Re: [tor-talk] browser fingerprinting

2014-04-14 Thread Aymeric Vitte
Yes, of course js is not at all the cause of the problems described in this thread, strange that this very wrong idea is still popular. JS can not prevent you from hacking yourself if you like which is what the links provided here are about. That's even the contrary, you can not hide js code,

Re: [tor-talk] Tor and Openssl on old OSX [was Tor and Openssl bug CVE-2014-0160]

2014-04-14 Thread Geoff Down
On Tue, Apr 8, 2014, at 11:37 PM, Andreas Krey wrote: > On Tue, 08 Apr 2014 22:06:31 +, Geoff Down wrote: > > > ... > > /library/tor/bin/tor: > > /opt/local/lib/libz.1.dylib (compatibility version 1.0.0, > > current version 1.2.5) > > /opt/local/lib/libevent-2.0.5.dyl

Re: [tor-talk] Heartbleed bug / Mainstream information

2014-04-14 Thread mick
On Mon, 14 Apr 2014 16:48:04 -0400 "Christopher J. Walters" allegedly wrote: > On 4/14/2014 4:40 PM, mick wrote: > > On Mon, 14 Apr 2014 15:03:09 -0400 > > "Christopher J. Walters" allegedly wrote: > >> > >> Or maybe Snowden really was just an attention seeker, who really > >> knew nothing. That

Re: [tor-talk] Heartbleed bug / Mainstream information

2014-04-14 Thread Christopher J. Walters
On 4/14/2014 4:40 PM, mick wrote: On Mon, 14 Apr 2014 15:03:09 -0400 "Christopher J. Walters" allegedly wrote: Or maybe Snowden really was just an attention seeker, who really knew nothing. That must be why the US sent a CIA kill squad after him - so he wouldn't spread "conspiracy theories" ar

Re: [tor-talk] Heartbleed bug / Mainstream information

2014-04-14 Thread mick
On Mon, 14 Apr 2014 15:03:09 -0400 "Christopher J. Walters" allegedly wrote: > > Or maybe Snowden really was just an attention seeker, who really knew > nothing. That must be why the US sent a CIA kill squad after him - so > he wouldn't spread "conspiracy theories" around. Do you have a referenc

Re: [tor-talk] Heartbleed bug / Mainstream information

2014-04-14 Thread Christopher J. Walters
On 4/14/2014 2:46 PM, Roger Dingledine wrote: On Sun, Apr 13, 2014 at 04:01:09PM -0400, Christopher J. Walters wrote: The discussion on the Heatbleed bug has apparently stopped here, and just about everywhere else It continued, including the NSA conspiracy theories, here: https://lists.torproj

Re: [tor-talk] Heartbleed bug / Mainstream information

2014-04-14 Thread Roger Dingledine
On Sun, Apr 13, 2014 at 04:01:09PM -0400, Christopher J. Walters wrote: > The discussion on the Heatbleed bug has apparently stopped here, and > just about everywhere else It continued, including the NSA conspiracy theories, here: https://lists.torproject.org/pipermail/tor-relays/2014-April/thread

Re: [tor-talk] browser fingerprinting

2014-04-14 Thread Roger Dingledine
On Mon, Apr 14, 2014 at 08:19:11PM +0200, Thomas Asta wrote: > Nils that ia simply untrue. JS accesses the local machine where the briwser > is. > Am 14.04.2014 20:11 schrieb "Nils Kunze" : > > > As these requests will be sent out via the tor network, this will not leak > > your real ip but just t

Re: [tor-talk] Is Tor network still vulnerable to Heartbleed?

2014-04-14 Thread Артур Истомин
On Mon, Apr 14, 2014 at 01:45:16PM +, antispa...@sent.at wrote: > In his announcement, arma noted it would be a good idea to stay away > from the Internet. Is it ok? Yeah, let's go to FIDO! :) The more you wait (without Internet), the more servers will be updated less likely that you'll find

Re: [tor-talk] Heartbleed bug / Mainstream information

2014-04-14 Thread Christopher J. Walters
On 4/13/2014 4:54 PM, Артур Истомин wrote: On Sun, Apr 13, 2014 at 04:01:09PM -0400, Christopher J. Walters wrote: .snip. Yeah, we all know about this shit. But problem not NSA (they need a bomb under their building), problem about how many devices/software not fixed and can not be fixed, how m

Re: [tor-talk] browser fingerprinting

2014-04-14 Thread Thomas Asta
Nils that ia simply untrue. JS accesses the local machine where the briwser is. Am 14.04.2014 20:11 schrieb "Nils Kunze" : > As these requests will be sent out via the tor network, this will not leak > your real ip but just the ip of your exit relay, which is known anyways. > > > 2014-04-14 19:49

Re: [tor-talk] browser fingerprinting

2014-04-14 Thread Nils Kunze
As these requests will be sent out via the tor network, this will not leak your real ip but just the ip of your exit relay, which is known anyways. 2014-04-14 19:49 GMT+02:00 Randolph : > tor with ff js enabled still bleeding: > > http://www.codeproject.com/Questions/589062/HowplustoplusgetplusC

Re: [tor-talk] browser fingerprinting

2014-04-14 Thread Randolph
tor with ff js enabled still bleeding: http://www.codeproject.com/Questions/589062/HowplustoplusgetplusClientplusIpplusAddressplusand 2014-04-14 19:48 GMT+02:00 Randolph : > another torbleed: > > http://stackoverflow.com/questions/391979/get-client-ip-using-just-javascript > http://en.wikipedia.

Re: [tor-talk] browser fingerprinting

2014-04-14 Thread Randolph
another torbleed: http://stackoverflow.com/questions/391979/get-client-ip-using-just-javascript http://en.wikipedia.org/wiki/JavaScript#Security 2014-04-14 19:44 GMT+02:00 Randolph : > > http://stackoverflow.com/questions/371875/local-file-access-with-javascript > > then firefox with javascript

Re: [tor-talk] browser fingerprinting

2014-04-14 Thread Randolph
http://stackoverflow.com/questions/371875/local-file-access-with-javascript then firefox with javascript enabled is a torbleed. 2014-04-14 15:46 GMT+02:00 Gerardus Hendricks : > On 4/13/14 9:20 PM, Randolph wrote: > >> Anonymity is quite easily broken, if cookies cannot managed (e.g. like >> i

[tor-talk] Is Tor network still vulnerable to Heartbleed?

2014-04-14 Thread antispam06
In his announcement, arma noted it would be a good idea to stay away from the Internet. Is it ok? -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

Re: [tor-talk] browser fingerprinting

2014-04-14 Thread Gerardus Hendricks
On 4/13/14 9:20 PM, Randolph wrote: Anonymity is quite easily broken, if cookies cannot managed (e.g. like in certain browsers) and if javascript is enabled. As far as we see, Firefox in the Tor bundle disables javascript, right? Javascript allows to access the local IP address and files, which h

Re: [tor-talk] Leaky pipe design in TOR

2014-04-14 Thread mahdi
But As i studied the Basic TOR paper, every middle onion router checks the integrity field of relay cell. when the integrity matches it diagnose that itself has chosen as exit node but in recent papers they all says that only the third node checks the integrity field (not the middle onion router) a

Re: [tor-talk] Leaky pipe design in TOR

2014-04-14 Thread Nick Mathewson
On Mon, Apr 14, 2014 at 6:46 AM, mahdi wrote: > Hi > I am a researcher about anonymous communication systems. something that > recently have confused me is that what happened to leaky pipe design of > TOR!! > Is that anymore in use in current versions of TOR? > And what is the reason of removi

[tor-talk] Leaky pipe design in TOR

2014-04-14 Thread mahdi
Hi I am a researcher about anonymous communication systems. something that recently have confused me is that what happened to leaky pipe design of TOR!! Is that anymore in use in current versions of TOR? And what is the reason of removing this feature? thanks alot for spending your time about m