はてなブックマーク

Update (Oct 22 13:15 UTC): Windows users that are affected by Tor Browser crashes might try to avoid this problem by opening "about:config" and setting the preference "media.directshow.enabled" to "false". This is a workaround reported to help while the investigation is still on-going. Update (Oct 25 02:32 UTC): If you are unhappy with the new Firefox 31 UI, please check out Classic Theme Restorer

Tor security advisory: "relay early" traffic confirmation attack by arma | July 30, 2014 This advisory was posted on the tor-announce mailing list. SUMMARY: On July 4 2014 we found a group of relays that we assume were trying to deanonymize users. They appear to have been targeting people who operate or access Tor hidden services. The attack involved modifying Tor protocol headers to do traffic co

Mission Impossible: Hardening Android for Security and Privacy by mikeperry | April 3, 2014 Updates: See the Changes section for a list of changes since initial posting. This post has been updated further by the November 2016 Refresh of the same idea Executive Summary The future is here, and ahead of schedule. Come join us, the weather's nice. This blog post describes the installation and configur

Tor and the BEAST SSL attack by nickm | September 24, 2011 Today, Juliano Rizzo and Thai Duong presented a new attack on TLS <= 1.0 at the Ekoparty security conference in Buenos Aires. Let's talk about how it works, and how it relates to the Tor protocol. Short version: Don't panic. The Tor software itself is just fine, and the free-software browser vendors look like they're responding well and qu

About an hour ago I was contacted by the Dutch Government with more details about the DigiNotar Debacle. It seems that they're doing a great job keeping on top of things and doing the job that DigiNotar should've done in July. They sent a spreadsheet with a list of 531 entries on the currently known bad DigiNotar related certificates. The list isn't pretty and I've decided that in the interest of

The DigiNotar Debacle, and what you should do about it by ioerror | September 1, 2011 Recently it has come to the attention of, well, nearly the entire world that the Dutch Certificate Authority DigiNotar incorrectly issued certificates to a malicious party or parties. Even more recently, it's come to light that they were apparently compromised months ago or perhaps even in May of 2009 if not earl

Detecting Certificate Authority compromises and web browser collusion by ioerror | March 23, 2011 Thanks to Ian Gallagher, Seth Schoen, Jesse Burns, Chris Palmer, and other anonymous birds for their invaluable feedback on this writeup. The Tor Project has long understood that the certification authority (CA) model of trust on the internet is susceptible to various methods of compromise. Without st