full-disclosure - Re: Compromise of Tor, anonymizing networks/utilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 08 Dec 2007 19:31:09 -0500
From: gmaggro <gmaggro@...ers.com>
To: coderman <coderman@...il.com>, full-disclosure@...ts.grok.org.uk
Subject: Re: Compromise of Tor,
	anonymizing networks/utilities

>> Yes, I suppose that assertion would be better served by backing it up
>> with some information..
> 
> http://www.freehaven.net/anonbib/
> http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ

Thank you for the information.

>> Having seen good crypto ruined by lousy implementations, I thought it
>> timely to remind ourselves of the lesson that implementation is at least as
>> important as the underlying theory.
> 
> this is actually a significant aspect for Tor, given that so many
> applications and services which were never intended to be anonymized
> are now getting sent over the network.  the implementation / side
> channel issue is huge, and one reason i am such a proponent of the
> transparent Tor proxy model where all network traffic is either sent
> through Tor or dropped.

Agreed.

Looking through the list of support programs commonly used to integrate
with Tor I see a number that would be good candidates for rolling into
the Tor code itself.

What about addressing some of the issues via deeper manipulation, say,
loadable kernel modules to assist Tor? Beat the stack into doing what
you want it to instead of using proxies, or adapting applications to use
proxies.

> (i should pimp JanusVM here, but you can also configure for *nix easily)

Heh, I have a copy of that around somewhere. Thank you for reminding me.

P.s. Sorry for the terrible formatting on my last email there, folks

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/