Re: [tor-bugs] #9931 [Website]: Securing the integrity of downloads from the Tor/Tails website

["Tor Bug Tracker & Wiki" <blackhole@xxxxxxxxxxxxxx>]

#9931: Securing the integrity of downloads from the Tor/Tails website
-------------------------+-------------------------------------------------
     Reporter:  tolodof  |      Owner:
         Type:  defect   |     Status:  closed
     Priority:  major    |  Milestone:
    Component:  Website  |    Version:  Tor: unspecified
   Resolution:  fixed    |   Keywords:  SSL, MITM, Verifying, Download,
Actual Points:           |  Website
       Points:           |  Parent ID:
-------------------------+-------------------------------------------------
Changes (by cypherpunks):

 * status:  new => closed
 * resolution:   => fixed


Comment:

 @tolodof

 Kindly review
 https://www.ssllabs.com/ssltest/analyze.html?d=torproject.org

 You'll notice that the Tor Project's EXCELLENT cryptography implementation
 is more secure than just about any other software updating/downloading
 channel you'll find on the internet, with support for TLS 1.2 and forward
 secrecy in many browsers. Yes, there are a few small changes that could be
 made, but most if not all would break functionality/compatibility for some
 users.

 Contrast that with update and add-on checking functionality you mentioned
 in Firefox, which still isn't configured to allow TLS 1.2 by default and
 which the relevant Mozilla servers can't even support anyway:
 https://browserprivacy.wordpress.com/2013/11/19/requiring-better-
 cryptography-in-firefox-and-thunderbird-breaks-update-functionality/

 Perhaps something like NSA's Quantum Insertion or a few lesser-known MITM
 attacks are still theoretically possible, but the bottom line is that
 downloading a signed copy of Tor from The Tor Project's server can be
 considerably more secure--if you use the right tools, practices, etc.--
 than Firefox.

 If you're still not convinced, download the data through another network
 (e.g. Tor) with a different computer and network configuration and then
 compare the binaries and signatures. I'm willing to bet they'll be
 identical in your case.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/9931#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs