Conversation

Notices

1. Embed this notice
   Rich Felker (dalias@hachyderm.io)'s status on Thursday, 06-Aug-2026 03:00:58 JST Rich Felker

   • evacide

   @evacide How could it affect Tor Onion Browser? Is there a fake Tor Onion Browser on iOS just like there's a fake Firefox, where it's really just the Apple browser reskinned?

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Thursday, 06-Aug-2026 05:03:54 JST Rich Felker

     in reply to

     • evacide
     • Sarah Jamie Lewis

     @sarahjamielewis @evacide Seems like Onion Browser should remove passkey support.

   • Embed this notice
     Sarah Jamie Lewis (sarahjamielewis@mastodon.social)'s status on Thursday, 06-Aug-2026 05:03:55 JST Sarah Jamie Lewis

     in reply to

     • evacide

     @dalias @evacide

     Basically, yes. Tor Project recommends Onion Browser on iOS (but it isn't a tor project project, or wasn't when I last looked)

     "There is no Tor Browser for iOS. We recommend an iOS app called Onion Browser, which is open source, uses Tor routing, and is developed by someone who works closely with the Tor Project."

     https://support.torproject.org/tor-browser/getting-started/installing/#ios

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Thursday, 06-Aug-2026 05:06:36 JST Rich Felker

     in reply to

     • evacide
     • Sarah Jamie Lewis

     @sarahjamielewis @evacide Or... if that's impossible because it's not actually something they can control, because the "app" is just a reskinning of Safari...

     ...then maybe that's a sign they shouldn't be shipping something users will be led to believe is actually a different, safe browser that can protect their privacy when it's not.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Thursday, 06-Aug-2026 05:38:33 JST Rich Felker

     in reply to

     • evacide
     • Sarah Jamie Lewis
     • LisPi

     @lispi314 @evacide @sarahjamielewis Supposedly they refuse to approve anything that's a an actual browser for inclusion in the App Store.

     Although it's not entirely clear to me whether it's just JITs that are banned.

     If the latter, they could and should just ship Tor Browser with the JIT functionality ripped out and only interpreter for JS.

   • Embed this notice
     LisPi (lispi314@udongein.xyz)'s status on Thursday, 06-Aug-2026 05:38:35 JST LisPi

     in reply to

     • evacide
     • Sarah Jamie Lewis

     @dalias @sarahjamielewis @evacide

     In a quirk of how passkeys work — a broadly secure alternative to usernames and passwords which use the WebAuthn standard — a user’s device makes a web request outside of the browser itself. Meaning, that request essentially bypasses Private Relay and exposes a user’s real IP address, even though to them it may look like they are simply interacting with a website as normal.

     Side-channel leak, support should never have been present for using an external program that cannot guarantee it will go through Tor.

     Such support is only acceptable on Whonix (or similar), anything else would require passkey support to be built into the browser.

     Because all web browsers on iOS have to use Apple’s WebKit engine, the researchers also found the issues impact at least one Tor browser, called OnionBrowser.

     For two of those leaks, the issues are “entirely based on how iOS and WebKit work and solely in Apple's hands. (That's the part that's kind of dire),” Mike Tigas, the creator of OnionBrowser, told 404 Media.

     It's not Tor Browser and what it's doing is utterly irresponsible.

     have to use Apple’s WebKit engine

     How are they enforcing this?