0

After reading about Tor's authentication mechanisms based on cookies:

it looks to me that if an adversory has access to /home/atagar/.tor/control_auth_cookie file, then the adversory can authenticate to Tor control. Is that correct? Am I missing something?

Thanks!

PS: That being said, in what environment would you use cookie authentication and where would you use safe-cookie authentication?

0

it looks to me that if an adversory has access to /home/atagar/.tor/control_auth_cookie file, then the adversory can authenticate to Tor control. Is that correct? Am I missing something?

Yes, if an adversary has access to the cookie file, they can authenticate with Tor's control port. This file won't always be located at that path, and on Debian-based distros the system-default data directory is /var/lib/tor which is only accessible to the debian-tor. You can also specify a different path with the CookieAuthFile option.

PS: That being said, in what environment would you use cookie authentication and where would you use safe-cookie authentication?

Basic cookie authentication is unsafe and deprecated (see section 5.1 of the control spec document), and may be removed from tor in the future. You should use the safe cookie authentication method.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.