Comments on: Tor: Exploiting the weakest link http://security.blogoverflow.com/2012/04/tor-exploiting-the-weakest-link/ The Security Stack Exchange Blog Sat, 06 Feb 2016 05:11:22 +0000 hourly 1 https://wordpress.org/?v=4.5.6 By: Chris http://security.blogoverflow.com/2012/04/tor-exploiting-the-weakest-link/#comment-234823 Tue, 17 Dec 2013 00:17:35 +0000 http://security.blogoverflow.com/?p=613#comment-234823 “/etc/init.d/tor start” starts tor as: /usr/bin/tor –defaults-torrc /usr/share/tor/tor-service-defaults-torrc –hush

how do i get rid of –hush?

]]> By: lucaskauffman http://security.blogoverflow.com/2012/04/tor-exploiting-the-weakest-link/#comment-37160 Wed, 27 Feb 2013 06:54:13 +0000 http://security.blogoverflow.com/?p=613#comment-37160 We didn’t need the password, but the session id contained in the cookie.

]]> By: Dan http://security.blogoverflow.com/2012/04/tor-exploiting-the-weakest-link/#comment-2536 Sat, 12 May 2012 05:19:15 +0000 http://security.blogoverflow.com/?p=613#comment-2536 “if you do not explicitly state https for the facebook login page, your password and username is sent PLAIN TEXT over the internet.”

Are you sure about that?

“<form id="login_form" action="https://www.facebook.com/login.php?login_attempt=1"&quot;

]]> By: Lucas Kauffman http://security.blogoverflow.com/2012/04/tor-exploiting-the-weakest-link/#comment-982 Wed, 11 Apr 2012 08:28:19 +0000 http://security.blogoverflow.com/?p=613#comment-982 We had a lot of facebook traffic coming by, I think that it covered about 40% of all requests we did (we counted them but I do not have the number anymore). Some of it was indeed https, but still a lot was just plain http. I do not know why the https anywhere plugin didn’t work. We didn’t modify anything special on the exit node. You can always have a got at it yourself all the commands are displayed in the video.

]]> By: CodeInChaos http://security.blogoverflow.com/2012/04/tor-exploiting-the-weakest-link/#comment-980 Tue, 10 Apr 2012 20:42:45 +0000 http://security.blogoverflow.com/?p=613#comment-980 TOR Browser contains the https anywhere plugin, so I’m a bit surprised by your facebook numbers.

Simple sniffing of connections is one of the most obvious issues with using TOR, and is relatively simple to mitigate.

I’m more afraid of rogue exit points linking visits to multiple sites. Preventing this requires a lot of discipline by the user, or significantly improving software(both the browser and TOR) and possibly even protocols.

]]>