Re: [tor-relays] About TBB downloadings

[Naja Melan <najamelan@xxxxxxxxxxxxx>]

> By the way, applies the same to the already downloaded pdf docs ?

yes.

It applies to everything you download and feed to an application which 
has internet access and which might connect to the internet based on 
information within the file or the filename for that matter.

For a more complete security analysis I think about it like this:

- If I download a document not over https correctly certified: the 
server, the last tor node and any routers between that last tor node 
and the server can inject something in the document
- If I download a document from a server with correct https: the server 
(potentially hacked) could try to identify me, on top of any 
reservations you might have about https

By all means, that's a lot of leaks if you are concerned about your 
security, so it is strongly adviced to open documents in Tails or in a 
VM that has no internet access. On top of that, it could be difficult 
to verify documents and clean them if you want to store them for later 
use and distribution, so in that case use a clean tor connection not 
related to other sensitive internet traffic.

If you use tor for your everyday browsing as an extra privacy measure, 
than downloading a random scientific paper and opening it will probably 
be low risk. Just keep in mind that the last tor node is an extra MITM 
that makes tor under quite a few circumstances less secure than direct 
internet connection (since anyone can run one). So if your evince has a 
buffer overflow bug for example, that's an extra person who could try 
to exploit it (again unless you use valid https) and this sort of 
exploit works on any document, regardless of whether the contents are 
sensitive or not.

It's up to you to figure out your security needs.

Naja Melan
_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays