[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #7454 [EFF-HTTPS Everywhere]: Active rules list doesn't indicate effects of securecookie if no URL rewrite took place
#7454: Active rules list doesn't indicate effects of securecookie if no URL
rewrite took place
----------------------------------+-----------------------------------------
Reporter: schoen | Owner: pde
Type: defect | Status: accepted
Priority: normal | Milestone:
Component: EFF-HTTPS Everywhere | Version:
Keywords: | Parent:
Points: | Actualpoints:
----------------------------------+-----------------------------------------
Changes (by pde):
* status: new => accepted
Comment:
The code that implements the <securecookie> element
[https://gitweb.torproject.org/https-
everywhere.git/blob/HEAD:/src/chrome/content/code/HTTPSRules.js#l546 does
try to display this fact] in the context menu. The problem is that it
only happens when the cookie is first secured. There may be no later
indication that a cookie in the page was secured by HTTPS Everywhere if
HTTPS Everywhere has nothing else to change in that page, and there may be
no indication that a cookie is ''missing'' from an HTTP page because a
past securecookie intervention. I think these are probably fixable,
though it will be tricky work.
It is also the case that disabling a ruleset won't go and ''remove'' the
securecookie flag from all of the cookies it was set on, since that
operation itself could cause potentially cause insecurity. Although
perhaps it's the lesser of two evils...
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/7454#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs