[tor-dev] Concerns regarding a multilingual version of TBB,

[Mark Smith]

On 10/8/15 3:49 PM, Tim Wilson-Brown - teor wrote:
>> On 9 Oct 2015, at 06:42, Yet Another Tor User
>> <yetanothertoruser at riseup.net <mailto:yetanothertoruser at riseup.net>>
>> wrote:
>>
>> I saw an email on the Wiki mailing list concerning a multilingual
>> version of Tor. If that was made possible your language tag be used to
>> track you. This could break your anonymity. Your thoughts?
>
> Tor is currently available in multiple languages, just not in the same
> download.
> We could use the solutions we currently use for this issue:
> * for the HTTP headers, send “accept-language: en-US,en;q=0.5”
> and in other places, either send en-US, or send no language.

Agreed, and I do not see how bundling a choice of languages into one Tor 
Browser package changes things (since people are already using Tor 
Browser with various languages). The tracking issue is already mitigated 
by a language spoofing feature that is provided by Torbutton. See "User 
Agent and HTTP Headers" within the fingerprinting section of the Tor 
Browser design document:
https://www.torproject.org/projects/torbrowser/design/#fingerprinting-linkability

The relevant browser preference is extensions.torbutton.spoof_english.

-- 
Mark Smith
Pearl Crescent
http://pearlcrescent.com/