[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #30941 [Circumvention/BridgeDB]: Need better instructions for requesting bridges via email
#30941: Need better instructions for requesting bridges via email
-------------------------------------------------+-------------------------
Reporter: pili | Owner: sysrqb
Type: defect | Status:
| needs_review
Priority: Medium | Milestone:
Component: Circumvention/BridgeDB | Version:
Severity: Normal | Resolution:
Keywords: ux-team, s30-o22a2, anti- | Actual Points:
censorship-roadmap-2020Q1 |
Parent ID: #31279 | Points:
Reviewer: | Sponsor:
| Sponsor30
-------------------------------------------------+-------------------------
Comment (by phw):
Replying to [comment:9 teor]:
> > I suggest that BridgeDB should respond with obfs4 bridges even if the
email request is invalid
>
> Careful with responding to invalid input: it can enable some kinds of
attacks.
>
> I can't think of any attacks that are easier than "just send another,
correctly-formatted email". But there can sometimes be risks with email
forwarding, or mailing lists.
[[br]]
BridgeDB already is responding to invalid emails with help instructions. I
think the benefits of this behaviour (it helps confused users) outweighs
the harm you mentioned – at least so far.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/30941#comment:14>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs