On Thu, 13 Sep 2007 11:46:33 +0200 Peter Palfrader <[EMAIL PROTECTED]> wrote: >On Thu, 13 Sep 2007, Scott Bennett wrote: > >> For obvious reasons, tor should not be getting directory information >> over >> a connection that is not encrypted from end to end, even if everyone knows >> exactly what the content of the directory information happens to be at any >> given moment. > >What are those reasons? I'm sorry they are not apparent to me. > Well, when I wrote that, one thing that was worrying me was a MITM attack. After sending it, I remembered that the directory information would be signed by an authority, which should infinitesimalize any chance of a MITM corruption of the information going undetected. But that still leaves open a somewhat less dangerous situation in which the MITM always damages the information or interferes with the connection somehow, creating a form of DoS, so that the recipient cannot obtain valid directory information. That would be a type of DoS that would not, for example, trigger any alarms in a router or other typical network monitor. There may also be some kind of profiling attack made possible simply by observing the timing of when a tor gets directory updates, network status documents, etc., though I haven't a good approach in mind for doing that. There was another fleeting thought or two, but they evaporated while I was typing my original message on the matter. If any come back to mind and still seem interesting, I'll post them. It may be that there is no real threat here and that I simply engaged fingers before engaging brain, but I've always had a dislike for the possibility of being watched without my knowledge or permission.
Scott Bennett, Comm. ASMELG, CFIAG ********************************************************************** * Internet: bennett at cs.niu.edu * *--------------------------------------------------------------------* * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * * -- Gov. John Hancock, New York Journal, 28 January 1790 * **********************************************************************