diff options
| author | Nick Mathewson <nickm@torproject.org> | 2012-03-26 14:06:27 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2012-03-26 14:06:27 -0400 |
| commit | 9740f067c4bed47beb63483be4f4636167a04019 (patch) | |
| tree | bdff78d23690de3a7ceaa05261d2915a97223487 | |
| parent | 6dcbfec82d1a76cf19dd385b1b91841189c8c4ab (diff) | |
| download | tor-9740f067c4bed47beb63483be4f4636167a04019.tar.gz tor-9740f067c4bed47beb63483be4f4636167a04019.zip | |
Safe cookie authentication gets a changes file
| -rw-r--r-- | changes/safecookie | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/changes/safecookie b/changes/safecookie new file mode 100644 index 0000000000..fd7d7af2b0 --- /dev/null +++ b/changes/safecookie @@ -0,0 +1,9 @@ + o Security Features: + - Provide controllers with a safer way to implement the cookie + authentication mechanism. With the old method, if another locally + running program could convince a controller that it was the Tor + process, then that program could trick the contoller into + telling it the contents of an arbitrary 32-byte file. The new + "SAFECOOKIE" authentication method uses a challenge-response + approach to prevent this. Fixes bug 5185, implements proposal 193. + |