#24622: Torcrazybutton can't decipher website s3.amazonaws.com
-------------------------------------------------+-------------------------
Reporter: cypherpunks | Owner: tbb-
| team
Type: defect | Status: new
Priority: Medium | Milestone:
Component: Applications/Tor Browser | Version:
Severity: Major | Resolution:
Keywords: tbb-7.0-issues, tbb-regression, | Actual Points:
tbb-linkability, GeorgKoppen201903, |
TorBrowserTeam201904 |
Parent ID: | Points:
Reviewer: | Sponsor:
-------------------------------------------------+-------------------------
Comment (by acat):
Firefox computes the firstPartyDomain with
`Services.eTLD.getBaseDomainFromHost('s3.amazonaws.com')`, and that one
throws an error with top-level domains (like s3.amazonaws.com) as defined
in mozilla public suffix list https://publicsuffix.org/list/. And I assume
if there's an exception then it gets set to an empty string (unless it's
about:*, etc.).
Which means that all domains here will go to the same catch-all circuit:
https://gitweb.torproject.org/tor-
browser.git/tree/netwerk/dns/effective_tld_names.dat?h=tor-
browser-60.6.1esr-8.0-1-build1. So urls like http://mycd.eu,
http://s3.amazonaws.com/whatever, https://ownprovider.com/en/Main, ...,
will go to the same catch-all circuit with the current firstPartyDomain
implementation. The same happens with any random domain like
http://foobarfoo. Also note the list in the repo is not up to date with
https://publicsuffix.org/list/public_suffix_list.dat.
Shouldn't firstPartyDomain be the first-level domain on those cases
(instead of empty string), or am I missing some reason why this is not a
good idea?
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/24622#comment:40>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs
