[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-bugs] #32973 [Applications/Tor Browser]: Display real/starting IP address in the Tor Circuit information

#32973: Display real/starting IP address in the Tor Circuit information
------------------------------------------+--------------------------------
 Reporter:  PROTechThor                   |          Owner:  tbb-team
     Type:  enhancement                   |         Status:
                                          |  needs_information
 Priority:  Low                           |      Milestone:
Component:  Applications/Tor Browser      |        Version:
 Severity:  Minor                         |     Resolution:
 Keywords:  ux-team, tbb-circuit-display  |  Actual Points:
Parent ID:                                |         Points:
 Reviewer:                                |        Sponsor:
------------------------------------------+--------------------------------
Changes (by sysrqb):

 * status:  new => needs_information


Comment:

 This is an interesting idea. Initially, my main concern is that in this
 case the browser holds the user's external IP address in memory which is
 something it does not do currently. Of course there is the argument that
 if the parent process is exploited such that an attacker gains access to
 the memory holding the IP address, then the user is pretty screwed anyway.
 But, do we want to increase the amount of information available in that
 case? With that being said, I definitely understand the usability benefit.

 In any case, if we do this, we wouldn't touch (or have access to) the
 information communicated between the tor client and the Guard, the browser
 would just ask the client for that info: `GETINFO address`. We can think
 about adding a button ("show your IP address") which queries tor for the
 address, but the browser doesn't save the address after the user closes
 the circuit display. (I'll ignore the problem with securely wiping memory
 right now).

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/32973#comment:3>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online

_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs