Thus spake Matthew (pumpkin@xxxxxxxxx): > When you are go into for example Yahoo webmail (without Tor) and > download an attachment (say a Word document or a photo) then your > browser asks you where on your hard drive you wish to save that > attachment. > > Then do the same thing using Tor (and Polipo). > > I assume the attachment downloads from Yahoo Mail (or whatever) through > the three Tor nodes before being unencrypted at the final node and then > is downloaded to my computer. In other words: the attachment (or for > that matter any file downloaded in the same way) is never downloaded > "outside" the Tor system - that is directly from the website to me > bypassing the Tor nodes? Yes, if you use Torbutton, the attachment itself will be downloaded only via Tor. If you do not use Torbutton, your browser may autolaunch a plugin or helper application to download the attachment and display it, which may *not* happen via Tor. See https://www.torproject.org/torbutton/design/#SingleStateTesting for example exploits against non-Torbutton users. Also, when you open your attachment after downloading it (either via Tor or not), the program that opens it may be induced into making a network connection outside of Tor. For example, .doc files, .pdf files, .torrent files, and many many others can reference images, urls, IP addresses, and other content from the Internet, which causes the application that opened them to connect to a server outside of Tor. This is especially dangerous if you are using Yahoo Mail, because even if you trust the person who sent you the document, your attachment will be downloaded in plaintext (via http, not https). This means that the exit node you use can replace or alter your document to unmask you (or worse, exploit your document reader and run arbitrary code). If you need to view these documents in a safe way, your best bet is to use VirtualBox or some other virtualization software to run a VM that you can disconnect from the network while you view the file, and roll back to a safe snapshot after you have viewed the file. Torbutton has a warning to attempt to explain all of this when you download documents handled by external applications, but it is a lot to get across in such a small amount of space. -- Mike Perry Mad Computer Scientist fscked.org evil labs
Attachment:
pgps5gVXU5tBn.pgp
Description: PGP signature