Georg Koppen: > Tom Ritter: >> The info I gave you was for Tor Browser, the the latter (about session >> ID) is actually wrong. TBB disables both. >> >> https://trac.torproject.org/projects/tor/ticket/20447#ticket >> https://gitweb.torproject.org/tor-browser.git/tree/security/manager/ssl/nsNSSComponent.cpp?h=tor-browser-45.4.0esr-6.5-1#n724 >> >> Also: https://trac.torproject.org/projects/tor/ticket/4099 > > Don't forget https://trac.torproject.org/projects/tor/ticket/17252 which > is our medium/long term plan. > > I spoke about binding the TLS session resumption and ID to the URL bar > domain with some Mozilla folks a while back and they seemed to be quite > amenable to this kind of patch idea. I guess I finally should file that > bug in Mozilla's bugtracker to get it on everybody's radar... > > Georg > >> Core Tor also disables both also AFAICT: >> https://gitweb.torproject.org/tor.git/commit/?id=8743080a289a20bfaf0a67d6382ba0c2a6d6534d >> https://gitweb.torproject.org/tor.git/tree/src/common/tortls.c#n1164 >> >> -tom
Thanks for this. I'll have to convert this to Java and get it integrated into NetCipher. This affects Orfox/Fennec by the way. Fennec uses Java code to fetch some things. I think the favicon is fetched with Java code, for example. .hc -- PGP fingerprint: EE66 20C7 136B 0D2C 456C 0A4D E9E2 8DEA 00AA 5556 https://pgp.mit.edu/pks/lookup?op=vindex&search=0xE9E28DEA00AA5556 _______________________________________________ tor-dev mailing list tor-dev@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev
