[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #6978 [Website]: Create Magnet links for download
#6978: Create Magnet links for download
-------------------------+--------------------------------------------------
Reporter: ioerror | Owner:
Type: enhancement | Status: new
Priority: normal | Milestone:
Component: Website | Version:
Keywords: | Parent:
Points: | Actualpoints:
-------------------------+--------------------------------------------------
Changes (by proper):
* cc: adrelanos@â (added)
Comment:
> Do BitTorrent clients actually download it over HTTPS properly?
I made a quick test to answer that question with
[http://packages.debian.org/wheezy/transmission transmission] (and
apache2, default-ssl, ssl snakeoil, tested https://127.0.0.1/testfile in
browser and got an invalid certificate as expected). Then used "mktorrent
--announce=http://announce.torrentsmd.com:6969/announce -w
https://127.0.0.1/testfile ~/testfile".
Result: It downloaded from HTTPS, but the invalid ssl certificate was
ignored.
Is this a problem?
To my knowledge, Bittorrent clients do hash verification, they still and
only use SHA-1. If SHA-1 is still considered safe enough is another topic.
And if Bittorrent clients do hash verification well or can be tricked,
would probable be a fine topic for research.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/6978#comment:13>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs