6

I have found a security issue in Tor which allows for information leakage in certain scenarios. I went to report this to the Tor project, but found nothing more than a bug tracker, and no obvious documentation of a procedure to report significant security issues. Even web searches just led me back and forth between the bug tracker and Wikipedia, which is rather useless.

While I discovered that the issue I found is already in the bug tracker, it has been there for over a month with no apparent attention paid to it, and was not in any way marked as a security issue.

What is the best way to get Tor project members' attention for this issue? (And, in my case, to do so anonymously?)

  • I'd suggest emailing the tor-dev mailing list. – user194 Jan 23 '14 at 21:48
1

The Tor Project maintains several email accounts and mailing lists. The table at administrative lists shows the mailing list tor-security. So tor-security@lists.torproject.org is the contact address you're looking for.

There is a trac entry which discusses a documented way to report vulnerabilities (see #9186). It was discussed to create a OpenPGP key for the list tor-security, but as far as I see it there is none yet.

So when you want to report security issues you should send a private encrypted mail to Nick Mathewson, Andrea Shepard or Roger Dingledine using their GnuPG key.

  • Is there a public PGP key or something you can use to encrypt the email since you wouldn't want vulnerability information to be read by a middleman? – Garrett Fogerlie Jan 25 '14 at 13:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.