[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #6546 [Tor]: Replace check.tp.o with internal mapaddress + JSON/XML object
#6546: Replace check.tp.o with internal mapaddress + JSON/XML object
--------------------------------------------------------------------------------+
Reporter: ioerror | Owner:
Type: enhancement | Status: new
Priority: normal | Milestone: Tor: 0.2.4.x-final
Component: Tor | Version:
Keywords: proposal-needed tbb-usability MikePerry201210d tor-client SponsorJ | Parent:
Points: | Actualpoints:
--------------------------------------------------------------------------------+
Comment(by mikeperry):
Bleh. This article makes me think we can't safely include any
cookies/nonces in the JSON output:
http://www.hpenterprisesecurity.com/vulncat/en/vulncat/dotnet/javascript_hijacking_vulnerable_framework.html.
Therefore, XML seems to actually be a safer option than JSON for this
reason, but we'd still need to be sure you can't access .text or
.innerHTML of the content to manually read out the cookie for tracking
purposes. Being sure here is tricky, as script tags aren't the only tags
that can be cross-origin...
Also, if exits were to DNS rebind to the local 127.x.x.x IP address, they
could read out any cookies we use there, too, even in XML.. Tor would need
to properly parse Host: headers, at minimum, before handing out cookies,
and/or it would need to make such cookies very short-lived...
I'll see if I can capture all of this in the proposal, but this is going
to be a lot trickier than we'd hoped if we want to ensure we don't open up
holes for tracking users...
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/6546#comment:16>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs