0

If I understand correctly Tor Browser's "new circuit" attaches new connections to a new circuit while letting old connections finish in the old circuit. It does not clear out cookies, so that domain-isolated user session persists across circuits (for that URL-bar domain).

But what happens to SSL session and DNS cache? Are they reset by "new circuit" or do they persist? Is there anything else that gets reset or that persists?

Furthermore, what happens on Tor Browser's side when the tor process itself changes the circuit on its own because it has become dirty? Does Tor Browser react to that in any way?

The reason for asking is that I'm trying to replicate Tor Browser's "new circuit" with libcurl as exactly as possible, so I'd be really grateful for any implementation details or pointers.

My current "new circuit" implementation retains only cookies while resetting DNS cache and SSL session. It lets existing transfers complete through the old circuit. It's also completely ignorant of the tor process itself resetting dirty circuits on its own, so in that case SSL session and DNS cache are not reset. How well does this match Tor Browser's implementation? Anything else I should be aware of?

Improve this question

1 Answer 1

Reset to default
-1

No, they are not reseted and you're pointing at the right thing! The maximal anonymity can not be achieved neither by using Tor Browser, nor by using Tails - as my research shows. There is a hardcore way that - actually - is available and easy to understand* for a regular user - it's a QubesOS. It's a Linux-based distribution focused on security via virtualization through Xen hypervisor - and you can make a very secure environment that fits your personal needs using it. For your question - you split the VM's for the browser and DNS server onboard, so no re-corellation attack vectors will be possible. You can not do it on Tails - unless you're nearly retweaking the whole distro by hand, but on QubesOS - it's some clicks away and really simple.

Improve this answer
4
  • 2
    I'm not sure how that relates to my question. I'm not asking how to reset SSL session and DNS cache on "new circuit". As I said, my implementation already does that currently and it's trivial to do that using libcurl. What I'm asking (among other things) is if Tor Browser does the same thing or not. I'm merely trying to replicate the current behavior of Tor Browser using libcurl. VMs, Tails, QubesOS, etc. are not related to my question at all.
    – user33390
    Commented Oct 9, 2021 at 17:16
  • OK, if you're replicating TB using cURL - then all you have to do to perform even better - just use a SOCKS proxy with a distinct and random user+password for every circuit/task you have
    – Alexey Vesnin ♦
    Commented Oct 9, 2021 at 18:40
  • 1
    No, merely using SOCKS creds is not enough to replicate TB at all. Just to give one example: TB switches circuit + user session on redirects to 3rd party domains. As a consequence you can't let libcurl use its internal redirect magic, you have to implement it yourself. My code already handles such details. My problem at this point is not really technical (yet), but simply a lack of knowledge about how TB behaves in certain situations, specifically what it does with DNS cache and SSL session in the case of new/dirty circuits. I just want to know what to do, not how to do it, that's all.
    – user33390
    Commented Oct 9, 2021 at 19:50
  • The sessions are cleared just like in a hardened ESR Firefox - TB is a hardened ESR Firefox with some tweaks. It's absolutely safe for letting cURL use it's redirect following magic using SOCKS5s auth and DNS for a dedicated circle. Actually, this will make things work right for you because at redirects you can't clear the data passed through automatically, so auto-privacy is impossible here. And breaking that will trigger the defense systems or just break the site functionality. Cookie jar and pipe preserved = OK
    – Alexey Vesnin ♦
    Commented Oct 19, 2021 at 19:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .