diff options
| author | Peter Todd <pete@petertodd.org> | 2015-08-18 19:25:29 -0700 |
|---|---|---|
| committer | bitcoindev <bitcoindev@gnusha.org> | 2015-08-19 02:25:41 +0000 |
| commit | ae5a664605e6ffac5b54e207d0d05c7dca3af44b (patch) | |
| tree | 9b6fe7c48de0c97f98e10ce6d0a4aa17a0fad4d2 /ac | |
| parent | c7220786f4f6b65634cb82ebc681197844c01509 (diff) | |
| download | pi-bitcoindev-ae5a664605e6ffac5b54e207d0d05c7dca3af44b.tar.gz pi-bitcoindev-ae5a664605e6ffac5b54e207d0d05c7dca3af44b.zip | |
Re: [bitcoin-dev] Bitcoin XTs Tor IP blacklist downloading system has significant privacy leaks.
Diffstat (limited to 'ac')
| -rw-r--r-- | ac/0b7527f2a73fd4656e1b539d8508cf97494491 | 122 |
1 files changed, 122 insertions, 0 deletions
diff --git a/ac/0b7527f2a73fd4656e1b539d8508cf97494491 b/ac/0b7527f2a73fd4656e1b539d8508cf97494491 new file mode 100644 index 000000000..0bc7f1e28 --- /dev/null +++ b/ac/0b7527f2a73fd4656e1b539d8508cf97494491 @@ -0,0 +1,122 @@ +Return-Path: <pete@petertodd.org> +Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org + [172.17.192.35]) + by mail.linuxfoundation.org (Postfix) with ESMTPS id 10496FF + for <bitcoin-dev@lists.linuxfoundation.org>; + Wed, 19 Aug 2015 02:25:41 +0000 (UTC) +X-Greylist: from auto-whitelisted by SQLgrey-1.7.6 +Received: from outmail149075.authsmtp.net (outmail149075.authsmtp.net + [62.13.149.75]) + by smtp1.linuxfoundation.org (Postfix) with ESMTP id 17662102 + for <bitcoin-dev@lists.linuxfoundation.org>; + Wed, 19 Aug 2015 02:25:39 +0000 (UTC) +Received: from mail-c237.authsmtp.com (mail-c237.authsmtp.com [62.13.128.237]) + by punt16.authsmtp.com (8.14.2/8.14.2/) with ESMTP id t7J2Pbwh027580; + Wed, 19 Aug 2015 03:25:37 +0100 (BST) +Received: from muck ([24.114.40.22]) (authenticated bits=128) + by mail.authsmtp.com (8.14.2/8.14.2/) with ESMTP id t7J2PUP9007104 + (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO); + Wed, 19 Aug 2015 03:25:35 +0100 (BST) +Date: Tue, 18 Aug 2015 19:25:29 -0700 +From: Peter Todd <pete@petertodd.org> +To: Christophe Biocca <christophe.biocca@gmail.com>, + bitcoin-dev@lists.linuxfoundation.org +Message-ID: <20150819022528.GA8920@muck> +References: <CANOOu=_8BA1REkjRA3OUU_UEk6iOkQDW7=C8bEByAFGF4KHrbg@mail.gmail.com> + <20150819013645.GC2835@muck> +MIME-Version: 1.0 +Content-Type: multipart/signed; micalg=pgp-sha256; + protocol="application/pgp-signature"; boundary="cWoXeonUoKmBZSoM" +Content-Disposition: inline +In-Reply-To: <20150819013645.GC2835@muck> +X-Server-Quench: 93b7f474-4619-11e5-9f75-002590a135d3 +X-AuthReport-Spam: If SPAM / abuse - report it at: + http://www.authsmtp.com/abuse +X-AuthRoute: OCd2Yg0TA1ZNQRgX IjsJECJaVQIpKltL GxAVKBZePFsRUQkR + aAdMdwsUGUATAgsB AmMbW1deUlh7WmQ7 aQ5PbARZfE5OQQdo + T01BRU1TWkFvex5h Y34XUhl1dgVCNnhw Y0QsV3MJWxJ+ckJg + RkhVHHAHZDJldWlJ V0VFdwNWdQpKLx5G bwR8GhFYa3VsNCMk + FAgyOXU9MCtqYA5U XgoKLFRacXoQVgI7 XVgjJX0lGUQORCEy + NABuJlkDGkIWO0kz N1RpQkMDLxIXaEVe FloFGy5WIVgPRiEi + Cx8SRVQfDjRWUG9Y DxQrOVkg +X-Authentic-SMTP: 61633532353630.1024:706 +X-AuthFastPath: 0 (Was 255) +X-AuthSMTP-Origin: 24.114.40.22/587 +X-AuthVirus-Status: No virus detected - but ensure you scan with your own + anti-virus system. +X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_LOW + autolearn=ham version=3.3.1 +X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on + smtp1.linux-foundation.org +Subject: Re: [bitcoin-dev] Bitcoin XTs Tor IP blacklist downloading system + has significant privacy leaks. +X-BeenThere: bitcoin-dev@lists.linuxfoundation.org +X-Mailman-Version: 2.1.12 +Precedence: list +List-Id: Bitcoin Development Discussion <bitcoin-dev.lists.linuxfoundation.org> +List-Unsubscribe: <https://lists.linuxfoundation.org/mailman/options/bitcoin-dev>, + <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=unsubscribe> +List-Archive: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/> +List-Post: <mailto:bitcoin-dev@lists.linuxfoundation.org> +List-Help: <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=help> +List-Subscribe: <https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev>, + <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=subscribe> +X-List-Received-Date: Wed, 19 Aug 2015 02:25:41 -0000 + + +--cWoXeonUoKmBZSoM +Content-Type: text/plain; charset=us-ascii +Content-Disposition: inline +Content-Transfer-Encoding: quoted-printable + +On Tue, Aug 18, 2015 at 06:36:45PM -0700, Peter Todd via bitcoin-dev wrote: +> is false. However, in the common scenario of a firewalled node, where +> the operator has neglected to explicitly set -listen=3D0, the code does +> still download the Tor exit node list, revealing the true location of +> the node. This is contrary to the previous behavior of not revealing any +> IP information in that configuration. +>=20 +> FWIW Gregory Maxwell removed the last "call home" feature in pull-req +> #5161, by replacing the previous calls to getmyip.com-type services with +> a local peer request. Similarly the DNS seeds use the DNS protocol +> specifically to avoid leaking IP address information. +>=20 +> tl;dr: Yes, Bitcoin XT has a privacy problem with the automatic Tor exit +> node list download. + +Oh, and I just checked, and Mike's original pull-req for the Tor +blacklist didn't include the proxy disable code; what's in master !=3D the +pull-req, so the OP may have been looking at the wrong code by accident. +(I personally noticed this issue in the pull-req and didn't realise it +hadn't been merged into master w/o modifications) + +https://github.com/mikehearn/bitcoinxt/commit/931a4d59a03c7e64d7d85ddfc07ae= +127533c7f28#diff-11780fa178b655146cb414161c635219R171 + +Kinda sloppy of Mike to be making changes in master that don't +correspond to the peer-reviewed pull-req code... + +--=20 +'peter'[:-1]@petertodd.org +00000000000000000402fe6fb9ad613c93e12bddfc6ec02a2bd92f002050594d + +--cWoXeonUoKmBZSoM +Content-Type: application/pgp-signature; name="signature.asc" +Content-Description: Digital signature + +-----BEGIN PGP SIGNATURE----- + +iQGrBAEBCACVBQJV0+kVXhSAAAAAABUAQGJsb2NraGFzaEBiaXRjb2luLm9yZzAw +MDAwMDAwMDAwMDAwMDAwNDAyZmU2ZmI5YWQ2MTNjOTNlMTJiZGRmYzZlYzAyYTJi +ZDkyZjAwMjA1MDU5NGQvFIAAAAAAFQARcGthLWFkZHJlc3NAZ251cGcub3JncGV0 +ZUBwZXRlcnRvZC5vcmcACgkQwIXyHOf0udwTLgf9EnxkLol89I5uK5VP59k8gITY +47oFlgGfbyenlvoBKPBHlzcTtpsEZDbvArIFHDtf/7/VvTPvjnrhW/LTq7Bk/TZ+ +Bb1urV/kVoGzsXqltjlcCRV5d7t0v9XconCHZA7xk2m4xQscGbfgy7q4/rcWjwNJ +BzeFv41xRSFG+f6rOa10Kw8+R/M+UBJgXguZV+FFdauE/7pfFL1+yqJ2iggFMffV ++bEzqrAdYK307syFhHxRa7rgIG6qYnObcyd5PJcPwgptzq/DLq0u3L0NndTfFsF7 +QnPpLNhjdZ7z4uv4A7lGJkrhh6rAJcdwXbBsYqDvluoxMdI0wVXA0m+d/u7W+A== +=GiCr +-----END PGP SIGNATURE----- + +--cWoXeonUoKmBZSoM-- + |