Re: [tor-dev] Proposal 190: Password-based Bridge Client Authorization

2012-01-18 Thread Robert Ransom
On 2012-01-18, Nick Mathewson wrote: > On Tue, Jan 17, 2012 at 1:28 PM, Robert Ransom > wrote: > >> With that hack on top of the v3 protocol, any client able to detect >> that a bridge is not being MITMed can impersonate the bridge through >> the TLS handshake, until after the (honest, victim) cl

Re: [tor-dev] Proposal 190: Password-based Bridge Client Authorization

2012-01-18 Thread Nick Mathewson
On Tue, Jan 17, 2012 at 1:28 PM, Robert Ransom wrote: > With that hack on top of the v3 protocol, any client able to detect > that a bridge is not being MITMed can impersonate the bridge through > the TLS handshake, until after the (honest, victim) client speaks the > Tor protocol at the fake bri

Re: [tor-dev] Proposal 190: Password-based Bridge Client Authorization

2012-01-18 Thread Ian Goldberg
On Wed, Jan 18, 2012 at 07:07:08AM +, Robert Ransom wrote: > On 2012-01-17, Ian Goldberg wrote: > > On Tue, Jan 17, 2012 at 08:43:00PM +0200, George Kadianakis wrote: > >> [0]: Did the Telex people clean up the patch, generalize it, and post > >> it in openssl-dev? Having configurable {Server,