[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-bugs] #3455 [Firefox Patch Issues]: Tor Browser should set SOCKS username for a request based on referer

#3455: Tor Browser should set SOCKS username for a request based on referer
----------------------------------+-----------------------------------------
 Reporter:  mikeperry             |          Owner:  mikeperry                    
     Type:  enhancement           |         Status:  new                          
 Priority:  major                 |      Milestone:  TorBrowserBundle 2.3.x-stable
Component:  Firefox Patch Issues  |        Version:                               
 Keywords:  tbb-linkability       |         Parent:  #5752                        
   Points:                        |   Actualpoints:                               
----------------------------------+-----------------------------------------
Description changed by mikeperry:

Old description:

> Once Proposal 171 is implemented (#1865), Tor Browser should set the
> Proposal 171 SOCKS username to a function of the hostname in the referer
> header (possibly caching the first referer for subsequent link
> navigation). If the referer is blank, we should use the request URL
> hostname. This policy should effectively give us the same top-level
> origin isolation for circuit use that we want for other identifiers.

New description:

 Once Proposal 171 is implemented (#1865), Tor Browser should set the
 Proposal 171 SOCKS username to a function of the hostname in the referer
 header (possibly caching the first referer for subsequent link
 navigation).

 If the referer is blank, we should use a function of the request URL
 hostname. This policy should effectively give us the same top-level origin
 isolation for circuit use that we want for other identifiers.

 Lunar also points out that if this function introduces a hashed nonce that
 is changed on "New Identity" invocations, we can then do without the
 control port and control auth/password inside torbutton but still provide
 New Identity. This would simplify a lot of setups, and potentially allow
 us to remove more code from Torbutton.

--

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/3455#comment:19>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs