Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unable to start tor browser - gpg hangs refreshing keys (possible key servers DoS) #401

Closed
arvidjaar opened this issue Jul 3, 2019 · 26 comments · Fixed by #402
Closed

Comments

@arvidjaar
Copy link

See https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f

What I have now looks very much like it:

UID        PID  PPID  C STIME TTY          TIME CMD
bor      31474 31391 97 06:30 ?        00:13:46 /usr/bin/gpg --status-fd 2 --homedir /home/bor/.local/share/torbrowser/gnupg_homedir --keyserver hkps://hkps.pool.sks-keyservers.net --keyserver-options ca-cert-file /usr/share/torbrowser-launcher/sks-keyservers.netCA.pem include-revoked no-honor-keyserver-url no-honor-pka-record --refresh-keys

Yes, 13 minutes processing time!!!

Please make key server configurable to allow mitigation.

@maieul
Copy link

maieul commented Jul 4, 2019

same problem

@baptx
Copy link

baptx commented Jul 8, 2019

The workaround I used is to kill all GPG processes with the command killall gpg, then Tor Browser started and I could use it.
But isn't this workaround removing the following security feature?
Verifies Tor Browser's signature for you, to ensure the version you downloaded was cryptographically signed by Tor developers and was not tampered with
Then it would be considered a security vulnerability that we can start Tor Browser just by killing GPG, users should not be able to disable a security feature without giving an explicit permission (e.g. through a command parameter --disable-gpg) and a warning should be displayed when the browser starts.

This issue looks similar to a previous one: #305
Here is a cleaner workaround to start Tor Browser: ~/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/start-tor-browser.

Related: #400

@Argentino84
Copy link

Same problem and the suggested workaround doesn't work for me. After killing gpg I only can choose to download everything again or close.

@P9at4Kic
Copy link

this may not be an issue with tor but an attack on OpenPGP

https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f

@Wikinaut
Copy link

@micahflee thanks for swift reaction and fix (confirmed: works).

@dephekt
Copy link
Contributor

dephekt commented Aug 3, 2019

People using the Ubuntu 18.04.2 LTS release version of this can do a oneliner to delete the bad key and a small hack to make torbrowser-launcher not hang on the key refresh.

This will delete the offending key you received from hkps.pool.sks-keyservers.net:
gpg --homedir ~/.local/share/torbrowser/gnupg_homedir --delete-keys torbrowser@torproject.org

Then you can manually edit your locally installed torbrowser-launcher to use keys.openpgp.org as seen in #402 by editing /usr/lib/python2.7/dist-packages/torbrowser_launcher/common.py line 220 and change hkps://hkps.pool.sks-keyservers.net to hkps://keys.openpgp.org.

Then start torbrowser-launcher like usual and it will get an uncorrupted key and things will keep working. It's just a way to workaround the issue until Ubuntu releases a fixed version downstream.

@matt3o
Copy link

matt3o commented Aug 27, 2019

gpg --homedir ~/.local/share/torbrowser/gnupg_homedir --delete-keys torbrowser@torproject.org

This stalls forever on my machine on 100% cpu usage.

For me a different quote in another bug report (#356) helped:

Running rm -r ~/.config/torbrowser ~/.cache/torbrowser ~/.local/share/torbrowser before trying to reinstall has solved my problem.

Fixed it for me.

@MaxXor
Copy link

MaxXor commented Sep 5, 2019

Can you release an update of torbrowser-launcher which includes the fix with the new key server? It's too inconvenient having to edit this line by hand to make it work on any fresh install for new users.

edit: The https://deb.torproject.org/torproject.org bionic repository does still cause this issue.

@wizball1087
Copy link

Thanks dephekt:

The workaround worked great for me also, the problem has been bugging me for days.

@magusvox
Copy link

magusvox commented Sep 7, 2019

im new on linux, but this has some hacker attack or i misundestood something?

@mark-orion
Copy link

I have the same problem (Ubuntu 18.04 LTS). Personally I don't mind editing things but please provide a fix for this ASAP - just for the sake of ease of use and to make TOR user friendly.

@dafeder
Copy link

dafeder commented Dec 10, 2019

I tried this fix and get farther now, in startup, but get a dialog with GENERIC_VERIFY_FAIL error.

@noloader
Copy link

Add a "mee too" for Ubuntu 18.04.03 x86_64 (fully patched).

I can't seem to get beyond this failure. It has been going on 6 months to a year:

Screenshot from 2019-12-18 15-27-08

Why can't Tor and Ubuntu get this to work?

@hvek
Copy link

hvek commented Jan 25, 2020

I also have the same issue with 18.04.03

@lucidyan
Copy link

For those who will experience this behavior on Ubuntu 18.04 - you should install newer version by adding ppa:

sudo add-apt-repository ppa:micahflee/ppa
sudo apt install torbrowser-launcher

Source:
#410 (comment)

@maksliman
Copy link

NAME="Linux Mint"
VERSION="19.1 (Tessa)"
4.15.0-74-generic GNU/Linux

https://github.com/micahflee/torbrowser-launcher
Refreshing local keyring...

and still not working

@bansheetk23
Copy link

Adding ppa worked for me. Thanx

@baptx
Copy link

baptx commented Mar 3, 2020

This problem is still present in Ubuntu 19.10. Adding PPA and reinstalling Tor browser did not fix the issue for me.

@guglielmogcg
Copy link

sudo apt-get purge tor torbrowser-launcher
rm -r ~/.config/torbrowser ~/.cache/torbrowser ~/.local/share/torbrowser

then add the ppa and sudo apt install torbrowser-launcher

Worked for me, ubuntu 18.04

@serolrom
Copy link

sudo apt-get purge tor torbrowser-launcher
rm -r ~/.config/torbrowser ~/.cache/torbrowser ~/.local/share/torbrowser

then add the ppa and sudo apt install torbrowser-launcher

Worked for me, ubuntu 18.04

Confirming this works for me.
From a newbie at Linux, let me give you guys a big Thank you!

@syfran66
Copy link

I'm on Linux Mint 19.3 Tricia and it still doesn't work.
Need help please.
Thanks

@alexalex1024
Copy link

alexalex1024 commented May 9, 2020

sudo apt-get purge tor torbrowser-launcher
rm -r ~/.config/torbrowser ~/.cache/torbrowser ~/.local/share/torbrowser

then add the ppa and sudo apt install torbrowser-launcher

Worked for me, ubuntu 18.04

It works very well for me with Ubuntu 18.04. Before, all other online workarounds have failed! You save me!

@comradekingu
Copy link

sudo add-apt-repository ppa:micahflee/ppa
sudo apt install torbrowser-launcher

run a "sudo apt update" between those to find the new package.

@ktuulos
Copy link

ktuulos commented Jul 4, 2020

Hmm, the above mentioned ppa does not work in my Ubuntu 18.04.04 computer. When I enabled the ppa and tried to install onionshare, I got following error message:

Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 onionshare : Depends: python3-flask-httpauth but it is not installable
E: Unable to correct problems, you have held broken packages.

True, there is no python3-flask-httpauth in Bionic. What now?

@avimanyu786
Copy link

avimanyu786 commented Sep 19, 2020

Hmm, the above mentioned ppa does not work in my Ubuntu 18.04.04 computer. When I enabled the ppa and tried to install onionshare, I got following error message:

Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 onionshare : Depends: python3-flask-httpauth but it is not installable
E: Unable to correct problems, you have held broken packages.

True, there is no python3-flask-httpauth in Bionic. What now?

I manually installed the Focal package on Bionic and then was able to install onionshare successfully.

@dhanesh-vishwakarma-a6
Copy link

I'm a 20.04 user.
Didn't worked for me...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet