Marco Bonetti: "I'm not getting the point of why there should be choice: if the users using this feature start changing they UA, the blending will be a lot more weak."
This has already been discussed previously, I was moving on to ask if this feature could be added, not debated. "If you really need it, just disable the feature in TorButton and install the UA switcher extension: after all TorButton is the essential extension for a complete firefox/tor setup but not the only one required (although it does a great job all by itself)." This was part of my point in my opening post, we shouldn't have to switch to another possibly closed and untrusted with the potential to be trojaned addons which may or may not receive heavy handed testing by Tor users to ensure it does not leak or otherwise gum up the Tor experience. Torbutton receives testing by Tor users and the author releases a signed version, my question is why is it so difficult to extend functionality to Torbutton by allowing us to specify our own user agent and/or choose between other user agents AND update the user agent string for Torbutton with each release? Surely it can't be much more difficult than borrowing some existing open code. If the real reason behind not adding this functionality is the fear the user will stand out from other tor users (a statement I don't believe) it could be marked (dangerous) just as some other options are. If the other so called dangerous options are there, perhaps these options should receive better questioning as to why they are there rather than not adding a function for users to customize/choose their own user agent string in Torbutton. G-Lo â: "Link to UA switcher addon:" X "Link to update the list of user agents:" X We're already aware these exist. I was not calling for links, I was calling for a feature improvement in Torbutton. Andrew Lewman: "Then uncheck the option and set your own user agent." Where, in Torbutton, may I do this? I assume you're referring here to modifying the Proxy user agent string setting (which does not survive SSL) or blindly trusting another addon which may or may not have issues with Tor. "There are other options to control your user agent, feel free to use those." I'm aware of other options, but they are not satisfactory nor should we have to trust other options when Torbutton could offer this simple option, even if it must be marked "dangerous" as other "dangerous" options are clearly marked, despite this not being a dangerous function as I see it. "If you want to partition yourself, by all means, do so." IMO, Torbutton usera partition themselves if they use one old, rarely updated user agent string. By using this oudated user agent string, they stand out as likely Tor users without checking whether or not they are using an exit node. I would argue users are being treated like cattle and branded with this old user agent on purpose so they do stand out that much further as Tor users. "The reason we don't provide more user agents is to make everyone look like one user." I see the point, but I disagree with this being the reason people continue to repeat day in and day out against adding better customization to Torbutton. I argue, if the Torbutton author's main concern was this, other so called dangerous options would not exist because the user could make the mistake and choose different options and thus risk privacy or security issues in his/her Tor session. I call upon the Torbutton author to consider adding this simple functionality within a future version of Torbutton and I suggest he update the user agent with each version rather than retaining an old Firefox user agent. We could all have the user agent "Torbutton user!" and blend with other Torbutton users, too*, but I would hope we had the sanity to choose something better and more widely used than an outdated, uncommon Firefox user agent. * / since not everyone downloads the Torbutton addon and has different user agents for Tor, thus these hundreds or thousands of Tor users without Torbutton and Torbutton's neglected user agent string do not blend in with other Torbutton users. Instead, many may choose to use a more popular user agent string and better blend in with everyone, not just the Tor users, after all, the webmasters reviewing logs may see a tor exit node being used, but for all they know the user with the popular user agent (blending in more with the population at large) coming from a tor exit node could be spoofing the tor exit node location. EFF's little test did not factor in the IP address, did it? No, it factored in browser information and from the results I've read across the web, Torbutton users stood out like a sore thumb compared with non-tor users. I've read the responses here to EFF's browser test site, so I don't need a rehash of people's feelings against the method(s) used in the browser test. I call for this feature to be added to Torbutton, I don't believe the "blending" statement is entirely true when the larger picture is examined. *********************************************************************** To unsubscribe, send an e-mail to [email protected] with unsubscribe or-talk in the body. http://archives.seul.org/or/talk/
