[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
A warning to proxy writers
- To: or-talk@xxxxxxxxxxxxx
- Subject: A warning to proxy writers
- From: Adam Langley <alangley@xxxxxxxxx>
- Date: Tue, 19 Apr 2005 10:25:36 +0100
- Delivered-to: archiver@seul.org
- Delivered-to: or-talk-outgoing@seul.org
- Delivered-to: or-talk@seul.org
- Delivery-date: Tue, 19 Apr 2005 05:32:59 -0400
- Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:reply-to:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=NnQXswAr1Mkief91VGMGffup9mgP45YdHWKqXY8ZWYqHjG0O2cDzBMNRCyEsrF+IIJOy/4BdqPSK0JaYbiaEw/u1sWV07WMKU1cu7ySrEZUJEgQjXOL6uniqmEnvEFnQ0CsS/v5I9Sxk0D5jquM77gEeBZk19uoIFp8dFzIjTQU=
- Reply-to: or-talk@xxxxxxxxxxxxx
- Sender: owner-or-talk@xxxxxxxxxxxxx
Writing a Tor HTTP proxy is probably a lot harder than you think, for
lots of reasons.
You would scrub the User-Agent and Referer headers, of course, because
they divide the anonymity set. Yet all that information (and more) is
still around:
http://www.imperialviolet.org/browser-information.html
and it can be returned to the server via XMLHTTPRequest.
Next, any embeds in the HTML can trigger plugins which have their own
proxy settings. Realmedia objects will almost certainly start a
connection to the given server, Flash I don't know about, but I would
guess so. Flash objects can also be used to store cookies which aren't
handled via Cookie headers nor the browser.
If the user doesn't have every protocol proxyied then an image link to
https:// or ftp:// etc could cause a non-Tor connection.
Even PDFs can have embedded Javascript which can causes Acrobat to
make a connection.
You can generally craft malformed HTML or CSS which will only cause
certain browsers/versions of browsers to fetch an image.
It's a really hard problem. The Freenet proxy was very aggressive, but
the advantage was that Freenet websites were designed to work with it
(so, no Javascript etc). The general web, however, isn't designed to
work with Tor.
AGL
--
Adam Langley agl@xxxxxxxxxxxxxxxxxx
http://www.imperialviolet.org (+44) (0)7906 332512
PGP: 9113 256A CC0F 71A6 4C84 5087 CDA5 52DF 2CB6 3D60