[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-bugs] #13766 [Tor Browser]: Raise MaxCircuitDirtiness for Tor Browser (to Infinite)?

#13766: Raise MaxCircuitDirtiness for Tor Browser (to Infinite)?
-------------------------+-------------------------------------------------
     Reporter:           |      Owner:  tbb-team
  mikeperry              |     Status:  new
         Type:  defect   |  Milestone:
     Priority:  normal   |    Version:
    Component:  Tor      |   Keywords:  tbb-usability, TorBrowserTeam201501
  Browser                |  Parent ID:
   Resolution:           |
Actual Points:           |
       Points:           |
-------------------------+-------------------------------------------------

Comment (by mikeperry):

 Replying to [comment:6 mikeperry]:
 > The updater is another thing that may be affected by this. We probably
 want to ensure we are sending a unique, new nonce as the SOCKS password
 field for updater requests (both to
 https://www.torproject.org/projects/torbrowser/RecommendedTBBVersions and
 to the update manifests at
 https://dist.torproject.org/torbrowser/update_2/).

 At the same time, we want to avoid guard discovery attacks here (see
 https://trac.torproject.org/projects/tor/ticket/7870#comment:18). This
 means we want to not give content elements on random websites the ability
 to generate a ton of script tags with the src set to
 https://www.torproject.org/projects/torbrowser/RecommendedTBBVersions, for
 example.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/13766#comment:7>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs