[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-bugs] #30499 [Metrics/Relay Search]: In Tor Metrics / Relay Search, users are able to enter the digital fingerprint of a bridge to run a successful search and display the data about that bridge, but the Relay Search page states, "If you are searching for a bridge, you will need to search by the hashed fingerprint. This prevents leaking the fingerprint of the bridge when searching."

To: undisclosed-recipients: ;
Subject: Re: [tor-bugs] #30499 [Metrics/Relay Search]: In Tor Metrics / Relay Search, users are able to enter the digital fingerprint of a bridge to run a successful search and display the data about that bridge, but the Relay Search page states, "If you are searching for a bridge, you will need to search by the hashed fingerprint. This prevents leaking the fingerprint of the bridge when searching."
From: "Tor Bug Tracker & Wiki" <blackhole@xxxxxxxxxxxxxx>
Date: Wed, 05 Jun 2019 12:22:55 -0000
Auto-submitted: auto-generated
Delivered-to: archiver@xxxxxxxx
Delivery-date: Wed, 05 Jun 2019 08:23:05 -0400
In-reply-to: <047.c4e1ed5acaa92c821261ad82f13bb422@torproject.org>
List-archive: <http://lists.torproject.org/pipermail/tor-bugs/>
List-help: <mailto:tor-bugs-request@lists.torproject.org?subject=help>
List-id: "auto: Tor bug tracker status mails" <tor-bugs.lists.torproject.org>
List-post: <mailto:tor-bugs@lists.torproject.org>
List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs>, <mailto:tor-bugs-request@lists.torproject.org?subject=subscribe>
List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-bugs>, <mailto:tor-bugs-request@lists.torproject.org?subject=unsubscribe>
References: <047.c4e1ed5acaa92c821261ad82f13bb422@torproject.org>
Reply-to: no-reply@xxxxxxxxxxxxxx, tor-assistants@xxxxxxxxxxxxxx
Sender: "tor-bugs" <tor-bugs-bounces@xxxxxxxxxxxxxxxxxxxx>

#30499: In Tor Metrics / Relay Search, users are able to enter the digital
fingerprint of a bridge to run a successful search and display the data
about that bridge, but the Relay Search page states, "If you are searching
for a bridge, you will need to search by the hashed fingerprint. This
prevents leaking the fingerprint of the bridge when searching."
----------------------------------+------------------------------
 Reporter:  monmire               |          Owner:  metrics-team
     Type:  defect                |         Status:  closed
 Priority:  Medium                |      Milestone:
Component:  Metrics/Relay Search  |        Version:
 Severity:  Normal                |     Resolution:  not a bug
 Keywords:                        |  Actual Points:
Parent ID:                        |         Points:
 Reviewer:                        |        Sponsor:
----------------------------------+------------------------------
Changes (by irl):

 * keywords:  Relay-Search-accepts-bridge-digital-signature issue =>
 * priority:  High => Medium
 * status:  new => closed
 * resolution:   => not a bug


Comment:

 If a user is going to type in a non-hashed bridge fingerprint, or any
 other secret, then there's not much we can do to stop them.

 Relay Search actually does hash fingerprints before looking them up, so
 even searching for a non-hashed fingerprint doesn't actually send that
 fingerprint to the server.

 Regarding the torrc thing, perhaps we can add comments to the file with
 the relay search links. This wouldn't be a problem with relay search
 though.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/30499#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online

_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs