1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
|
Return-Path: <pete@petertodd.org>
Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org
[172.17.192.35])
by mail.linuxfoundation.org (Postfix) with ESMTPS id 10496FF
for <bitcoin-dev@lists.linuxfoundation.org>;
Wed, 19 Aug 2015 02:25:41 +0000 (UTC)
X-Greylist: from auto-whitelisted by SQLgrey-1.7.6
Received: from outmail149075.authsmtp.net (outmail149075.authsmtp.net
[62.13.149.75])
by smtp1.linuxfoundation.org (Postfix) with ESMTP id 17662102
for <bitcoin-dev@lists.linuxfoundation.org>;
Wed, 19 Aug 2015 02:25:39 +0000 (UTC)
Received: from mail-c237.authsmtp.com (mail-c237.authsmtp.com [62.13.128.237])
by punt16.authsmtp.com (8.14.2/8.14.2/) with ESMTP id t7J2Pbwh027580;
Wed, 19 Aug 2015 03:25:37 +0100 (BST)
Received: from muck ([24.114.40.22]) (authenticated bits=128)
by mail.authsmtp.com (8.14.2/8.14.2/) with ESMTP id t7J2PUP9007104
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO);
Wed, 19 Aug 2015 03:25:35 +0100 (BST)
Date: Tue, 18 Aug 2015 19:25:29 -0700
From: Peter Todd <pete@petertodd.org>
To: Christophe Biocca <christophe.biocca@gmail.com>,
bitcoin-dev@lists.linuxfoundation.org
Message-ID: <20150819022528.GA8920@muck>
References: <CANOOu=_8BA1REkjRA3OUU_UEk6iOkQDW7=C8bEByAFGF4KHrbg@mail.gmail.com>
<20150819013645.GC2835@muck>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
protocol="application/pgp-signature"; boundary="cWoXeonUoKmBZSoM"
Content-Disposition: inline
In-Reply-To: <20150819013645.GC2835@muck>
X-Server-Quench: 93b7f474-4619-11e5-9f75-002590a135d3
X-AuthReport-Spam: If SPAM / abuse - report it at:
http://www.authsmtp.com/abuse
X-AuthRoute: OCd2Yg0TA1ZNQRgX IjsJECJaVQIpKltL GxAVKBZePFsRUQkR
aAdMdwsUGUATAgsB AmMbW1deUlh7WmQ7 aQ5PbARZfE5OQQdo
T01BRU1TWkFvex5h Y34XUhl1dgVCNnhw Y0QsV3MJWxJ+ckJg
RkhVHHAHZDJldWlJ V0VFdwNWdQpKLx5G bwR8GhFYa3VsNCMk
FAgyOXU9MCtqYA5U XgoKLFRacXoQVgI7 XVgjJX0lGUQORCEy
NABuJlkDGkIWO0kz N1RpQkMDLxIXaEVe FloFGy5WIVgPRiEi
Cx8SRVQfDjRWUG9Y DxQrOVkg
X-Authentic-SMTP: 61633532353630.1024:706
X-AuthFastPath: 0 (Was 255)
X-AuthSMTP-Origin: 24.114.40.22/587
X-AuthVirus-Status: No virus detected - but ensure you scan with your own
anti-virus system.
X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_LOW
autolearn=ham version=3.3.1
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
smtp1.linux-foundation.org
Subject: Re: [bitcoin-dev] Bitcoin XTs Tor IP blacklist downloading system
has significant privacy leaks.
X-BeenThere: bitcoin-dev@lists.linuxfoundation.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Bitcoin Development Discussion <bitcoin-dev.lists.linuxfoundation.org>
List-Unsubscribe: <https://lists.linuxfoundation.org/mailman/options/bitcoin-dev>,
<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=unsubscribe>
List-Archive: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/>
List-Post: <mailto:bitcoin-dev@lists.linuxfoundation.org>
List-Help: <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=help>
List-Subscribe: <https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev>,
<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=subscribe>
X-List-Received-Date: Wed, 19 Aug 2015 02:25:41 -0000
--cWoXeonUoKmBZSoM
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Tue, Aug 18, 2015 at 06:36:45PM -0700, Peter Todd via bitcoin-dev wrote:
> is false. However, in the common scenario of a firewalled node, where
> the operator has neglected to explicitly set -listen=3D0, the code does
> still download the Tor exit node list, revealing the true location of
> the node. This is contrary to the previous behavior of not revealing any
> IP information in that configuration.
>=20
> FWIW Gregory Maxwell removed the last "call home" feature in pull-req
> #5161, by replacing the previous calls to getmyip.com-type services with
> a local peer request. Similarly the DNS seeds use the DNS protocol
> specifically to avoid leaking IP address information.
>=20
> tl;dr: Yes, Bitcoin XT has a privacy problem with the automatic Tor exit
> node list download.
Oh, and I just checked, and Mike's original pull-req for the Tor
blacklist didn't include the proxy disable code; what's in master !=3D the
pull-req, so the OP may have been looking at the wrong code by accident.
(I personally noticed this issue in the pull-req and didn't realise it
hadn't been merged into master w/o modifications)
https://github.com/mikehearn/bitcoinxt/commit/931a4d59a03c7e64d7d85ddfc07ae=
127533c7f28#diff-11780fa178b655146cb414161c635219R171
Kinda sloppy of Mike to be making changes in master that don't
correspond to the peer-reviewed pull-req code...
--=20
'peter'[:-1]@petertodd.org
00000000000000000402fe6fb9ad613c93e12bddfc6ec02a2bd92f002050594d
--cWoXeonUoKmBZSoM
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
-----BEGIN PGP SIGNATURE-----
iQGrBAEBCACVBQJV0+kVXhSAAAAAABUAQGJsb2NraGFzaEBiaXRjb2luLm9yZzAw
MDAwMDAwMDAwMDAwMDAwNDAyZmU2ZmI5YWQ2MTNjOTNlMTJiZGRmYzZlYzAyYTJi
ZDkyZjAwMjA1MDU5NGQvFIAAAAAAFQARcGthLWFkZHJlc3NAZ251cGcub3JncGV0
ZUBwZXRlcnRvZC5vcmcACgkQwIXyHOf0udwTLgf9EnxkLol89I5uK5VP59k8gITY
47oFlgGfbyenlvoBKPBHlzcTtpsEZDbvArIFHDtf/7/VvTPvjnrhW/LTq7Bk/TZ+
Bb1urV/kVoGzsXqltjlcCRV5d7t0v9XconCHZA7xk2m4xQscGbfgy7q4/rcWjwNJ
BzeFv41xRSFG+f6rOa10Kw8+R/M+UBJgXguZV+FFdauE/7pfFL1+yqJ2iggFMffV
+bEzqrAdYK307syFhHxRa7rgIG6qYnObcyd5PJcPwgptzq/DLq0u3L0NndTfFsF7
QnPpLNhjdZ7z4uv4A7lGJkrhh6rAJcdwXbBsYqDvluoxMdI0wVXA0m+d/u7W+A==
=GiCr
-----END PGP SIGNATURE-----
--cWoXeonUoKmBZSoM--
|
