Re: TLS Man-In-The-Middle Vulnerability

2009-11-23 Thread Marco Bonetti
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Erwin Lam wrote: Nov 23 05:07:29.317 [notice] Tor 0.2.1.20 opening log file. Nov 23 05:07:29.352 [notice] Parsing GEOIP file. Nov 23 05:07:30.212 [notice] No current certificate known for authority urras; launching request. Nov 23 05:07:30.212

Re: TLS Man-In-The-Middle Vulnerability

2009-11-23 Thread Marco Bonetti
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I should correct myself: I'm supposed to be in a safe network, yet the errors are still on. Could it be related to the openssl version? The 0.9.8k release disables SSL renegotiation. - -- Marco Bonetti Slackintosh Linux Project Developer:

Re: TLS Man-In-The-Middle Vulnerability

2009-11-23 Thread Scott Bennett
On Mon, 23 Nov 2009 05:21:41 +0100 Erwin Lam erwin...@dds.nl wrote: On Monday 23 November 2009 03:29:14 Scott Bennett wrote: On Sun, 22 Nov 2009 23:47:36 +0100 Erwin Lam erwin...@dds.nl wrote: On Thursday 12 November 2009 03:15:20 Nick Mathewson wrote: On Wed, Nov 11, 2009 at

Re: TLS Man-In-The-Middle Vulnerability

2009-11-23 Thread Erwin Lam
On Monday 23 November 2009 19:46:48 Scott Bennett wrote: big snip ... tor-0.2.1.20-1.pm.1.1.x86_64 Try 0.2.2.6-alpha. I'm running 0.2.2.5-alpha with no problems. openssl-0.9.8k-3.5.3.x86_64 You should probably also update openssl to 0.9.8l before building tor.

Re: TLS Man-In-The-Middle Vulnerability

2009-11-23 Thread Roger Dingledine
On Mon, Nov 23, 2009 at 05:21:41AM +0100, Erwin Lam wrote: Indeed it will not. We have a fix in svn to make the 0.2.1.x and 0.2.2.x-alpha series both work correctly with OpenSSL 0.9.8l. With any luck, we should get releases out before too long. Well, I am running tor v 0.2.1.20,

Re: TLS Man-In-The-Middle Vulnerability

2009-11-22 Thread Erwin Lam
On Thursday 12 November 2009 03:15:20 Nick Mathewson wrote: On Wed, Nov 11, 2009 at 12:59:21PM -0500, Andrew S. Lists wrote: On 11/05/09 15:52, Nick Mathewson wrote: On Thu, Nov 05, 2009 at 02:10:00PM -0500, Marcus Griep wrote: Don't know if any one else has seen or taken a look at this.

Re: TLS Man-In-The-Middle Vulnerability

2009-11-22 Thread andrew
On Sun, Nov 22, 2009 at 11:47:36PM +0100, erwin...@dds.nl wrote 2.2K bytes in 60 lines about: : Would you mind releasing that updated version a.s.a.p. Tor doesn't work : here at all anymore What errors do you see in the tor logs? -- Andrew Lewman The Tor Project pgp 0x31B0974B Website:

Re: TLS Man-In-The-Middle Vulnerability

2009-11-22 Thread Scott Bennett
On Sun, 22 Nov 2009 23:47:36 +0100 Erwin Lam erwin...@dds.nl wrote: On Thursday 12 November 2009 03:15:20 Nick Mathewson wrote: On Wed, Nov 11, 2009 at 12:59:21PM -0500, Andrew S. Lists wrote: On 11/05/09 15:52, Nick Mathewson wrote: On Thu, Nov 05, 2009 at 02:10:00PM -0500, Marcus

Re: TLS Man-In-The-Middle Vulnerability

2009-11-22 Thread Erwin Lam
On Monday 23 November 2009 03:29:14 Scott Bennett wrote: On Sun, 22 Nov 2009 23:47:36 +0100 Erwin Lam erwin...@dds.nl wrote: On Thursday 12 November 2009 03:15:20 Nick Mathewson wrote: On Wed, Nov 11, 2009 at 12:59:21PM -0500, Andrew S. Lists wrote: On 11/05/09 15:52, Nick Mathewson

Re: TLS Man-In-The-Middle Vulnerability

2009-11-11 Thread Andrew S. Lists
On 11/05/09 15:52, Nick Mathewson wrote: On Thu, Nov 05, 2009 at 02:10:00PM -0500, Marcus Griep wrote: Don't know if any one else has seen or taken a look at this. I don't know if this affects Tor, though I believe that we do use certificate renegotiation in the protocol, and that is the entry

Re: TLS Man-In-The-Middle Vulnerability

2009-11-11 Thread Nick Mathewson
On Wed, Nov 11, 2009 at 12:59:21PM -0500, Andrew S. Lists wrote: On 11/05/09 15:52, Nick Mathewson wrote: On Thu, Nov 05, 2009 at 02:10:00PM -0500, Marcus Griep wrote: Don't know if any one else has seen or taken a look at this. I don't know if this affects Tor, though I believe that we

TLS Man-In-The-Middle Vulnerability

2009-11-05 Thread Marcus Griep
Don't know if any one else has seen or taken a look at this. I don't know if this affects Tor, though I believe that we do use certificate renegotiation in the protocol, and that is the entry vector for this particular vulnerability: TLS Man-in-the-middle on renegotiation vulnerability made

Re: TLS Man-In-The-Middle Vulnerability

2009-11-05 Thread Marcus Griep
wrote: Don't know if any one else has seen or taken a look at this. I don't know if this affects Tor, though I believe that we do use certificate renegotiation in the protocol, and that is the entry vector for this particular vulnerability: TLS Man-in-the-middle on renegotiation vulnerability

Re: TLS Man-In-The-Middle Vulnerability

2009-11-05 Thread Nick Mathewson
On Thu, Nov 05, 2009 at 02:10:00PM -0500, Marcus Griep wrote: Don't know if any one else has seen or taken a look at this. I don't know if this affects Tor, though I believe that we do use certificate renegotiation in the protocol, and that is the entry vector for this particular