2

Just wondering if http://www.tcpcrypt.org/ would be useful to add? Also is there any work being done to replace/add encryption at the ODI level?

  • OSI Doh apparently I can't type non spell check :) Not being able to edit OP is bad, should have timer of 30 seconds or so. – Hueristic Jan 13 '16 at 22:25
  • This is not a forum. – SuperSluether Oct 10 '16 at 13:40
4

This isn't a good idea.

  1. TCPCrypt is, and I can't stress this enough, absolute trash.
    • It provides no protection against an active MITM attacker, it's not authenticated.
  2. The remote party too must support TCPCrypt, otherwise it won't work.
    • Any remote party could just use TLS or an onion service and gain greater protection than that offered by TCPCrypt.

Tor cannot magically add crypto to traffic after leaves the network, it absolutely must be the responsibility of applications sending data over Tor to apply appropriate levels of cryptography to their communications, there is no alternative.

  • "It provides no protection against an active MITM attacker, it's not authenticated." Idon't understand this, what does provide protection from an ACTIVE MITM??? Nothing that I know of. Doesn't this encrypt traffic after the connection is made? So if you already have a MITM your screwed anyway. But it should help from picking up a MITM after your connected right? – Hueristic Jul 13 '16 at 19:23
  • "nothing that I know of" only speaks to the limits of your knowledge :) – cacahuatl Jul 13 '16 at 19:35
  • I am Joe's utter disregard for your opinions. I gave two examples in my answer of systems that resist active MITM attackers. TCPCrypt does not verify the remote party is who they say they are, it performs an unauthenticated key exchange. – cacahuatl Jul 14 '16 at 22:18
  • I'm bored by this now. Try harder. – cacahuatl Jul 23 '16 at 17:57
  • 1
    Heuristic, this is not a forum. Why don't you go find an IRC channel to vent your misunderstanding. When you're done with that, Google how a MITM attack actually works. Also Google how StackExchange works. It's a professional question and answer site, not a forum to argue in the comments. – SuperSluether Oct 10 '16 at 13:45
1

No it does not. Tor makes your "request->destination" chain to be private, at the exit node traffic is released "as-is", no modifications

  • Thanks for the reply, would it be a bad idea for this to be bundled? It seems to me this should be spread yet today is the first time I've ever seen it. – Hueristic Jan 13 '16 at 23:56
  • @Hueristic it's a good idea, I'm currently workingo on a similar one for Tor, but for ability to physically set keys+algos+etc for node-to-node communications – Alexey Vesnin Jan 14 '16 at 0:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.