May 5, 2006

Torbutton Firefox plugin

Author: Nathan Willis

At a Wi-Fi hotspot, you may need the security and anonymity of Tor, but on a secure network, the higher bandwidth of a direct connection becomes more important. Torbutton is a plugin for Mozilla Firefox that enables users to easily and rapidly switch Tor on and off.

Torbutton works by flipping the browser's proxy settings back and forth between a secure, "Torified" setting and the unsecured default. You will need to download and install both Tor and Privoxy in order for it to work. But whereas the traditional means of Torifying Firefox requires manually changing the proxy settings, Torbutton adds a small pane to the status bar that both displays and toggles the enabled/disabled state of the Tor connection.

Torifying Firefox versions prior to 1.5 requires Privoxy in order to stop the so-called "DNS leak" -- i.e., DNS requests could not be directed to go through the SOCKS proxy like other protocols. Firefox 1.5 and later adds a proxy setting for DNS, thus eliminating the dependency on Privoxy. The Torbutton home page indicates that the next release will handle additional configurations.

It should be noted, though, that some users are comfortable living with the DNS leak -- Torifying HTTP traffic is sufficient to protect your data in most cases. Patching the DNS leak is done primarily to prevent snooping on which sites you visit.

One limitation of Torbutton is that it toggles the browser's proxy settings only between "Manual proxy configuration" and "Direct connection to the Internet." This is a limitation because Firefox allows you to specify only one manual proxy configuration, meaning that if you use a proxy to access the Internet when not using Tor, that proxy setting already occupies your manual configuration.

The better long-term solution, of course, is to fix Firefox so that users can maintain more than one manual proxy configuration. In the meantime, though, Torbutton developer Scott Squires recommends that users who need more complete proxy management look into the SwitchProxy extension.

Since Thunderbird and Sunbird share proxy settings preferences nearly identical to Firefox's, the Torbutton code could presumably be adapted to fit. Squires, however, is not currently planning to build a version of Torbutton for Mozilla Thunderbird or Sunbird, though both handle HTTP traffic. Email is not a low-latency application like Web browsing, Squires points out, and presents different threat models. Tor's anonymous network would wreak spamming havoc were it to allow SMTP traffic, but there are other options out there. For email anonymity, Squires recommends an anonymous remailer such as MixMinion.

As is often the case with security products, the big hurdles to Tor's widespread adoption are not technical in nature. Users stand to gain a lot from the privacy and anonymity of Tor, but the process of Torifying applications one by one can be discouraging. Torbutton is a useful tool to make that process simpler and encourage the hesitant.


  • Programming
Click Here!