[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-bugs] #20468 [Applications/Tor Browser]: TorBrowser using a secert HASHEDPASSWORD
#20468: TorBrowser using a secert HASHEDPASSWORD
------------------------------------------+----------------------
Reporter: cypherpunks | Owner: tbb-team
Type: defect | Status: new
Priority: Medium | Milestone:
Component: Applications/Tor Browser | Version:
Severity: Normal | Keywords:
Actual Points: | Parent ID:
Points: | Reviewer:
Sponsor: |
------------------------------------------+----------------------
For security reasons, I was trying force the TorBrowser to work with it's
own tor instance (and SocksPort) but without allowing it to have access to
the ControlPort.
I don't care for the TorButton New Identity or circuit path display
features.
I tried setting CookieAuthentication to 0 in torrc-defaults. But was
surprised to find that the TorBrowser still managed to authenticate with
the control port and the TorButton was able to display the circuit path.
With the help of the folks on irc, we were able to determine that the
TorLauncher uses it's own secret hashed password if it's unable to find a
cookie or env password.
Protocolinfo says: 250-AUTH METHODS=HASHEDPASSWORD
I think the TorBrowser and TorLauncher should respect the users wishes and
not set a secret password for itself. Instead just work without the
ControlPort.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/20468>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs