Re: Supercookies

2009-08-21 Thread Andrew Lewman
On 08/21/2009 10:58 AM, Freemor wrote: > You're not alone. I use a seperate browser for Tor and it is completely > stripped out no plugins, java/javascript disables, defaults to saving > to disk rather then opening stuff. etc. Try Torora, http://code.google.com/p/torora/. I've been heavily test

Re: Supercookies

2009-08-21 Thread Freemor
On Fri, 21 Aug 2009 10:10:53 -0400 Ted Smith wrote: > On Fri, 2009-08-21 at 07:47 +, Paul Ferguson wrote: > Am I the only person who thinks it is generally a bad idea to keep > adding surface area to a browser that is supposed to be anonymous? If > we have an extension to rein in a plugin, a

Re: Supercookies

2009-08-21 Thread Ted Smith
On Fri, 2009-08-21 at 07:47 +, Paul Ferguson wrote: > > Uuups, it seems BetterPrivacy allows remote code execution: > > Easily defeated: > > http://objection.mozdev.org/ > > - ferg > Am I the only person who thinks it is generally a bad idea to keep adding surface area to a browser that is

RE: Supercookies

2009-08-21 Thread downie -
> Date: Fri, 21 Aug 2009 09:14:04 +0200 > From: matej.kova...@owca.info > To: or-talk@freehaven.net > Subject: Re: Supercookies > > Uuuups, it seems BetterPrivacy allows remote code execution. > > "This plugin is currently dangerous for anyone to have installe

Re: Supercookies

2009-08-21 Thread Matej Kovacic
Uuuups, it seems BetterPrivacy allows remote code execution. "This plugin is currently dangerous for anyone to have installed as it is vulnerable to a 0 day exploit which allows remote code execution. I wont post the code but lets just say I have a working exploit ( though benign ) running on

Re: Supercookies

2009-08-21 Thread Paul Ferguson
> Uuups, it seems BetterPrivacy allows remote code execution: Easily defeated: http://objection.mozdev.org/ - ferg

Re: Supercookies

2009-08-21 Thread Matej Kovacic
Uuups, it seems BetterPrivacy allows remote code execution: This plugin is currently dangerous for anyone to have installed as it is vulnerable to a 0 day exploit which allows remote code execution. I wont post the code but lets just say I have a working exploit ( though benign ) running on ht

Re: Supercookies

2009-08-20 Thread Andrew Lewman
On 08/20/2009 10:58 AM, Ted Smith wrote: > Wait, what? The discussion of persistent, hidden, plugin-based storage > is off-topic for the Tor list? I would think that constitutes a security > threat from the perspective of someone using Tor to safeguard their > anonymity. Additionally, the question

Re: Supercookies

2009-08-20 Thread Ted Smith
On Thu, 2009-08-20 at 10:28 -0400, Andrew Lewman wrote: > On 08/20/2009 10:09 AM, Ted Smith wrote: > > You don't "lose most functionality" by using free software. > > Not picking on Ted, but this whole thread is off-topic. > Wait, what? The discussion of persistent, hidden, plugin-based storage

Re: Supercookies

2009-08-20 Thread Andrew Lewman
On 08/20/2009 10:09 AM, Ted Smith wrote: > You don't "lose most functionality" by using free software. Not picking on Ted, but this whole thread is off-topic. -- Andrew Lewman The Tor Project pgp 0x31B0974B Website: https://torproject.org/ Blog: https://blog.torproject.org/ Identi.ca: torproje

Re: Supercookies

2009-08-20 Thread Ted Smith
On Thu, 2009-08-20 at 09:54 -0400, Praedor Atrebates wrote: > On Thursday 20 August 2009 09:36:40 am Ted Smith wrote: > > On Thu, 2009-08-20 at 08:55 +0200, Matej Kovacic wrote: > > > Hi, > > > > > > I am not sure if this was on this list, but it is an interesting > > > information: > > > > > > h

Re: Supercookies

2009-08-20 Thread Eugen Leitl
On Thu, Aug 20, 2009 at 09:54:59AM -0400, Praedor Atrebates wrote: > No need to go extreme and lose most functionality by going 1% free/open > software. The issue is security only. Some features are intrinsically exploitable, and it matters little how it's implemented. > You simply lose a

Re: Supercookies

2009-08-20 Thread Praedor Atrebates
On Thursday 20 August 2009 09:36:40 am Ted Smith wrote: > On Thu, 2009-08-20 at 08:55 +0200, Matej Kovacic wrote: > > Hi, > > > > I am not sure if this was on this list, but it is an interesting > > information: > > > > http://www.wired.com/epicenter/2009/08/you-deleted-your-cookies-think-again/

Re: Supercookies

2009-08-20 Thread Ted Smith
On Thu, 2009-08-20 at 08:55 +0200, Matej Kovacic wrote: > Hi, > > I am not sure if this was on this list, but it is an interesting > information: > > http://www.wired.com/epicenter/2009/08/you-deleted-your-cookies-think-again/ > it seems cookies could be "respawned"... > > And there is a plugin

Supercookies

2009-08-19 Thread Matej Kovacic
Hi, I am not sure if this was on this list, but it is an interesting information: http://www.wired.com/epicenter/2009/08/you-deleted-your-cookies-think-again/ it seems cookies could be "respawned"... And there is a plugin to remove this LSO's: https://addons.mozilla.org/en-US/firefox/addon/6623