[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: Firefox and Tor? Forget about it!!
- To: or-talk@xxxxxxxxxxxxx
- Subject: Re: Firefox and Tor? Forget about it!!
- From: grarpamp <grarpamp@xxxxxxxxx>
- Date: Mon, 21 Dec 2009 04:11:15 -0500
- Delivered-to: archiver@xxxxxxxx
- Delivered-to: or-talk-outgoing@xxxxxxxx
- Delivered-to: or-talk@xxxxxxxx
- Delivery-date: Mon, 21 Dec 2009 04:11:19 -0500
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :date:message-id:subject:from:to:content-type; bh=7HP2WH+csMagCAqf0Ri0sSTaAPm2DGx2uiVNX2rXbzg=; b=ReX5u+sD+iw+X8sHKwuUdcwFQ9fL2j8tx9EftrNBkkjt2Ex7xLRLesOOvka7r7c6Rr Vzf+HyIWMwq4mMt5LzXQ0ipLoMskPWl50YsanEu8XLmC+gV439XarNYQidZz7QGHGPfn xijY+6bL3OWk3IUeM86mbMQuBQT+yRatS1N+g=
- Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; b=Wi0w9R8cH6vI7q3X/C6uNTJvBQ7WW6Ws5HguWJkzhtRzBvoaZifZfj7AeCryl32bZb QKe3b7RkruconbEdnrfSUOwsFIocHoqrPHrO3Oh9k7lhVgtsmtuywzO+steBdioqnk12 lgLnc+0pyuokSk1Bs4oL/KgsYxnX0aKwQyHlU=
- In-reply-to: <N1B-3lCvM7vO2W@xxxxxxxxxxxxx>
- References: <N1B-3lCvM7vO2W@xxxxxxxxxxxxx>
- Reply-to: or-talk@xxxxxxxxxxxxx
- Sender: owner-or-talk@xxxxxxxxxxxxx
> http://secunia.com/advisories/37699/
All fixed in FF 3.5.6.
> I want something less bloated like Dillo:
I won't suggest anything. But there should be a browser that is
well developed/maintained and usable by the populous
that puts security first. Now 'populous' may prevent that but
surely finance/health/etc corporations might want a more
secure browser for internal deployment. OpenBSD and even
FreeBSD have fit that niche and balance fairly well.
> a bootable Live CD with focus on privacy related software.
Sandboxing and well configured setups are always a good thing.
Tor's sole purpose is to prevent the real source of TCP packets
from being discovered. And to provide similarly hidden services.
Everything you are able to put through Tor is 'safe' in respect
to the purpose of Tor. Outside of what Tor offers, it is up to the
user to figure out and know how to manage their own security practices.
> Firefox's issues with tor usage and how many soft spots could
> be considered possible or future vectors
All apps have and will have flaws. If you don't trust FF/them to:
- Punt everything through Tor... sandbox them.
- Resist attacks that would give access to your system... don't put
sensitive stuff on that system.
- Resist attacks that would disclose browser state, steal sessions,
etc... use single purpose sessions.
Layer your security so you don't have that problem. If you can't run
FF with java/js/flash/images all enabled and feel safe about it,
you're not doing it right.
> whether or not this is a proper direction to go on or if Dillo's audience
> is limited and doesn't receive enough testing to warrant switching to Dillo.
FF is the current defacto mass market browser, outside of IE and Mac.
Tor is best served by focusing on enhancements/bundles for that.
You've managed to put together a workable bundle. Put it
out there and see what happens. Who knows :)
***********************************************************************
To unsubscribe, send an e-mail to majordomo@xxxxxxxxxxxxxx with
unsubscribe or-talk in the body. http://archives.seul.org/or/talk/