[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-bugs] #23771 [Internal Services/Service - trac]: Certain Trac accounts are vulnerable to social engineering hologram impersonation
#23771: Certain Trac accounts are vulnerable to social engineering hologram
impersonation
--------------------------------------------------+-----------------
Reporter: arthuredeIstein | Owner: qbi
Type: defect | Status: new
Priority: Very High | Milestone:
Component: Internal Services/Service - trac | Version:
Severity: Critical | Keywords:
Actual Points: | Parent ID:
Points: | Reviewer:
Sponsor: |
--------------------------------------------------+-----------------
Certain accounts are vulnerable to social engineering hologram
impersonation
=====
The way this works is since it's hard to distinguish between lower case
"L" (l) and upper case "I" (I) in the font used for usernames, then one
can make accounts on trac that impersonate other legitimate accounts by
using upper case "I", such as the account that I use right now to report
this issue.
There are two possible solutions for this:
1. Change the font used for usernames on Trac with one in which lower case
"L" (l) and upper case "I" (I) are visually distinguishable with our
normal human eyes.
2. Make alternate accounts for all core Tor people that substitute lower
case "L" (l) with upper case "I" (I) (or permutations of them if they more
than a single lower case "L"), and then change the hashed passwords in the
database with something else.
I'd like that option 2 is at least made for the present account.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/23771>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs