2

Why aren’t the cache files deleted when Tor is closed, and could they be used to help trace where Tor had been connected to?

There’s a bunch of 'em!

cached-certs
cached-descriptors
cached-descriptors.new
cached-microdesc-consensus
cached-microdescs
cached-microdescs.new

I read about the cached data here.
It’s gibberish to me, but doesn’t seem to address the security question.

Improve this question
1
  • 1
    It's directory information. It wouldn't be useful for such purposes.
    – cacahuatl
    Commented Jan 10, 2017 at 17:36

1 Answer 1

Reset to default
1

It's a "hints for future" for your Tor node: these files will speed-up it's reintegration into network when restarted and some possible malicious node attacks - generally based on MitM techniques - can be prevented, i.e. it's maintaining a "known certificates and keys list". There's nothing bad in deleting them, but nothing good either: 10-20Mbytes on disk, rarely accessed - it's not so expensive nowdays to just have it "for good"

Improve this answer
5
  • 1
    I was only concerned with security. The amount of space consumed isn’t even worth mentioning. As long as they don’t leave a trail I don’t care. I really didn’t think the development team would have been so sloppy as to leave a security risk that that, but I had to ask.
    – Demented Old Circus Monkey
    Commented Jan 12, 2017 at 0:20
  • There's no security risks in deleting these files, you don't have to worry. Even more - no connection/circuit related information is cached in any form in any file
    – Alexey Vesnin ♦
    Commented Jan 12, 2017 at 1:08
  • Of course there’s no risk in deleting the files - that was never a concern. The question was about leaving them in place and the information they contain. After deleting the files then opening Tor to re-create them, there are hundreds of keys/certificates/whatever in the cache files. cached-descriptors.new even contains an IP address from Germany. There appear to be a lot of identifying names in cached-microdesc-consensus. Names like agentsmith, KDFrelayPorterRanch, thebigpenistorrelay, FordModelA, Frijtzwithketchup and on and on...
    – Demented Old Circus Monkey
    Commented Jan 13, 2017 at 2:46
  • There are thousands of connection names and IP addresses with ports listed in the file. spacebeans 84.48.199.78 9049 9030, raspberrypi45 91.224.157.99 9001 9030, oscar 158.69.207.216 9001, DoctorBigCock 176.10.215.164 9090, earthling 80.73.242.142 443 80, Hypocrazy 83.247.78.90 9001 9030 etc. etc. etc. That appears to be a serious security violation.
    – Demented Old Circus Monkey
    Commented Jan 13, 2017 at 2:57
  • if you're concerned about even keeping an ip/cert/key lists - use tmpfs for your cache files, then after a poweroff it will be no physical trace of them
    – Alexey Vesnin ♦
    Commented Jan 13, 2017 at 3:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .