Unable to start tor browser - gpg hangs refreshing keys (possible key servers DoS)

[arvidjaar]

See https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f

What I have now looks very much like it:

UID        PID  PPID  C STIME TTY          TIME CMD
bor      31474 31391 97 06:30 ?        00:13:46 /usr/bin/gpg --status-fd 2 --homedir /home/bor/.local/share/torbrowser/gnupg_homedir --keyserver hkps://hkps.pool.sks-keyservers.net --keyserver-options ca-cert-file /usr/share/torbrowser-launcher/sks-keyservers.netCA.pem include-revoked no-honor-keyserver-url no-honor-pka-record --refresh-keys

Yes, 13 minutes processing time!!!

Please make key server configurable to allow mitigation.

[maieul]

same problem

[baptx]

The workaround I used is to kill all GPG processes with the command killall gpg, then Tor Browser started and I could use it.
But isn't this workaround removing the following security feature?
Verifies Tor Browser's signature for you, to ensure the version you downloaded was cryptographically signed by Tor developers and was not tampered with
Then it would be considered a security vulnerability that we can start Tor Browser just by killing GPG, users should not be able to disable a security feature without giving an explicit permission (e.g. through a command parameter --disable-gpg) and a warning should be displayed when the browser starts.

This issue looks similar to a previous one: #305
Here is a cleaner workaround to start Tor Browser: ~/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/start-tor-browser.

Related: #400

[Argentino84]

Same problem and the suggested workaround doesn't work for me. After killing gpg I only can choose to download everything again or close.

[P9at4Kic]

this may not be an issue with tor but an attack on OpenPGP

https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f

[Wikinaut]

@micahflee thanks for swift reaction and fix (confirmed: works).

[dephekt]

People using the Ubuntu 18.04.2 LTS release version of this can do a oneliner to delete the bad key and a small hack to make torbrowser-launcher not hang on the key refresh.

This will delete the offending key you received from hkps.pool.sks-keyservers.net:
gpg --homedir ~/.local/share/torbrowser/gnupg_homedir --delete-keys [email protected]

Then you can manually edit your locally installed torbrowser-launcher to use keys.openpgp.org as seen in #402 by editing /usr/lib/python2.7/dist-packages/torbrowser_launcher/common.py line 220 and change hkps://hkps.pool.sks-keyservers.net to hkps://keys.openpgp.org.

Then start torbrowser-launcher like usual and it will get an uncorrupted key and things will keep working. It's just a way to workaround the issue until Ubuntu releases a fixed version downstream.

[matt3o]

gpg --homedir ~/.local/share/torbrowser/gnupg_homedir --delete-keys [email protected]

This stalls forever on my machine on 100% cpu usage.

For me a different quote in another bug report (#356) helped:

Running rm -r ~/.config/torbrowser ~/.cache/torbrowser ~/.local/share/torbrowser before trying to reinstall has solved my problem.

Fixed it for me.

[MaxXor]

Can you release an update of torbrowser-launcher which includes the fix with the new key server? It's too inconvenient having to edit this line by hand to make it work on any fresh install for new users.

edit: The https://deb.torproject.org/torproject.org bionic repository does still cause this issue.

[wizball1087]

Thanks dephekt:

The workaround worked great for me also, the problem has been bugging me for days.

[magusvox]

im new on linux, but this has some hacker attack or i misundestood something?

[mark-orion]

I have the same problem (Ubuntu 18.04 LTS). Personally I don't mind editing things but please provide a fix for this ASAP - just for the sake of ease of use and to make TOR user friendly.

[dafeder]

I tried this fix and get farther now, in startup, but get a dialog with GENERIC_VERIFY_FAIL error.

[noloader]

Add a "mee too" for Ubuntu 18.04.03 x86_64 (fully patched).

I can't seem to get beyond this failure. It has been going on 6 months to a year:

Why can't Tor and Ubuntu get this to work?

[hvek]

I also have the same issue with 18.04.03

[lucidyan]

For those who will experience this behavior on Ubuntu 18.04 - you should install newer version by adding ppa:

sudo add-apt-repository ppa:micahflee/ppa
sudo apt install torbrowser-launcher

Source:
#410 (comment)

[maksliman]

NAME="Linux Mint"
VERSION="19.1 (Tessa)"
4.15.0-74-generic GNU/Linux

https://github.com/micahflee/torbrowser-launcher
Refreshing local keyring...

and still not working

[bansheetk23]

Adding ppa worked for me. Thanx

[baptx]

This problem is still present in Ubuntu 19.10. Adding PPA and reinstalling Tor browser did not fix the issue for me.

[guglielmogcg]

sudo apt-get purge tor torbrowser-launcher
rm -r ~/.config/torbrowser ~/.cache/torbrowser ~/.local/share/torbrowser

then add the ppa and sudo apt install torbrowser-launcher

Worked for me, ubuntu 18.04

[serolrom]

sudo apt-get purge tor torbrowser-launcher
rm -r ~/.config/torbrowser ~/.cache/torbrowser ~/.local/share/torbrowser

then add the ppa and sudo apt install torbrowser-launcher

Worked for me, ubuntu 18.04

Confirming this works for me.
From a newbie at Linux, let me give you guys a big Thank you!

[syfran66]

I'm on Linux Mint 19.3 Tricia and it still doesn't work.
Need help please.
Thanks

[alexalex1024]

sudo apt-get purge tor torbrowser-launcher
rm -r ~/.config/torbrowser ~/.cache/torbrowser ~/.local/share/torbrowser

then add the ppa and sudo apt install torbrowser-launcher

Worked for me, ubuntu 18.04

It works very well for me with Ubuntu 18.04. Before, all other online workarounds have failed! You save me!

[comradekingu]

sudo add-apt-repository ppa:micahflee/ppa
sudo apt install torbrowser-launcher

run a "sudo apt update" between those to find the new package.

[ktuulos]

Hmm, the above mentioned ppa does not work in my Ubuntu 18.04.04 computer. When I enabled the ppa and tried to install onionshare, I got following error message:

Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 onionshare : Depends: python3-flask-httpauth but it is not installable
E: Unable to correct problems, you have held broken packages.

True, there is no python3-flask-httpauth in Bionic. What now?

[avimanyu786]

Hmm, the above mentioned ppa does not work in my Ubuntu 18.04.04 computer. When I enabled the ppa and tried to install onionshare, I got following error message:

Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 onionshare : Depends: python3-flask-httpauth but it is not installable
E: Unable to correct problems, you have held broken packages.

True, there is no python3-flask-httpauth in Bionic. What now?

I manually installed the Focal package on Bionic and then was able to install onionshare successfully.

[dhanesh-vishwakarma-a6]

I'm a 20.04 user.
Didn't worked for me...