RE: Stealing browser history without JavaScript

2009-06-14 Thread Zinco
Matej Kovacic wrote: Hi, this seems an interesting issue: http://www.making-the-web.com/misc/sites-you-visit/nojs/ bye, Matej >>>Anon Mus Wrote: >>> Been to this site and it dont work on my firefox.3.0.8 browser... (with >>> NoScript, QuickJav

RE: Stealing browser history without JavaScript

2009-06-14 Thread downie -
> Date: Sun, 14 Jun 2009 22:34:32 +0100 > From: my.green.lant...@googlemail.com > To: or-talk@freehaven.net > Subject: Re: Stealing browser history without JavaScript > > Matej Kovacic wrote: > > > > Seems to me it would have to have all websites known to man on the page it > > loads. If it loo

Re: Stealing browser history without JavaScript

2009-06-14 Thread Anon Mus
Zinco wrote: -Original Message- From: owner-or-t...@freehaven.net [mailto:owner-or-t...@freehaven.net] On Behalf Of Anon Mus Sent: Sunday, June 14, 2009 8:09 AM To: or-talk@freehaven.net Subject: Re: Stealing browser history without JavaScript Matej Kovacic wrote: Hi, this seems an

Re: SoC Project: Improving Hidden Service Security and Usability

2009-06-14 Thread Chris Humphry
Hi Ringo, Thanks for your soon to be improvements!   I have a couple of requests/questions if you do not mind: 1. I believe the current state of Hidden Service (HS) is one where access to an HS can be username:passphrase protected?  Please correct me if I am wrong, but I believe someone made H

Re: eliminating bogus port 43 exits

2009-06-14 Thread Anon Mus
Alexander Cherepanov wrote: Hello, Scott! You wrote to or-t...@seul.org, scr...@nonvocalscream.com on Sun, 14 Jun 2009 01:15:43 -0500 (CDT): Now, another person on this list has argued that the RFC's should be ignored and that IANA should be ignored. I remain unconvinced that doing ei

RE: Stealing browser history without JavaScript

2009-06-14 Thread Zinco
-Original Message- From: owner-or-t...@freehaven.net [mailto:owner-or-t...@freehaven.net] On Behalf Of Anon Mus Sent: Sunday, June 14, 2009 8:09 AM To: or-talk@freehaven.net Subject: Re: Stealing browser history without JavaScript Matej Kovacic wrote: > Hi, > > this seems an interesting

Re: Stealing browser history without JavaScript

2009-06-14 Thread Anon Mus
Matej Kovacic wrote: Hi, this seems an interesting issue: http://www.making-the-web.com/misc/sites-you-visit/nojs/ bye, Matej Been to this site and it dont work on my firefox.3.0.8 browser... (with NoScript, QuickJava, Better Privacy, JavaScript Deobfuscator, Quick Preference Button & Us

Re: Persistant SSL?

2009-06-14 Thread Andrew Lewman
On 06/14/2009 04:52 AM, pigpo...@safe-mail.net wrote: > It's encouraged to use SSL across tor rather than unencrypted HTTP. > Most of the websites I view do not offer SSL. How is it possible to > maintain a persistant SSL experience on the web with tor excluding > the few sites offering SSL? You

Re: torrc placement w/o make install

2009-06-14 Thread Andrew Lewman
On 06/14/2009 04:48 AM, pigpo...@safe-mail.net wrote: > I installed tor v0.2.0.34 from source, Linux. I run tor from > ~/tor(verion)/src/or, after running ./configure && make, omitting > make install. It works well. As it starts, one message is: > > [notice] Configuration file "/usr/local/etc/tor/

Re: Hackers exploiting tor clients on .onion sites?

2009-06-14 Thread Karsten Loesing
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 So, did I get this right? You are concerned about certain log messages, you even searched them on the Net, but you deleted them afterwards (including the searches in your browser history) and are telling us now that something strange is going on when v

Re: eliminating bogus port 43 exits

2009-06-14 Thread Alexander Cherepanov
Hello, Scott! You wrote to or-t...@seul.org, scr...@nonvocalscream.com on Sun, 14 Jun 2009 01:15:43 -0500 (CDT): > Now, another person on this list has argued that the RFC's should be > ignored and that IANA should be ignored. I remain unconvinced that doing > either would be a good idea.

Hackers exploiting tor clients on .onion sites?

2009-06-14 Thread pigpoked
I explored a few of the common .onion sites listed at Wikipedia's tor page listed within the external links footer. These sites loaded well, but I noticed several errors in my tor client logs. I googled for info on the errors, some of the error messages turned up in cvs related pages and bug tal

torrc placement w/o make install

2009-06-14 Thread pigpoked
I installed tor v0.2.0.34 from source, Linux. I run tor from ~/tor(verion)/src/or, after running ./configure && make, omitting make install. It works well. As it starts, one message is: [notice] Configuration file "/usr/local/etc/tor/torrc" not present, using reasonable defaults. As I opted no

Persistant SSL?

2009-06-14 Thread pigpoked
It's encouraged to use SSL across tor rather than unencrypted HTTP. Most of the websites I view do not offer SSL. How is it possible to maintain a persistant SSL experience on the web with tor excluding the few sites offering SSL? I've discovered some commerical web proxies offering SSL accounts

Re: eliminating bogus port 43 exits

2009-06-14 Thread Hans de Hartog
Thank you. I switched on info-logging and tomorrow I'll post the results of your script. Hans de Hartog Scott Bennett wrote: Unfortunately, the above method is unlikely to see more than a tiny fraction of the port 43 exits, which are usually of very short duration. Instead, try turni

Re: torrc placement w/o make install

2009-06-14 Thread Scott Bennett
On Sun, 14 Jun 2009 05:20:13 -0400 pigpo...@safe-mail.net wrote: >I installed tor v0.2.0.34 from source, Linux. I run tor from /src/or, after >running ./configure && make, omitting make install. It works well. As it >starts, one message is: > >[notice] Configuration file "/usr/local/etc/tor/

Hackers exploiting tor clients on .onion sites?

2009-06-14 Thread pigpoked
I explored a few of the common .onion sites listed at Wikipedia's tor page listed within the external links footer. These sites loaded well, but I noticed several errors in my tor client logs. I googled for info on the errors, some of the error messages turned up in cvs related pages and bug tal

Persistant SSL?

2009-06-14 Thread pigpoked
It's encouraged to use SSL across tor rather than unencrypted HTTP. Most of the websites I view do not offer SSL. How is it possible to maintain a persistant SSL experience on the web with tor excluding the few sites offering SSL? I've discovered some commerical web proxies offering SSL accounts

torrc placement w/o make install

2009-06-14 Thread pigpoked
I installed tor v0.2.0.34 from source, Linux. I run tor from /src/or, after running ./configure && make, omitting make install. It works well. As it starts, one message is: [notice] Configuration file "/usr/local/etc/tor/torrc" not present, using reasonable defaults. As I opted not to run make

Re: Dupe named exit nodes, friend or foe?

2009-06-14 Thread Scott Bennett
On Sun, 14 Jun 2009 04:53:51 -0400 pigpo...@safe-mail.net wrote: >Twice, I've received the, "Sorry, you're not using tor" message on the tor >check page. I checked one tor node listing website, the exit node IP listed on >the "Sorry" page was a recently added exit node which had a duplicate

Dupe named exit nodes, friend or foe?

2009-06-14 Thread pigpoked
Twice, I've received the, "Sorry, you're not using tor" message on the tor check page. I checked one tor node listing website, the exit node IP listed on the "Sorry" page was a recently added exit node which had a duplicate name of another exit node. This duplicate exit node was listed as down,

Re: eliminating bogus port 43 exits

2009-06-14 Thread Scott Bennett
On Sun, 14 Jun 2009 09:57:31 +0200 Hans de Hartog wrote: >Let's get back to the facts. I ran the following script last night >every 10 seconds for 10 hours on my exit node (lowest possible >bandwidth, i.e. 20 KBs). >Port Connections(cumulative for all runs) >443 131013 >80 31367 >43

allowing exits to more whois servers triggers bug

2009-06-14 Thread Scott Bennett
I added quite a few ExitPolicy lines to allow exits to whois servers I found on a list. Unfortunately, rather than uploading a new descriptor, tor is now issuing error messages that repeat frequently. Jun 14 03:03:08.492 [notice] Received reload signal (hup). Reloading config and resetting

Re: eliminating bogus port 43 exits

2009-06-14 Thread Hans de Hartog
Let's get back to the facts. I ran the following script last night every 10 seconds for 10 hours on my exit node (lowest possible bandwidth, i.e. 20 KBs). Port Connections(cumulative for all runs) 443 131013 80 31367 43 306 Other ports neglectable, so why the fuzz about port 43? The scri