Re: A suggestion to TOR [a proxy server]

[Gregory Maxwell <gmaxwell@xxxxxxxxx>]

On Sun, Jul 25, 2010 at 7:33 PM, Kory Kirk <kory.kirk@xxxxxxxxx> wrote:
> I think this can be achieved with a Java applet. So maybe when JTor is
> finished. A relay could host a web server, and have the Java applet on it.
> The applet would need to be signed, and could be further verified by a
> checksum, which could be done automatically by Torbutton. The server would
> act as the entry point for all of your circuits.ÂSince the JVM is running on
> your machine, the entry point would not see the destination. Imagine if
> there was a list of relays implementing this method, and you could possibly
> choose one by location.
>
> Seth David Schoen writes:
>> The Tor developers don't think that would achieve the "same
>> objective" as Tor, because the proxy server would be in a
>> position to know both where you are coming from and what you
>> are doing.
> I think this would be solved because data going from the client to the proxy
> server would be the same as normal traffic between client and entry node.
> Although it would probably bring up all sorts of adversarial issues. I am
> interested if anyone sees a major flaw in this design.
> -koryk


(1) If the user can't install the regular tor package that means that
someone else has enough control over his system that he can't trust
any validation on his system. Short of abusing the treacherous
computing for good, there is no real way to have confidence in any
validation system running on an untrusted machine.

More practically important,

(2) If the user can install the torbutton software he either could
install tor directly or a version of torbutton can be shipped
_including_ tor itself.

and

(3) If the server in question provides the torbutton it could easily
provide a modified copy of it. So this doesn't eliminate the
bootstrapping problem.
***********************************************************************
To unsubscribe, send an e-mail to majordomo@xxxxxxxxxxxxxx with
unsubscribe or-talk    in the body. http://archives.seul.org/or/talk/