[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #4100 [Firefox Patch Issues]: Isolate SPDY and HTTP Keep-Alive to top-level domain (was: Isolate TLS Session IDs and HTTP Keep-Alive to top-level domain)
#4100: Isolate SPDY and HTTP Keep-Alive to top-level domain
----------------------------------+-----------------------------------------
Reporter: mikeperry | Owner: mikeperry
Type: enhancement | Status: new
Priority: major | Milestone: TorBrowserBundle 2.3.x-stable
Component: Firefox Patch Issues | Version:
Keywords: tbb-linkability | Parent:
Points: | Actualpoints:
----------------------------------+-----------------------------------------
Changes (by mikeperry):
* priority: normal => major
Old description:
> We need to prevent 3rd party domains from being able to correlate
> activity using either TLS Session IDs or HTTP Keep-Alive.
>
> In #4099, we plan to simply disable TLS session resumption and HTTP keep-
> alive. Long term, we should try to find a way to preserve these features
> by preventing them from applying to third parties from different top-
> level domains.
New description:
We need to prevent 3rd party domains from being able to correlate activity
using HTTP Keep-Alive connections. We limited this linkability in #4603,
but we should solve it entirely, if we can.
--
Comment:
The NSS code is so decoupled from the rest of Firefox that I think
expecting to re-enable TLS Session IDs after binding them to top-level
domain is out of the question. Let's just make this ticket focus on
binding HTTP Keepalive and SPDY to top-level domains.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/4100#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs