[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #4303 [Company]: Tor controllers should check the length of authentication-cookie files
#4303: Tor controllers should check the length of authentication-cookie files
---------------------+------------------------------------------------------
Reporter: rransom | Owner: phobos
Type: defect | Status: new
Priority: major | Milestone:
Component: Company | Version:
Keywords: | Parent:
Points: | Actualpoints:
---------------------+------------------------------------------------------
Changes (by karsten):
* type: project => defect
Old description:
> Right now, our Tor controllers will send any file readable by the user to
> whatever is listening to the control port they try to connect to (usually
> 127.0.0.1:9051). This sucks. They should only send any file that is
> exactly 32 bytes long and readable by the user to whatever is listening
> on that port. (Hopefully no one stores AES-256, Salsa20, or Curve25519
> secret keys (or other actually sensitive pieces of data) in raw 32-byte
> binary files.)
>
> Marking this as a âtaskâ, not a âdefectâ, so it'll get a child ticket
> list.
New description:
Right now, our Tor controllers will send any file readable by the user to
whatever is listening to the control port they try to connect to (usually
127.0.0.1:9051). This sucks. They should only send any file that is
exactly 32 bytes long and readable by the user to whatever is listening on
that port. (Hopefully no one stores AES-256, Salsa20, or Curve25519
secret keys (or other actually sensitive pieces of data) in raw 32-byte
binary files.)
[[TicketQuery(parent=#4303,format=table,col=summary|owner)]]
--
Comment:
Changed ticket type to defect and added child ticket list to the
description.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/4303#comment:3>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs