Re: Defeat Exit Node Sniffing?

[scar <scar@xxxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Chris Palmer @ 2008/03/02 14:15:
| defcon writes:
|
|> I have been using tor for a while now, and I absolutely love it, although
|> the only thing keeping me from using it, is the insecurities of the exit
|> nodes.  I know to truly stay anonymous you should stay away from personal
|> accounts "but" how can I connect through tor to gmail or other ssl
enabled
|> services without risking my password being sniffed or my dns request
being
|> hijacked.  Any advice would be greatly appreciated!
|
| The answer is to use SSL. I'm not sure but I think you meant to say
"... or
| other *non*-ssl enabled serviecs...".
|
| In the particular case of Gmail: Gmail normally uses HTTPS for the login
| phase but not thereafter. That is of course totally silly, because
while the
| attacker won't see your password they will still see your Gmail session
| cookies. That's all they need to hijack your Gmail session -- they don't
| need your password. BUT! the good news is that if you go to Gmail via
| https://mail.google.com/, Gmail will use HTTPS for the entire session, not
| just the login phase, and then you are as safe as anyone ever can be from
| network eavesdroppers (including traffic-sniffing Tor operators).
|

sorry, but that's not entirely true.  if you watch your tor circuits,
gmail will jump to one insecure connection on port 80 to do "something"
during the login phase, and then go back https, even if you use
https://mail.google.com/.  this has been discussed to death, please
search the archives.

the best solution is to stop using gmail, since they probably keep your
email forever.  next-best solution is to use a 3rd-party email program
and configure it to use TLS or SSL for your pop.gmail.com and
smtp.gmail.com connections.
-----BEGIN PGP SIGNATURE-----

iD8DBQFHyztAXhfCJNu98qARCPgTAJ9IcmnkJSyq50tH6m0YM5LnWzwmyQCfdmkd
s63d6BRRavBoj9CYY5daTY8=
=VKYu
-----END PGP SIGNATURE-----