So the tour project sent out a letter on May 29th that was full of deception and that's what we're
talking about today. Why, who actually cares? Well, the actual issue is if you can't trust them to
tell you the truth with a simple newsletter, then what can you actually trust them with?
Now, for a bit of context, this will be my fourth video on this subject. However,
this one will be pretty short compared to the other ones. And I've released three videos exposing
the tour projects, various failures, which was really unfortunate. The first was tour
browsers latest update gets you fingerprinted, which is released April 22nd. And it showed
basically via their own developer statements, their removal of OS spoofing protection. Two weeks
later on May 6th, I released for 11 months tour let users think that they were safe, which revealed
the broken security slider. The third for nine years tour ignored Princeton's proof. BGP attacks
can unmask millions of users essentially showed their infrastructure vulnerabilities. And the
fact that Princeton University had actually discussed mitigation techniques like nine years prior to that.
Now, combined, these videos reached almost a quarter of a million viewers who really just
deserve to know the truth. Now, let's actually pivot for a minute and go to the actual newsletter
that I mentioned. Here, we can see that it says, don't worry, it's here to stay. There's been some
online speculation and confusion around OS spoofing in tour browser as a result of tour
browsers latest stable release. Let's be clear, OS spoofing has never gone away, and it is here
to stay. So let's address each deception individually. And I'll start with the most
vague and then get to the actual serious lie addressing the kind of nonsensical and
propagandist citation of online speculation and confusion. There was no speculation.
Nor was there any real confusion. Like many of you already know this, because in those three
videos, 2,316 of you actually commented, here's the actual speculation, their developer stating,
we turn off spoofing OS. And here's the confusion part, their actual developer stating, remove
the relevant machinery from Firefox altogether. They're basically calling their own documentation
decision speculation outright live, you can find where they say OS spoofing has never gone
anywhere. Developer documentation actually proves they removed it entirely. Like this isn't even
a question. Like, this is a direct lie to users who actually trust them. Lastly, they say here to
stay when they actually removed the code in April of 2025. One month later, they claim that it's
here to stay. The code is gone. It's like the feature is gone. Now, that's not me
guessing that it's gone. Their own developers explicitly documented actually removing it. On
October 2024, developer Thornton opens issue 43.170 stating privacy resistant finger printing spoofing
user agent headers should be false in Tor browser 14 plus. The original intent of
42647 was that we turn off spoofing OS. Did you catch that one? Turn off spoofing OS.
That's their words, right? This not improve or modify, it's turn off. And when you turn
off the light, is the light still there? I think so. In April of 2025, developer Morgan
implemented the removal in issue 43.189 when he said with 43.170 we're no longer spoofing user
agents in any of our browsers. We can therefore remove the relevant machinery from Firefox
altogether. Now, to be clear, they stopped faking the operating system part of the user agent
where everyone used to appear as a Windows user. Now your real OS actually shows through.
And we'll cover more detail in this in a minute, but like Morgan basically confirms that they
removed the entire machinery that made this protection even possible to begin with. This
would actually proves their actual deception. Developer Pierre admits privacy resist fingerprint
spoof OS and user agent handler is still in our prefs file, even though we've ripped
out the code. They left a setting that does nothing like I is leaving a light switch on
like the wall after removing the wiring. Users might flip that switch thinking they're protected,
but nothing actually happens. It's a dummy switch, right? The protection is completely
gone even though the illusion remains and the newsletter continues with calculated
misdirection. I might add when it says tour browser has always limited user agents to general
categories. Windows Mac OS Linux or Android in JavaScript and Windows or Android in HTTP headers.
That means we spoof the OS version and architecture, which was always the approach in JavaScript.
Now it's consistent in HTTP headers too. Okay, so let's decode this harmonization lie. Here's
what actually happened before their change. There were two ways that websites could actually
detect your operating system, mainly one was through JavaScript when enabled,
which could see your real OS and through HTTP headers, the basic information your browser sends
to every single website, which tore spoofed to show everyone as a Windows user, right? So this
meant if you disable JavaScript, say for security, which most people want security do, you were protected
and the HTTP headers still hid your real OS. Everyone looked like a Windows user in the
server logs and they removed that protection and now HTTP headers reveal your real operating system
just like JavaScript does. If you're on Linux, the server sees Linux. If you're on Mac, the server
sees Mac and they took away the protection that basically mattered the most and the one that worked
when users did everything right and called it harmonization. Now to be fair, look at different
sides of this argument, they'll probably argue like their defenders at privacy guides did
that CSS could detect your OS anyways, but that's nonsense. CSS based OS detection
is speculative at best and pretty much hit or miss guesswork based on things like scroll bar OS,
like HTTP headers are precise, right? Permanent records that actually say this user runs Linux
like almost definitively, right? Now there's a massive difference between
maybe we can guess your OS through some CSS tricks that might or might not work and
your OS is permanently logged in plain text on every server you visit every time you visit it.
They know this. They removed the protection anyways because they wanted to. They basically
redefined OS spoofing to hide what they actually did and again remember previously
OS spoofing meant all users all users appeared as windows regardless of the actual operating system.
That's what provided the anonymity and made it hard to be fingerprinted. Everyone looked identical
and everyone had the same fingerprint. It made them like obviously harder to fingerprint.
So they're calling version spoofing now OS spoofing like version spoofing hides whether you're on
Windows 10 or Windows 11 OS spoofing hid whether you were Windows user Linux user or Mac and the
entirety of the OS. These are fundamentally different protections that we're actually talking
about and before their change again server logs showed everyone as a Windows user. I really
want to emphasize that and I know I'm being that dead horse but it's important after the change
Linux users showed his Linux Mac users showed his Mac they fragmented the anonymity set and
then they lied about it and that's my beef like so now like watch they'll try to defend this
with some like technicality in between like their panhandling posts that they make where
they beg for tens of thousands of dollars they'll say the preference still exists in the about config
sure a dead preference that does nothing because they ripped out the code their words their developers
words they claim they're still doing OS spoofing because they hide the version numbers like I mean
that's like saying that you're wearing a disguise because you put on clown shoes
but nothing else it's laughably stupid they'll argue that javascript already revealed your OS
anyways so what with javascript disabled which security conscious users do
htb headers were the kind of last line of defense and now that's gone too so
server logs permanently record your real OS and this might seem like some kind of little detail
but ask any serious investigator if they care about a piece of identifying information
that adds uniqueness to the target and they'll point to their september 2024 blog post as proof
that they actually announced it they had a passing singular mention in a alpha release blog
that nobody reads and this was in my opinion for plausible deniability I can't actually
state that but that's my contention these developers making six figures couldn't tweet about
removing a core privacy feature nor could the marketing team apparently but they can beg
continually on social media for you to fund them when the feds are not giving them millions of
dollars now when confronted in the comments of the first video that I put out there
they claimed that proposals for this change were introduced in september of 2024 with the tour browser
14 oa4 release calling on the tour community to provide feedback we received very little feedback
and implemented the change they buried the change in the alpha release notes in git lab tickets
and then blamed users for not actually finding it and this goes you'll be odd reading terms
of service agreement or even release notes and none of that anyone actually reads like we both know
that they legit expected people to go to their git lab and read developer conversations thousands of
pages to know what's actually going on when they post regularly on multiple social media gouts the
real agenda appears in thorn's own words from issue 4 3 1 7 0 we are meant to discourage users
from changing settings in the about config by adding a switch you are allowing entropy to increase
which is anthetical to the mission my intent and has been for years is not to spoof the os in
linux mac not to add a pref for users to fiddle with right they view user choice is
anthetical to their mission is what they're telling you they don't want users to have preferences to
fiddle with how like not allowing people to modify settings in a browser that those same people
fund like if you're a u.s citizen anyway and pay taxes your donor that's what it is
or if you're a donor from another country you're still paying for it like keep in mind the guy that's
actually saying this makes well over a hundred thousand dollars a year to do this job and
works to the comfort of his own home and here you can see an ad for developer position and this
is an entry level position it seems like so most likely the devs devs that are actually talking
about taking away user choice and make a lot more money anyway another developer actually
warned about the consequences before implementation saying that my concern is passive fingerprinting
in case of server seizure the server logs can reveal more information about the user to the
adversary no one answered them they just left them on scene when markets get seized or hidden
services get compromised that data absolutely helps identify users privacy guides tried
chirping in and and running damage control for the Torah project claiming that
there's still spoofing going on it's just four different buckets instead of one
four means segregation not spoofing so before there was one group everyone appeared as being
on windows and after it's four groups so clearly labeled by os like they're categorizing
users instead of protecting them which was my point like they also claimed with privacy guys I mean
that HTTPS prevents the issue and HTTPS prevents network interception sure but not serve a logging
moron like when servers get seized logs contain os fingerprints regardless of HTTPS
as but like here's what actually makes this excuse so pathetic most onion sites run HTTP
not HTTPS and don't answer this but how many people do you know that download Torah browser
to watch YouTube videos or make a Reddit account considering the fact you can't it's
be a lot right so and I mean the latter if we're on jeopardy what is your Torah hidden services
right like did they forget that onion sites actually exist you're downloading the Torah
browser what are those access okay like let's put that to the side for a minute we'll just
forget about it they didn't need HTTPS because Torah already provides end-to-end encryption
to hidden services right so their HTTPS solves this argument is completely meaningless
though it's nonsense so for the very services where anonymity matters most dark net markets
whistleblower sites hidden services right privacy guides absolutely knows this but spread
this nonsensical misinformation and this isn't their actual first time trying to pull this
kind of nonsense either in june of 2024 graphino s actually had to call out privacy guides leader
for spreading lies about their product claiming they marketed to criminals graphino s called it
a thoroughly dishonest attempt to harm them seems privacy guides has a pattern of attacking
actual privacy products while defending those who do things like remove privacy features
okay so we move on right but look at who tore thanks in their newsletter on a related note
we'd like to thank privacy guides for spearheading a productive discussion around a flaw in Torah
browser security slider privacy guides the same nonprofit that defended Torah OS spoofing
removal saying that classification was spoofing can't make this up in the video comments claiming
that quote the risk for people or niche os's has not significantly changes when i absolutely did
like my security slider video reached 68 000 people and almost 900 of you actually commented
exposing this kind of 11 month vulnerability that existed and of course they didn't want to
say they didn't want to talk about this channel in the newsletter but they definitely wanted to
thank their defenders but both organizations and nonprofits i get it dude three videos later with
239 000 views combined views anyways and over 2300 comments they can't really claim
ignorance anymore though 68 users responded directly to their pinned comment in that first
video and the Torah project never bothered to respond to a single one instead they posted
damage control and basically ran away the timeline really shows everything october of 2024
they made the decision to remove os spoofing april of 2025 there was implementation and
code removal and then april 22nd of 2025 was my first video exposing their change and may 29th
of 2025 was the newsletter that was actually lying about it so seven months after deciding to remove
it one month after implementing it and five weeks after getting exposed they sent a newsletter
claiming it was never removed they literally state os spoofing has never gone anywhere
while their developers documented removing it entirely which you saw they claim it's here to stay
after ripping it out the Torah project deliberately deceived users rather than
just admit what they did they removed privacy features then they lied about it in an official
communication my advice would be to stop donating to projects that lie about their actions
stop trusting newsletters that contradict developer documentation stop believing organizations
that treat user choice as a threat the newsletter proves that they'll rather deceive users
than actually tell the truth about anything so as always thanks for watching to the end
and i'll see you the next video