[tor-talk] Hiden service and session integrity

[NTPT <NTPT@xxxxxxxxx>]

Hi all

I am new to TORÂ and I investigate the possibility of gidden services and i 
can not find an answer in the docs.

web application "foo" use a classical session to maitain state of the user. 
Classically user BAR have IP address and cookie is assigned in the login 
process. If the right cookie from the right ip address comes for user BAR, 
server accepts future request

But how it can work thru TOR ? what about scenario that an attacker 
determine my exit point and somehow stole my authentication cookie and then 
he can use .exit pseudodomain to route his traffic thru the same exit pointÂ
 (ie gain same ip address as a legitimate client ) ? 


And is it possible (and how ? ) to run end to end encrypted (ssl) web 
traffic via tor network ?


Thanx for explanation.
ÂÂ 
-- 
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk