Re: [tor-bugs] #30499 [Metrics/Relay Search]: In Tor Metrics / Relay Search, users are able to enter the digital fingerprint of a bridge to run a successful search and display the data about that brid

[Tor Bug Tracker & Wiki]

#30499: In Tor Metrics / Relay Search, users are able to enter the digital
fingerprint of a bridge to run a successful search and display the data
about that bridge, but the Relay Search page states, "If you are searching
for a bridge, you will need to search by the hashed fingerprint. This
prevents leaking the fingerprint of the bridge when searching."
--+--
 Reporter:  monmire   |  Owner:  metrics-team
 Type:  defect| Status:  closed
 Priority:  Medium|  Milestone:
Component:  Metrics/Relay Search  |Version:
 Severity:  Normal| Resolution:  not a bug
 Keywords:|  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by cypherpunks):

 wait, the bridge configline in torrc does not include the hashed
 fingerprint ? I only provide ip port combination, tor bridge client would
 accept any bridge (hashed fingerprint) at this destination..

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30499 [Metrics/Relay Search]: In Tor Metrics / Relay Search, users are able to enter the digital fingerprint of a bridge to run a successful search and display the data about that brid

[Tor Bug Tracker & Wiki]

#30499: In Tor Metrics / Relay Search, users are able to enter the digital
fingerprint of a bridge to run a successful search and display the data
about that bridge, but the Relay Search page states, "If you are searching
for a bridge, you will need to search by the hashed fingerprint. This
prevents leaking the fingerprint of the bridge when searching."
--+--
 Reporter:  monmire   |  Owner:  metrics-team
 Type:  defect| Status:  closed
 Priority:  Medium|  Milestone:
Component:  Metrics/Relay Search  |Version:
 Severity:  Normal| Resolution:  not a bug
 Keywords:|  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by irl):

 #30768 filed for adding comments to the torrc.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30499 [Metrics/Relay Search]: In Tor Metrics / Relay Search, users are able to enter the digital fingerprint of a bridge to run a successful search and display the data about that brid

[Tor Bug Tracker & Wiki]

#30499: In Tor Metrics / Relay Search, users are able to enter the digital
fingerprint of a bridge to run a successful search and display the data
about that bridge, but the Relay Search page states, "If you are searching
for a bridge, you will need to search by the hashed fingerprint. This
prevents leaking the fingerprint of the bridge when searching."
--+--
 Reporter:  monmire   |  Owner:  metrics-team
 Type:  defect| Status:  closed
 Priority:  Medium|  Milestone:
Component:  Metrics/Relay Search  |Version:
 Severity:  Normal| Resolution:  not a bug
 Keywords:|  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--
Changes (by irl):

 * keywords:  Relay-Search-accepts-bridge-digital-signature issue =>
 * priority:  High => Medium
 * status:  new => closed
 * resolution:   => not a bug


Comment:

 If a user is going to type in a non-hashed bridge fingerprint, or any
 other secret, then there's not much we can do to stop them.

 Relay Search actually does hash fingerprints before looking them up, so
 even searching for a non-hashed fingerprint doesn't actually send that
 fingerprint to the server.

 Regarding the torrc thing, perhaps we can add comments to the file with
 the relay search links. This wouldn't be a problem with relay search
 though.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs