Thus spake Greg Kalitnikoff (kalitnikoff@xxxxxxxxxxxxxxxx): > Andrew Lewman <andrew@xxxxxxxxxxxxxx> wrote: > > Moxie is a smart guy, his answer to the CA issues, and therefore his own > > sslsniff/sslstrip attack is currently http://convergence.io/. I think Moxie's > > on the list, he can reply as well. > > Do you consider including Convergence (or similar extension - > Perspectives http://www.networknotary.org/firefox.html) to official > TorBrowser? I think the idea of distributed notaries is something that > ssl security would evolve to. Yes. We haven't included Perspectives and related pre-Convergence addons because the Firefox APIs are not sophisticated enough to notify the user of SSL MITM before your browser sent authentication data. They expect to improve them soon, but confusion still remains: https://bugzilla.mozilla.org/show_bug.cgi?id=644640 IIRC, Moxie's Convergence bypasses the API problem by creating a synthetic proxy that MITMs you and re-signs your HTTPS certificates as either "good" or "bad" internally (after notary verification) to prevent the authentication transmission. It also makes use of OpenSSL functions for certificate inspection through js-ctypes, which adds a little more complexity into the mix. While functional, this approach needs to be reviewed and digested a bit by the security community before we jump right on board and toss it in. It will also require some testing and auditing to ensure it properly behaves with Tor's proxy in all cases. We don't have to do this testing ourselves (indeed, it is not high priority right now - we don't even have a trac ticket for it), but we'd like an external audit to be well documented and thorough if we were to rely on it. The audit should also be done with Tor Browser Bundle. AFAIK, Tor Browser Bundle users should be able to install his XPI and use it now, but beware that doing so will reduce your anonymity set to exit node observers (due to the presumably low adoption rate of Convergence today). -- Mike Perry Mad Computer Scientist fscked.org evil labs
Attachment:
pgpsuZ2w11c2e.pgp
Description: PGP signature
_______________________________________________ tor-talk mailing list tor-talk@xxxxxxxxxxxxxxxxxxxx https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk