[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #5011 [Pluggable transport]: Discuss possible designs for an external program that discovers bridge addresses to tell Tor about them
#5011: Discuss possible designs for an external program that discovers bridge
addresses to tell Tor about them
---------------------------------+------------------------------------------
Reporter: karsten | Owner: mikeperry
Type: task | Status: new
Priority: normal | Milestone:
Component: Pluggable transport | Version:
Keywords: MikePerry201203 | Parent: #5010
Points: | Actualpoints:
---------------------------------+------------------------------------------
Comment(by mikeperry):
Replying to [comment:13 nickm]:
> So as a first step, make the data format reject partially-bogus
messages, or messages with junk at the start. That'll make some standard
cross-protocol attacks harder.
>
> Second, once the BridgeFinder and whoever needs to use it share a
secret, they can authenticate pretty easily; possibly with a simple HMAC
challenge-response system. (That'd be ideal; see discussions on #5185).
So the only hard part is making sure they share a secret.
>
> How were you planning for the Chrome extension or the Warcraft plugin or
whatever to learn the port of the bridgefinder ? Presumably they could
learn the shared secret via the same channel. Finding an appropriate
channel for esoterically sandboxed stuff is likely to require specific
work depending on the details of the sandbox; I don't know enough about
Chrome plugins to know what mechanism would work.
I was hoping we could get away with fixed port. I think any sort of
configuration is going to make people sad and confused, unless they're
walked through the pairing process to generate a secret and give it to
both Vidalia/Orbot and their plugin of the week. But how does that happen
on a phone?
Can we skip the shared secret authentication step in initial
imlementations, or is it must-have even if we require that "IPC 1" has a
proper handshake, well-formed-or-die behavior, and triggers user
confirmation from Vidalia?
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/5011#comment:15>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs