[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-talk] Hiden service and session integrity
I am new to TORÂ and I investigate the possibility of gidden services and i
can not find an answer in the docs.
web application "foo" use a classical session to maitain state of the user.
Classically user BAR haveÂ IP address and cookie is assigned in the login
process. If the right cookie from the right ip address comes for user BAR,
server accepts future request
But how it can work thru TOR ? what about scenario that an attacker
determine my exit point and somehow stole my authentication cookie and then
he can use .exit pseudodomain to route his traffic thru the same exit pointÂ
(ie gain same ip address as a legitimate client ) ?
And is it possible (and how ? ) to run end to end encrypted (ssl) web
traffic via tor network ?
Thanx for explanation.
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to