[tor-talk] TOR tried to take a snapshot of my screen

[Roger Dingledine]

On Mon, Aug 25, 2014 at 11:22:27AM -0700, BM-2cVvnFWSftFx8dv12L8z8PjejmtrjYjnUY at bitmessage.ch wrote:
> Mirimir wrote:
> > Maybe Zemana is incorrectly flagging some aspect of HTML5 canvas
> > spoofing by the Tor browser as taking a screen snapshot".
> 
> The incident happend at different web pages that had been accessed before
> many times without any incident.
> 
> The Zemana is the same version I am running since December 2013, i.e., it
> is running for around 8 months without any incident.

But the Firefox version is new, including the html5 canvas stuff. So I
think this is still a plausible direction to consider.

A search for 'zemana firefox' brings up several cases like
https://support.mozilla.org/questions/687961
that look related -- people have had problems with the interactions
between these two programs in the past.

> I guess inside the rerouting net is a kind of automatic tool to spy Tor
> users and, in addition, the (humans) operators my pick users at will for
> additional checks. Just my guess.

Well, one of the great features of Tor Browser is the deterministic
build process:
https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and-global-compromise
https://blog.torproject.org/blog/deterministic-builds-part-two-technical-details
which basically means that anybody can produce a byte-for-byte identical
version of the Tor Browser download that you have -- and many people
reproduced the Tor Browser 3.6.3 and 3.6.4 versions that you have
(assuming of course that you fetched the real one).

So that means you can grab all the source code (mostly of Firefox)
and be sure that it's actually the thing you're running:
https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser/Hacking#BuildingtheTorBrowser

Now, I know it isn't fun to look through all of Firefox for compatibility
problems between it and your other Windows program. But the point is
that anybody can do it. So hopefully it is an answer to your above
conspiracy concerns -- if you think there's a screen capture feature
in Firefox, find it!

> Hope more users will start to use Zemana and other anti-spyware and more
> reports about this problem arrives.

Hey, good thinking. Are there any other Zemana users here? I have never
heard of it, so maybe nobody else has either.

--Roger