One more TBB design doc update..
Mike Perry commited on 2015-05-07 00:32:08
Zeige 1 geänderte Dateien mit 30 Einfügungen und 20 Löschungen.
- projects/torbrowser/design/index.html.en c017f4ed8..9ba583d28
| ... | ... |
@@ -1,5 +1,5 @@ |
| 1 | 1 |
<?xml version="1.0" encoding="UTF-8"?> |
| 2 |
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>The Design and Implementation of the Tor Browser [DRAFT]</title><meta name="generator" content="DocBook XSL Stylesheets V1.78.1" /></head><body><div class="article"><div class="titlepage"><div><div><h2 class="title"><a id="design"></a>The Design and Implementation of the Tor Browser [DRAFT]</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Mike</span> <span class="surname">Perry</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:mikeperry#torproject org">mikeperry#torproject org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Erinn</span> <span class="surname">Clark</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:erinn#torproject org">erinn#torproject org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Steven</span> <span class="surname">Murdoch</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:sjmurdoch#torproject org">sjmurdoch#torproject org</a>></code></p></div></div></div></div><div><p class="pubdate">May 6th, 2015</p></div></div><hr /></div><div class="toc"><p><strong>Table of Contents</strong></p><dl class="toc"><dt><span class="sect1"><a href="#idp69131840">1. Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="#components">1.1. Browser Component Overview</a></span></dt></dl></dd><dt><span class="sect1"><a href="#DesignRequirements">2. Design Requirements and Philosophy</a></span></dt><dd><dl><dt><span class="sect2"><a href="#security">2.1. Security Requirements</a></span></dt><dt><span class="sect2"><a href="#privacy">2.2. Privacy Requirements</a></span></dt><dt><span class="sect2"><a href="#philosophy">2.3. Philosophy</a></span></dt></dl></dd><dt><span class="sect1"><a href="#adversary">3. Adversary Model</a></span></dt><dd><dl><dt><span class="sect2"><a href="#adversary-goals">3.1. Adversary Goals</a></span></dt><dt><span class="sect2"><a href="#adversary-positioning">3.2. Adversary Capabilities - Positioning</a></span></dt><dt><span class="sect2"><a href="#attacks">3.3. Adversary Capabilities - Attacks</a></span></dt></dl></dd><dt><span class="sect1"><a href="#Implementation">4. Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="#proxy-obedience">4.1. Proxy Obedience</a></span></dt><dt><span class="sect2"><a href="#state-separation">4.2. State Separation</a></span></dt><dt><span class="sect2"><a href="#disk-avoidance">4.3. Disk Avoidance</a></span></dt><dt><span class="sect2"><a href="#app-data-isolation">4.4. Application Data Isolation</a></span></dt><dt><span class="sect2"><a href="#identifier-linkability">4.5. Cross-Origin Identifier Unlinkability</a></span></dt><dt><span class="sect2"><a href="#fingerprinting-linkability">4.6. Cross-Origin Fingerprinting Unlinkability</a></span></dt><dt><span class="sect2"><a href="#new-identity">4.7. Long-Term Unlinkability via "New Identity" button</a></span></dt><dt><span class="sect2"><a href="#other-security">4.8. Other Security Measures</a></span></dt></dl></dd><dt><span class="sect1"><a href="#BuildSecurity">5. Build Security and Package Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="#idp70162016">5.1. Achieving Binary Reproducibility</a></span></dt><dt><span class="sect2"><a href="#idp70184144">5.2. Package Signatures and Verification</a></span></dt><dt><span class="sect2"><a href="#idp70188672">5.3. Anonymous Verification</a></span></dt><dt><span class="sect2"><a href="#update-safety">5.4. Update Safety</a></span></dt></dl></dd><dt><span class="appendix"><a href="#Transparency">A. Towards Transparency in Navigation Tracking</a></span></dt><dd><dl><dt><span class="sect1"><a href="#deprecate">A.1. Deprecation Wishlist</a></span></dt><dt><span class="sect1"><a href="#idp70225312">A.2. Promising Standards</a></span></dt></dl></dd></dl></div><div class="sect1"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="idp69131840"></a>1. Introduction</h2></div></div></div><p> |
|
| 2 |
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>The Design and Implementation of the Tor Browser [DRAFT]</title><meta name="generator" content="DocBook XSL Stylesheets V1.78.1" /></head><body><div class="article"><div class="titlepage"><div><div><h2 class="title"><a id="design"></a>The Design and Implementation of the Tor Browser [DRAFT]</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Mike</span> <span class="surname">Perry</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:mikeperry#torproject org">mikeperry#torproject org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Erinn</span> <span class="surname">Clark</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:erinn#torproject org">erinn#torproject org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Steven</span> <span class="surname">Murdoch</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:sjmurdoch#torproject org">sjmurdoch#torproject org</a>></code></p></div></div></div></div><div><p class="pubdate">May 6th, 2015</p></div></div><hr /></div><div class="toc"><p><strong>Table of Contents</strong></p><dl class="toc"><dt><span class="sect1"><a href="#idp53435264">1. Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="#components">1.1. Browser Component Overview</a></span></dt></dl></dd><dt><span class="sect1"><a href="#DesignRequirements">2. Design Requirements and Philosophy</a></span></dt><dd><dl><dt><span class="sect2"><a href="#security">2.1. Security Requirements</a></span></dt><dt><span class="sect2"><a href="#privacy">2.2. Privacy Requirements</a></span></dt><dt><span class="sect2"><a href="#philosophy">2.3. Philosophy</a></span></dt></dl></dd><dt><span class="sect1"><a href="#adversary">3. Adversary Model</a></span></dt><dd><dl><dt><span class="sect2"><a href="#adversary-goals">3.1. Adversary Goals</a></span></dt><dt><span class="sect2"><a href="#adversary-positioning">3.2. Adversary Capabilities - Positioning</a></span></dt><dt><span class="sect2"><a href="#attacks">3.3. Adversary Capabilities - Attacks</a></span></dt></dl></dd><dt><span class="sect1"><a href="#Implementation">4. Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="#proxy-obedience">4.1. Proxy Obedience</a></span></dt><dt><span class="sect2"><a href="#state-separation">4.2. State Separation</a></span></dt><dt><span class="sect2"><a href="#disk-avoidance">4.3. Disk Avoidance</a></span></dt><dt><span class="sect2"><a href="#app-data-isolation">4.4. Application Data Isolation</a></span></dt><dt><span class="sect2"><a href="#identifier-linkability">4.5. Cross-Origin Identifier Unlinkability</a></span></dt><dt><span class="sect2"><a href="#fingerprinting-linkability">4.6. Cross-Origin Fingerprinting Unlinkability</a></span></dt><dt><span class="sect2"><a href="#new-identity">4.7. Long-Term Unlinkability via "New Identity" button</a></span></dt><dt><span class="sect2"><a href="#other-security">4.8. Other Security Measures</a></span></dt></dl></dd><dt><span class="sect1"><a href="#BuildSecurity">5. Build Security and Package Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="#idp55327360">5.1. Achieving Binary Reproducibility</a></span></dt><dt><span class="sect2"><a href="#idp55349120">5.2. Package Signatures and Verification</a></span></dt><dt><span class="sect2"><a href="#idp55353648">5.3. Anonymous Verification</a></span></dt><dt><span class="sect2"><a href="#update-safety">5.4. Update Safety</a></span></dt></dl></dd><dt><span class="appendix"><a href="#Transparency">A. Towards Transparency in Navigation Tracking</a></span></dt><dd><dl><dt><span class="sect1"><a href="#deprecate">A.1. Deprecation Wishlist</a></span></dt><dt><span class="sect1"><a href="#idp55389664">A.2. Promising Standards</a></span></dt></dl></dd></dl></div><div class="sect1"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="idp53435264"></a>1. Introduction</h2></div></div></div><p> |
|
| 3 | 3 |
|
| 4 | 4 |
This document describes the <a class="link" href="#adversary" title="3. Adversary Model">adversary model</a>, |
| 5 | 5 |
<a class="link" href="#DesignRequirements" title="2. Design Requirements and Philosophy">design requirements</a>, and <a class="link" href="#Implementation" title="4. Implementation">implementation</a> of the Tor Browser. It is current as of Tor Browser |
| ... | ... |
@@ -655,13 +655,13 @@ system-wide extensions (through the use of |
| 655 | 655 |
disabled, which prevents Flash cookies from leaking from a pre-existing Flash |
| 656 | 656 |
directory. |
| 657 | 657 |
|
| 658 |
- </p></div><div class="sect2"><div class="titlepage"><div><div><h3 class="title"><a id="disk-avoidance"></a>4.3. Disk Avoidance</h3></div></div></div><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp66184288"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> |
|
| 658 |
+ </p></div><div class="sect2"><div class="titlepage"><div><div><h3 class="title"><a id="disk-avoidance"></a>4.3. Disk Avoidance</h3></div></div></div><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp55029872"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> |
|
| 659 | 659 |
|
| 660 | 660 |
The User Agent MUST (at user option) prevent all disk records of browser activity. |
| 661 | 661 |
The user should be able to optionally enable URL history and other history |
| 662 | 662 |
features if they so desire. |
| 663 | 663 |
|
| 664 |
- </blockquote></div></div><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp66185680"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> |
|
| 664 |
+ </blockquote></div></div><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp55031232"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> |
|
| 665 | 665 |
|
| 666 | 666 |
We achieve this goal through several mechanisms. First, we set the Firefox |
| 667 | 667 |
Private Browsing preference |
| ... | ... |
@@ -733,7 +733,7 @@ the URL bar origin for which browser state exists, possibly with a |
| 733 | 733 |
context-menu option to drill down into specific types of state or permissions. |
| 734 | 734 |
An example of this simplification can be seen in Figure 1. |
| 735 | 735 |
|
| 736 |
- </p><div class="figure"><a id="idp66208640"></a><p class="title"><strong>Figure 1. Improving the Privacy UI</strong></p><div class="figure-contents"><div class="mediaobject" align="center"><img src="NewCookieManager.png" align="middle" alt="Improving the Privacy UI" /></div><div class="caption"><p></p> |
|
| 736 |
+ </p><div class="figure"><a id="idp55052928"></a><p class="title"><strong>Figure 1. Improving the Privacy UI</strong></p><div class="figure-contents"><div class="mediaobject" align="center"><img src="NewCookieManager.png" align="middle" alt="Improving the Privacy UI" /></div><div class="caption"><p></p> |
|
| 737 | 737 |
|
| 738 | 738 |
This example UI is a mock-up of how isolating identifiers to the URL bar |
| 739 | 739 |
origin can simplify the privacy UI for all data - not just cookies. Once |
| ... | ... |
@@ -741,7 +741,7 @@ browser identifiers and site permissions operate on a URL bar basis, the same |
| 741 | 741 |
privacy window can represent browsing history, DOM Storage, HTTP Auth, search |
| 742 | 742 |
form history, login values, and so on within a context menu for each site. |
| 743 | 743 |
|
| 744 |
-</div></div></div><br class="figure-break" /><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp69892352"></a>Identifier Unlinkability Defenses in the Tor Browser</h4></div></div></div><p> |
|
| 744 |
+</div></div></div><br class="figure-break" /><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp55056352"></a>Identifier Unlinkability Defenses in the Tor Browser</h4></div></div></div><p> |
|
| 745 | 745 |
|
| 746 | 746 |
Unfortunately, many aspects of browser state can serve as identifier storage, |
| 747 | 747 |
and no other browser vendor or standards body has invested the effort to |
| ... | ... |
@@ -1124,7 +1124,7 @@ narrow domain or use case, or when there are alternate ways of accomplishing |
| 1124 | 1124 |
the same task, these features and/or certain aspects of their functionality |
| 1125 | 1125 |
may be simply removed. |
| 1126 | 1126 |
|
| 1127 |
- </p></li></ol></div></div><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp69985904"></a>Strategies for Defense: Randomization versus Uniformity</h4></div></div></div><p> |
|
| 1127 |
+ </p></li></ol></div></div><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp55149888"></a>Strategies for Defense: Randomization versus Uniformity</h4></div></div></div><p> |
|
| 1128 | 1128 |
|
| 1129 | 1129 |
When applying a form of defense to a specific fingerprinting vector or source, |
| 1130 | 1130 |
there are two general strategies available: either the implementation for all |
| ... | ... |
@@ -1298,7 +1298,9 @@ these requests are still sent by Firefox to our SOCKS proxy (ie we set |
| 1298 | 1298 |
<span class="command"><strong>network.proxy.no_proxies_on</strong></span> to the empty string). The local |
| 1299 | 1299 |
Tor client then rejects them, since it is configured to proxy for internal IP |
| 1300 | 1300 |
addresses by default. Access to the local network is forbidden via the same |
| 1301 |
-mechanism. |
|
| 1301 |
+mechanism. We also disable the WebRTC API as mentioned previously, since even |
|
| 1302 |
+if it were usable over Tor, it still currently provides the local IP address |
|
| 1303 |
+and associated network information to websites. |
|
| 1302 | 1304 |
|
| 1303 | 1305 |
</p></li><li class="listitem"><span class="command"><strong>Invasive Authentication Mechanisms (NTLM and SPNEGO)</strong></span><p> |
| 1304 | 1306 |
|
| ... | ... |
@@ -1311,15 +1313,23 @@ them to reveal machine information and still fail silently prior to the |
| 1311 | 1313 |
password prompt, these authentication mechanisms should either be disabled, or |
| 1312 | 1314 |
placed behind a site permission before their use. We simply disable them. |
| 1313 | 1315 |
|
| 1314 |
- </p></li><li class="listitem"><span class="command"><strong>USB Device ID Enumeration</strong></span><p> |
|
| 1316 |
+ </p></li><li class="listitem"><span class="command"><strong>USB Device ID Enumeration via the GamePad API</strong></span><p> |
|
| 1315 | 1317 |
|
| 1316 | 1318 |
The <a class="ulink" href="https://developer.mozilla.org/en-US/docs/Web/Guide/API/Gamepad" target="_top">GamePad |
| 1317 | 1319 |
API</a> provides web pages with the <a class="ulink" href="https://dvcs.w3.org/hg/gamepad/raw-file/default/gamepad.html#widl-Gamepad-id" target="_top">USB |
| 1318 | 1320 |
device id, product id, and driver name</a> of all connected game |
| 1319 |
-controllers, as well as detailed information about their capabilities. This API |
|
| 1320 |
-should be behind a site permission in Private Browsing Modes, or should present a generic |
|
| 1321 |
-controller type (perhaps a two button controller that can be mapped to the keyboard) in all cases. |
|
| 1322 |
-We simply disable it via the pref <span class="command"><strong>dom.gamepad.enabled</strong></span>. |
|
| 1321 |
+controllers, as well as detailed information about their capabilities. |
|
| 1322 |
+ </p><p> |
|
| 1323 |
+ |
|
| 1324 |
+It's our opinion that this API needs to be completely redesigned to provide an |
|
| 1325 |
+abstract notion of a game controller rather than offloading all of the |
|
| 1326 |
+complexity associated with handling specific game controller models to web |
|
| 1327 |
+content authors. For systems without a game controller, a standard controller |
|
| 1328 |
+can be virtualized through the keyboard, which will serve to both improve |
|
| 1329 |
+usability by normalizing user interaction with different games, as well as |
|
| 1330 |
+eliminate fingerprinting vectors. Barring that, this API should be behind a |
|
| 1331 |
+site permission in Private Browsing Modes. For now though, we simply disable |
|
| 1332 |
+it via the pref <span class="command"><strong>dom.gamepad.enabled</strong></span>. |
|
| 1323 | 1333 |
|
| 1324 | 1334 |
</p></li><li class="listitem"><span class="command"><strong>Fonts</strong></span><p> |
| 1325 | 1335 |
|
| ... | ... |
@@ -1599,11 +1609,11 @@ In order to avoid long-term linkability, we provide a "New Identity" context |
| 1599 | 1609 |
menu option in Torbutton. This context menu option is active if Torbutton can |
| 1600 | 1610 |
read the environment variables $TOR_CONTROL_PASSWD and $TOR_CONTROL_PORT. |
| 1601 | 1611 |
|
| 1602 |
- </p><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp70103376"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> |
|
| 1612 |
+ </p><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp55268352"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> |
|
| 1603 | 1613 |
|
| 1604 | 1614 |
All linkable identifiers and browser state MUST be cleared by this feature. |
| 1605 | 1615 |
|
| 1606 |
- </blockquote></div></div><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp70104624"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> |
|
| 1616 |
+ </blockquote></div></div><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp55269600"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> |
|
| 1607 | 1617 |
|
| 1608 | 1618 |
First, Torbutton disables Javascript in all open tabs and windows by using |
| 1609 | 1619 |
both the <a class="ulink" href="https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsIDocShell#Attributes" target="_top">browser.docShell.allowJavascript</a> |
| ... | ... |
@@ -1702,7 +1712,7 @@ images (<span class="command"><strong>svg.in-content.enabled</strong></span>). |
| 1702 | 1712 |
Fingerprinting</a> is a statistical attack to attempt to recognize specific |
| 1703 | 1713 |
encrypted website activity. |
| 1704 | 1714 |
|
| 1705 |
- </p><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp70138960"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> |
|
| 1715 |
+ </p><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp55303936"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> |
|
| 1706 | 1716 |
|
| 1707 | 1717 |
We want to deploy a mechanism that reduces the accuracy of <a class="ulink" href="https://en.wikipedia.org/wiki/Feature_selection" target="_top">useful features</a> available |
| 1708 | 1718 |
for classification. This mechanism would either impact the true and false |
| ... | ... |
@@ -1724,7 +1734,7 @@ Congestion-Sensitive BUFLO</a>. It may be also possible to <a class="ulink" href |
| 1724 | 1734 |
defenses</a> such that they only use existing spare Guard bandwidth capacity in the Tor |
| 1725 | 1735 |
network, making them also effectively no-overhead. |
| 1726 | 1736 |
|
| 1727 |
- </p></blockquote></div></div><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp70145856"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> |
|
| 1737 |
+ </p></blockquote></div></div><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp55310832"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> |
|
| 1728 | 1738 |
Currently, we patch Firefox to <a class="ulink" href="https://gitweb.torproject.org/tor-browser.git/commit/?h=tor-browser-31.6.0esr-4.5-1&id=20a59cec9886cf2575b1fd8e92b43e31ba053fbd" target="_top">randomize |
| 1729 | 1739 |
pipeline order and depth</a>. Unfortunately, pipelining is very fragile. |
| 1730 | 1740 |
Many sites do not support it, and even sites that advertise support for |
| ... | ... |
@@ -1789,7 +1799,7 @@ contend with. For this reason, we have deployed a build system |
| 1789 | 1799 |
that allows anyone to use our source code to reproduce byte-for-byte identical |
| 1790 | 1800 |
binary packages to the ones that we distribute. |
| 1791 | 1801 |
|
| 1792 |
- </p><div class="sect2"><div class="titlepage"><div><div><h3 class="title"><a id="idp70162016"></a>5.1. Achieving Binary Reproducibility</h3></div></div></div><p> |
|
| 1802 |
+ </p><div class="sect2"><div class="titlepage"><div><div><h3 class="title"><a id="idp55327360"></a>5.1. Achieving Binary Reproducibility</h3></div></div></div><p> |
|
| 1793 | 1803 |
|
| 1794 | 1804 |
The GNU toolchain has been working on providing reproducible builds for some |
| 1795 | 1805 |
time, however a large software project such as Firefox typically ends up |
| ... | ... |
@@ -1900,7 +1910,7 @@ but differs under LXC. We are also investigating currently |
| 1900 | 1910 |
<a class="ulink" href="https://trac.torproject.org/projects/tor/ticket/12240" target="_top">oddities related to |
| 1901 | 1911 |
time-based dependency tracking</a> that only appear in LXC containers. |
| 1902 | 1912 |
|
| 1903 |
- </p></li></ol></div></div><div class="sect2"><div class="titlepage"><div><div><h3 class="title"><a id="idp70184144"></a>5.2. Package Signatures and Verification</h3></div></div></div><p> |
|
| 1913 |
+ </p></li></ol></div></div><div class="sect2"><div class="titlepage"><div><div><h3 class="title"><a id="idp55349120"></a>5.2. Package Signatures and Verification</h3></div></div></div><p> |
|
| 1904 | 1914 |
|
| 1905 | 1915 |
The build process generates a single sha256sums.txt file that contains a sorted |
| 1906 | 1916 |
list of the SHA-256 hashes of every package produced for that build version. Each |
| ... | ... |
@@ -1933,7 +1943,7 @@ In order to verify package integrity, the signature must be stripped off using |
| 1933 | 1943 |
the osslsigncode tool, as described on the <a class="ulink" href="https://www.torproject.org/docs/verifying-signatures.html.en#BuildVerification" target="_top">Signature |
| 1934 | 1944 |
Verification</a> page. |
| 1935 | 1945 |
|
| 1936 |
- </p></div><div class="sect2"><div class="titlepage"><div><div><h3 class="title"><a id="idp70188672"></a>5.3. Anonymous Verification</h3></div></div></div><p> |
|
| 1946 |
+ </p></div><div class="sect2"><div class="titlepage"><div><div><h3 class="title"><a id="idp55353648"></a>5.3. Anonymous Verification</h3></div></div></div><p> |
|
| 1937 | 1947 |
|
| 1938 | 1948 |
Due to the fact that bit-identical packages can be produced by anyone, the |
| 1939 | 1949 |
security of this build system extends beyond the security of the official |
| ... | ... |
@@ -2062,7 +2072,7 @@ possible for us to <a class="ulink" href="https://trac.torproject.org/projects/t |
| 2062 | 2072 |
ourselves</a>, as they are comparatively rare and can be handled with site |
| 2063 | 2073 |
permissions. |
| 2064 | 2074 |
|
| 2065 |
- </p></li></ol></div></div><div class="sect1"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="idp70225312"></a>A.2. Promising Standards</h2></div></div></div><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><a class="ulink" href="http://web-send.org" target="_top">Web-Send Introducer</a><p> |
|
| 2075 |
+ </p></li></ol></div></div><div class="sect1"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="idp55389664"></a>A.2. Promising Standards</h2></div></div></div><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><a class="ulink" href="http://web-send.org" target="_top">Web-Send Introducer</a><p> |
|
| 2066 | 2076 |
|
| 2067 | 2077 |
Web-Send is a browser-based link sharing and federated login widget that is |
| 2068 | 2078 |
designed to operate without relying on third-party tracking or abusing other |
| 2069 | 2079 |