differences chapter.

To remedy this kind of issue, there are three promising approaches.

Delete and Reinstall Tor Browser[edit]

If browser settings like bookmarks, saved passwords and so on are not too important, Tor Browser can be completely deleted and reinstalled. Tor Browser usually functions normally after this procedure. The easiest method is using Tor Browser Downloader by Whonix ™ for this process.

Attempt to Debug the Issue[edit]

Advanced users can try to start Tor Browser without the help of /usr/bin/torbrowser by Whonix ™, thereby bypassing that part of Whonix ™ Tor Browser integration. Tor Browser resides in folder ~/.tb/tor-browser. Therefore Tor Browser can be launched in Debugging Mode, which is a Tor Browser (not Whonix ™) feature.

Additionally, the whole ~/.tb/tor-browser folder could be copied to a Debian buster machine or better yet, a virtual machine. For better security, a virtual machine might even be non-networked before attempts are made to launch Tor Browser. This error is likely to be reproducible outside Whonix ™ and this step will provide confirmation.

During debug attempts, do not use /usr/bin/torbrowser or the Tor Browser start menu entry because these are provided by Whonix ™ and are not the cause here. On the other hand, The Tor Project is responsible for errors that emerge when Tor Browser is started manually or in debug mode.

Be aware the Tor Bug Tracker ^[archive] already has various, existing bug reports related to incremental updates via the Tor Browser internal updater. These are most likely related to Tor Browser launch failures:

• https://gitlab.torproject.org/legacy/trac/-/issues/29771 ^[archive]
• https://gitlab.torproject.org/legacy/trac/-/issues/16028 ^[archive]
• https://trac.torproject.org/projects/tor/query?component=Applications%2FTor+Browser&summary=~incremental&max=500&order=priority ^[archive]
• https://trac.torproject.org/projects/tor/query?component=Applications%2FTor+Browser&summary=~update&max=500&order=priority ^[archive]

Backup and Restore Browser Settings[edit]

Steps to perform a backup and restore of browser settings (like bookmarks) is currently undocumented in the Whonix ™ wiki. However, any online instructions for this process in Tor Browser or even Firefox should equally apply in Whonix ™. The only difference is the Whonix ™ Tor Browser folder location: ~/.tb/tor-browser.

Close Tor Browser[edit]

Sometimes the following error message appears when no Tor Browser window is open.

Figure: Running Tor Browser Instance

Tor Browser is already running, but is not responding. To use Tor Browser, you must first close the existing Tor Browser process, restart your device, or use a different profile.

Most likely Tor Browser is still/already running in the background but without a visible desktop environment window due to an existing software bug.

To kill the Tor Browser process, run the following command.

pkill firefox.real

See also: Tor Browser Crash Errors.

Why do I have White Bars around my Tor Browser Content?[edit]

Users who ignore advice to not maximize/resize the Tor Browser window will now notice white borders surrounding the Tor Browser content: ^[146]

Ever since 9 update I have had white bars at the bottom and top of my browser. Even with using the TBB on non-whonix I still have them. Am I the only one & am I exposed?

This is not an indicator of compromise, but a new fingerprinting defense called Letterboxing ^[archive]:

Tor Browser in its default mode is starting with a content window rounded to a multiple of 200px x 100px to prevent fingerprinting the screen dimensions. The strategy here is to put all users in a couple of buckets to make it harder to single them out. That worked so far until users started to resize their windows (e.g. by maximizing them or going into fullscreen mode). Tor Browser 9 ships with a fingerprinting defense for those scenarios as well, which is called Letterboxing ^[archive], a technique developed by Mozilla and presented earlier this year ^[archive]. It works by adding white margins to a browser window so that the window is as close as possible to the desired size while users are still in a couple of screen size buckets that prevent singling them out with the help of screen dimensions.

Tor Browser Consumes 100% CPU after Clock Sync or Suspend/Resume[edit]

An upstream bug ^[archive] in Tor Browser causes the firefox.real process to consume excessive CPU whenever the connection to Tor's ControlPort is broken, which continues until Tor Browser is restarted. This is known to occur when the sdwdate clock synchronization daemon is restarted in Whonix-Gateway, whether manually via the sdwdate-gui time synchronization systray, or automatically via post-resume hooks. For details, refer to the related forum discussion ^[archive]. (original report on Qubes issue tracker ^[archive])

As a workaround:

1. Open about:config in the Tor Browser URL bar.
2. Search for and set extensions.torbutton.display_circuit to false.
3. Restart Tor Browser.

In Qubes-Whonix ™, see Disposable Customization ^[archive] to make this change persistent in Disposables.

Permission Issues[edit]

^[147]

Tip: If something does not work, do not arbitrarily try to use sudo / root without indication that this would be appropriate. That only risks messing up user home folder permissions. See Inappropriate Use of Root Rights.

Attempt to fix:

1. Open a terminal.

2. Owner Permissions Fix

Run the following command to reset permissions of user user's home folder /home/user back to owner user and group user. That command is often sufficient to fix previous inappropriate use of root rights issues.

sudo chown --recursive user:user /home/user

3. Folder Permission Fix

If that does not resolve permission issues, run the following slightly more experimental command to set chmod 0770 ^[archive] on all folders inside the user user's home folder. ^[148]

find /home/user -type d -print0 | xargs -0 chmod 0770

4. Files Permission Fix

Similar to the previous step, if that does not resolve permission issues, run the following slightly more experimental command to grant user user read and write access on all files inside the user user's home folder. This may have some disadvantages. The only known example is for users of git. See footnote for further information. ^[149]

chmod --recursive ug+rw /home/user

6. Done.

Chances are good that permission issues have been resolved. Try starting Tor Browser. In case the issue is persisting, the following options could be considered.

Attempt to debug:

Start Tor Browser Start by Whonix ™ in In Verbose Mode. This will show verbose output messages which might be useful for the user to identify the issue. In doubt, Support might help interpreting these messages.

Other options:

• Delete and Reinstall Tor Browser
• Tor Browser Manual Download
• Factory Reset, re-install method

Onion v2 Deprecation[edit]

Version 2 Onion Sites will be deprecated soon

This onion site will not be reachable soon. Please contact the site administrator and encourage them to upgrade.

Tor is ending its support for version 2 onion services beginning in July 2021, and this onion site will no longer be reachable at this address. If you are the site administrator, upgrade to a version 3 onion service soon.

Learn more… ^[archive]

This is unspecific to Whonix ™.

Figure: onion v2 deprecation notice

The "learn more" link can be clicked. It links to https://support.torproject.org/onionservices/#v2-deprecation ^[archive] which explains what is an onion v2 and an onion v3 and contains additional information.

How do I know if I'm using v2 or v3 onion services? You can identify v3 onion addresses by their 56 character length, e.g. Tor Project's v2 address:http://expyuzz4wqqyqhjn.onion/ ^[archive], and Tor Project's v3 address: http://2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion/ ^[archive]

If there is such a notice, you're visiting an onion v2. In this case, look if there is an onion v3.

• If there is no onion v3: either contact site administrator or do nothing.
• if there is an onion v3: use the onion v3; update your bookmarks.

Glossary and Key Terminology[edit]

Glossary[edit]

It is recommended to become familiar with terms regularly used by The Tor Project and Whonix ™. One useful resource is the v1.0 Tor glossary ^[archive] which is now available on The Tor Project community wiki page.

Key Terminology[edit]

Tor vs Tor Browser[edit]

Tor is an anonymizer developed by The Tor Project. Tor Browser is a web browser developed by the Tor Project which is optimized for privacy. Please do not confuse Tor with Tor Browser when conversing about Whonix ™ topics.

Tor Browser Transparent Proxying[edit]

The Tor Browser "transparent proxying" feature ^[150] and/or the environment variable TOR_TRANSPROXY=1 often cause confusion. It was an unfortunate naming decision by The Tor Project. This feature actually removes proxy settings. With no proxy set, the user's system reverts to its default configuration. The effect of this decision is that Tor Browser networking will work in a similar fashion to an unconfigured Firefox browser.

This is potentially dangerous when done outside of Whonix ™ because Tor Browser's transparent proxying feature could result in clearnet traffic; for instance if the gateway does not have a transparent torification feature (like Whonix-Gateway ™). In the case of Whonix ™, even if the transparent proxying feature is set, Whonix-Gateway ™ will "torify" traffic and force it through Tor. Similarly, if transparent proxying is set and happens to use a JonDo-Gateway, traffic will be forced through JonDo.

One downside of the transparent proxying feature is that even when it is used inside Whonix ™, it breaks Tor Browser's top level isolation for each separate tab ^[archive].

Transparent proxying should not be confused with:

• Tor's TransPort [address:]port|auto [isolation flags] setting ^[archive].
• Tor's IsolatingProxy ^[archive].

TODO: expand.

Advanced Users[edit]

Refer to this wiki entry if any of the following advanced topics are of interest:

Running Tor Browser in Qubes Disposable Template[edit]

This entry has been moved here.

See Also[edit]

• Watching YouTube Videos in Whonix ™
• Downloading YouTube Videos in Whonix ™
• Using Tor Browser in Qubes-Whonix ™
• Tor Browser, Advanced Users
• Non-Whonix ™ Tor Browser
• Verify Tor Browser in Microsoft Windows

Footnotes[edit]

License[edit]

Whonix ™ Tor Browser wiki page Copyright (C) Amnesia <amnesia at boum dot org>

Whonix ™ Tor Browser wiki page Copyright (C) 2012 - 2021 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>

This program comes with ABSOLUTELY NO WARRANTY; for details see the wiki source code.

This is free software, and you are welcome to redistribute it under certain conditions; see the wiki source code for details.

	100px
Fosshost	About Advertisements

Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki

Follow:

Support:

Donate:

Priority Support | Investors | Professional Support

Whonix ™ | © ENCRYPTED SUPPORT LP | Freedom Software / Open Source (Why?)

The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole.