[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-bugs] #9767 [Tor]: Implement proposal 222: Eliminate client timestamps in Tor

#9767: Implement proposal 222: Eliminate client timestamps in Tor
-------------------------+-------------------------------------------------
     Reporter:  nickm    |      Owner:
         Type:  defect   |     Status:  needs_review
     Priority:  major    |  Milestone:  Tor: 0.2.4.x-final
    Component:  Tor      |    Version:
   Resolution:           |   Keywords:  tor-client fingerprinting time
Actual Points:           |  prop222
       Points:           |  Parent ID:
-------------------------+-------------------------------------------------

Comment (by andrea):

 Further thought on TLS/SSL timestamps: if NSA can MITM the connection and
 forge a server certificate with an expiration date of their choice, and
 the client strictly tests the expiration date against the local clock,
 then whether the client continues the handshake also leaks information
 about clock skew.  The client is probably fucked regardless in that case,
 but in the NAT/mobile client scenario under discussion it is a capability
 beyond just what the MITM alone would give them.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/9767#comment:7>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs