[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #5761 [TorBrowserButton]: Decide if it's safe to pass the Dooble around the Tor Community
#5761: Decide if it's safe to pass the Dooble around the Tor Community
---------------------------------+------------------------------------------
Reporter: mike123 | Owner: mike123
Type: enhancement | Status: closed
Priority: normal | Milestone:
Component: TorBrowserButton | Version:
Resolution: invalid | Keywords:
Parent: | Points:
Actualpoints: |
---------------------------------+------------------------------------------
Comment(by rransom):
Replying to [comment:34 textbrowser]:
> Replaced cookies.db. The database now houses encoded values of raw
forms. One field.
Good. That prevents a whole class of attacks.
> Researching the suggestion pertaining to the use of hashes of
passphrases as cipher keys.
See the documentation for `gcry_kdf_derive` for the recommended standard
way to convert a passphrase into a key.
> The important conclusion is that "Doobie" isn't a bogus project. We're
still evolving, learning, twisting.
Thanks for fixing those issues. I thought you weren't interested in
fixing them.
Also, you probably need to remove the IV from the beginning of a
ciphertext buffer before decrypting it.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/5761#comment:35>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs