Re: client bug in 0.2.2.7-alpha and a new bad exit: exoassist

2010-01-31 Thread Scott Bennett
On Sun, 31 Jan 2010 23:10:42 -0500 Flamsmark wrote: >On 31 January 2010 21:58, Scott Bennett wrote: > >> So it appears that a) there is a new tor client bug in 0.2.2.7-alpha >> that >> leaves the "exoassist.exit" in the name passed along from its SOCKS >> listener >> to the destination p

Re: client bug in 0.2.2.7-alpha and a new bad exit: exoassist

2010-01-31 Thread Flamsmark
On 31 January 2010 21:58, Scott Bennett wrote: > So it appears that a) there is a new tor client bug in 0.2.2.7-alpha > that > leaves the "exoassist.exit" in the name passed along from its SOCKS > listener > to the destination port. > Isn't .exit deprecated because it's a potential vector fo

client bug in 0.2.2.7-alpha and a new bad exit: exoassist

2010-01-31 Thread Scott Bennett
There's another bad exit on the loose. Its Nickname is "exoassist", and its fingerprint is "39A6 74F8 2BFB 0195 860C 04DD E0F3 6B60 C09D C72A". When trying to fetch a web page from www.fibrlink.net, I was surprised to get an error page back from someplace in Australia, beginning with "The req

Re: Testing packages for OS X 10.5 and later with broken openssl

2010-01-31 Thread Andrew Lewman
Ok, apparently the fixes for ppc didn't work right. Let's try again. I build these new ppc packages on a 10.5.x ppc machine. https://www.torproject.org/dist/osx-old/Tor-0.2.2.8-alpha-i386-10.5-10.6-only-Bundle.dmg and .asc are "expert" Tor. Just tor, nothing else. https://www.torproject.org/di

Re: browser fingerprinting - panopticlick

2010-01-31 Thread 7v5w7go9ub0o
Kyle Williams wrote: 7v5w7go9ub0o wrote: Andrew Lewman wrote: On 01/29/2010 08:20 PM, 7v5w7go9ub0o wrote: As we slowly transition to web 2.0, probably the next step is putting the TOR browser in a VM full of bogus, randomized userid/sysid/network information - carefully firewalled to allow

Re: browser fingerprinting - panopticlick

2010-01-31 Thread 7v5w7go9ub0o
Andrew Lewman wrote: > On 01/30/2010 08:40 PM, 7v5w7go9ub0o wrote: >> Given the implications of panopticlick, have you any interest/plans >> in making Torbutton fingerprints even more indistinguishable (e.g. >> give every user a windows I.E. fingerprint) > > Just to highlight what Mike said, > >

Re: browser fingerprinting - panopticlick

2010-01-31 Thread 7v5w7go9ub0o
scar wrote: > > thanks for the suggestions, 7v5w7go9ub0o. > > i also read through [1] and am trying out the LinkStatus add-on[2]. > > it seems to work, and is kind of useful in that it tells me in the > status bar the time i last visited a link. > > > 1. http://whattheinternetknowsaboutyou.c

Re: TorButton and information disclosure on last OR

2010-01-31 Thread Marcus Griep
I think that you misunderstand what the Host header is for. It is a required header for HTTP/1.1, and it gives a host *name* that the server can then use to differentiate which resource you wanted. For example, www.example.com and news.example.com could be run off the same server. In order for the

TorButton and information disclosure on last OR

2010-01-31 Thread Mansur Marvanov
Hello! I have a Client machine with TorButton (Tor client + Firefox + Privoxy + TorButton) and a Server machine with Apache. But when I'm trying to connect from Client to Server through TOR network I see that there's my information on HTTP-headers on Server side that last OR gives to my Apache. So

Re: browser fingerprinting - panopticlick

2010-01-31 Thread Kyle Williams
7v5w7go9ub0o wrote: > Andrew Lewman wrote: > >> On 01/29/2010 08:20 PM, 7v5w7go9ub0o wrote: >> >>> As we slowly transition to web 2.0, probably the next step is >>> putting the TOR browser in a VM full of bogus, randomized >>> userid/sysid/network information - carefully firewalled to all