[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-bugs] #4303 [Company]: Tor controllers should check the length of authentication-cookie files
#4303: Tor controllers should check the length of authentication-cookie files
---------------------+------------------------------------------------------
Reporter: rransom | Owner: phobos
Type: task | Status: new
Priority: major | Milestone:
Component: Company | Version:
Keywords: | Parent:
Points: | Actualpoints:
---------------------+------------------------------------------------------
Right now, our Tor controllers will send any file readable by the user to
whatever is listening to the control port they try to connect to (usually
127.0.0.1:9051). This sucks. They should only send any file that is
exactly 32 bytes long and readable by the user to whatever is listening on
that port. (Hopefully no one stores AES-256, Salsa20, or Curve25519
secret keys (or other actually sensitive pieces of data) in raw 32-byte
binary files.)
Marking this as a âtaskâ, not a âdefectâ, so it'll get a child ticket
list.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/4303>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs