Torbutton : please offer better user agent choices

[twinkletoedturtle at Safe-mail.net]

Marco Bonetti:

"I'm not getting the point of why there should be choice: if the
users using this feature start changing they UA, the blending will be a
lot more weak."

This has already been discussed previously, I was moving on to ask if
this feature could be added, not debated. 

"If you really need it, just disable the feature in TorButton and install
the UA switcher extension: after all TorButton is the essential
extension for a complete firefox/tor setup but not the only one required
(although it does a great job all by itself)."

This was part of my point in my opening post, we shouldn't have to
switch to another possibly closed and untrusted with the potential to
be trojaned addons which may or may not receive heavy handed testing
by Tor users to ensure it does not leak or otherwise gum up the Tor
experience. Torbutton receives testing by Tor users and the author
releases a signed version, my question is why is it so difficult to
extend functionality to Torbutton by allowing us to specify our own
user agent and/or choose between other user agents AND update the
user agent string for Torbutton with each release? Surely it can't
be much more difficult than borrowing some existing open code. If the
real reason behind not adding this functionality is the fear the
user will stand out from other tor users (a statement I don't believe)
it could be marked (dangerous) just as some other options are. If the
other so called dangerous options are there, perhaps these options
should receive better questioning as to why they are there rather
than not adding a function for users to customize/choose their own
user agent string in Torbutton.

G-Lo â:

"Link to UA switcher addon:"  X
"Link to update the list of user agents:" X

We're already aware these exist. I was not calling for links, I was
calling for a feature improvement in Torbutton.

Andrew Lewman:

"Then uncheck the option and set your own user agent."

Where, in Torbutton, may I do this? I assume you're referring here
to modifying the Proxy user agent string setting (which does not survive SSL)
or blindly trusting another addon which may or may not have issues with
Tor.

"There are other options to control your user agent, feel free to use those."

I'm aware of other options, but they are not satisfactory nor should we have
to trust other options when Torbutton could offer this simple option, even
if it must be marked "dangerous" as other "dangerous" options are clearly
marked, despite this not being a dangerous function as I see it.


"If you want to partition yourself, by all means, do so."

IMO, Torbutton usera partition themselves if they use one old, rarely updated
user agent string. By using this oudated user agent string, they stand out
as likely Tor users without checking whether or not they are using an exit node.
I would argue users are being treated like cattle and branded with this old
user agent on purpose so they do stand out that much further as Tor users.

"The reason we don't provide more user agents is to make everyone look
like one user."

I see the point, but I disagree with this being the reason people continue
to repeat day in and day out against adding better customization to Torbutton.
I argue, if the Torbutton author's main concern was this, other so called
dangerous options would not exist because the user could make the mistake
and choose different options and thus risk privacy or security issues in
his/her Tor session. I call upon the Torbutton author to consider adding
this simple functionality within a future version of Torbutton and
I suggest he update the user agent with each version rather than retaining
an old Firefox user agent.

We could all have the user agent "Torbutton user!" and blend with other
Torbutton users, too*, but I would hope we had the sanity to choose
something better and more widely used than an outdated, uncommon
Firefox user agent.

* / since not everyone downloads the Torbutton addon and has different
user agents for Tor, thus these hundreds or thousands of Tor users
without Torbutton and Torbutton's neglected user agent string do 
not blend in with other Torbutton users. Instead, many may choose
to use a more popular user agent string and better blend in with
everyone, not just the Tor users, after all, the webmasters reviewing
logs may see a tor exit node being used, but for all they know the
user with the popular user agent (blending in more with the population
at large) coming from a tor exit node could be spoofing the tor exit
node location. EFF's little test did not factor in the IP address,
did it? No, it factored in browser information and from the results
I've read across the web, Torbutton users stood out like a sore thumb
compared with non-tor users. I've read the responses here to EFF's
browser test site, so I don't need a rehash of people's feelings
against the method(s) used in the browser test.

I call for this feature to be added to Torbutton, I don't believe
the "blending" statement is entirely true when the larger picture
is examined.
***********************************************************************
To unsubscribe, send an e-mail to majordomo at torproject.org with
unsubscribe or-talk    in the body. http://archives.seul.org/or/talk/