The Tor software protects you by bouncing your communications around a distributed network of relays run by volunteers all around the world: it prevents somebody watching your Internet connection from learning what sites you visit, it prevents the sites you visit from learning your physical location, and it lets you access sites which are blocked.
The
Tor Browser lets you use Tor on Windows, Mac OS X, or Linux without needing to install any software. It can run off a USB flash drive, comes with a pre-configured web browser to protect your anonymity, and is self-contained.
The primary user-facing change since the 3.6 series is the transition to Firefox 31-ESR.
More importantly for censored users who were using 3.6, the 4.0 series also features the addition of three versions of the
meek pluggable transport.
In fact, we believe that both meek-amazon and meek-azure will work in China today, without the need to obtain bridge addresses. Note though that we still need to improve meek's performance to match other transports, though. so adjust your expectations accordingly. See tickets
#12428,
#12778, and
#12857 for details.
This release also features an in-browser updater, and a completely reorganized bundle directory structure to make this updater possible. This means that simply extracting a 4.0 Tor Browser over a 3.6.6 Tor Browser will not work. Please also be aware that the security of the updater depends on the specific CA that issued the
www.torproject.org HTTPS certificate (Digicert), and so it still must be activated manually through the Help ("?") "
about browser" menu option. Very soon, we will support both strong HTTPS site-specific certificate pinning (ticket
#11955) and update package signatures (ticket
#13379). Until then, we do not recommend using this updater if you need stronger security and normally verify GPG signatures.
There are also a couple behavioral changes relating to NoScript since 3.6. In particular, by default it now enforces script enable/disable for all sub-elements of a page, so you only need to enable scripts once for a page to work, rather than enabling many sub-scripts. This will hopefully make it possible for more people to use the "High Security" setting in our upcoming
Security Slider, which will have Javascript disabled globally via NoScript by default. While we do not recommend per-element whitelisting due to fingerprinting, users who insist on keeping this functionality may wish to check out
RequestPolicy.
Note to MacOS users: We intend to deprecate 32bit OSX bundles very soon. If you are still using 32bit OSX 10.6, you soon will need to either update your OS to a later version, or begin using the
Tails live operating system.
Here is the changelog since 4.0-alpha-3:
Here is the list of all changes in the 4.0 series since 3.6.6:
All Platforms
Windows:
- Bug 10065: Enable DEP, ASLR, and SSP hardening options
Linux:
- Bug 13031: Add full RELRO hardening protection.
- Bug 10178: Make it easier to set an alternate Tor control port and password
- Bug 11102: Set Window Class to "Tor Browser" to aid in Desktop navigation
- Bug 12249: Don't create PT debug files anymore
