Re: How safe is Tor for logging into http (nont https) web sites

Re: How safe is Tor for logging into http (nont https) web sites
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 General Computer Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Re: How safe is Tor for logging into http (nont https) web sites Joan Battaglia 10-27-2007
Posted by Joan Battaglia on October 27, 2007, 5:16 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
On Sat, 27 Oct 2007 19:17:28 +0100, mark carter wrote:
>>> I would strongly urge you never to use Tor for login to your Bank account.
>>
>> I'm asking about my email account.
>> Given that using Tor to access http-based email accounts (eg
>> http://mail.yahoo.com) is KNOWN to be passing your password to the Tor
>> operator - the question was if using https-based email (eg
>> https://mail.google.com) provided any protection of the password from the
>> rogue Tor operator.
>> Does https protect the password from Tor - or not?

> I guess the next question, though, would be: could an exit node capture
> traffic destined for certificate authorities, and substitute its own
> fake certification?

Oh my. I don't know what this means but I guess should stop using Tor to
log into both my http://mail and my https://mail accounts. Thank you.

Is there _any_ way to log into web-based email securely without
compromising your password?

Posted by Nomen Nescio on October 27, 2007, 9:10 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Joan Battaglia wrote:

> On Sat, 27 Oct 2007 19:17:28 +0100, mark carter wrote:
> >>> I would strongly urge you never to use Tor for login to your Bank account.
> >>
> >> I'm asking about my email account.
> >> Given that using Tor to access http-based email accounts (eg
> >> http://mail.yahoo.com) is KNOWN to be passing your password to the Tor
> >> operator - the question was if using https-based email (eg
> >> https://mail.google.com) provided any protection of the password from the
> >> rogue Tor operator.
> >> Does https protect the password from Tor - or not?
>
> > I guess the next question, though, would be: could an exit node capture
> > traffic destined for certificate authorities, and substitute its own
> > fake certification?

No. Not unless some basic systems are completely broken.

>
> Oh my. I don't know what this means but I guess should stop using Tor to
> log into both my http://mail and my https://mail accounts. Thank you.

If you need to access those accounts anonymously you shouldn't. Your
mail provider will know your identity whether you use SSL or not.

>
> Is there _any_ way to log into web-based email securely without
> compromising your password?

Yes. SSL... with or without Tor. That's it's purpose.


Posted by Joan Battaglia on October 28, 2007, 12:15 am
If you were  Registered and logged in, you could reply and use other advanced thread options
On Sun, 28 Oct 2007 02:10:03 +0100 (CET), Nomen Nescio wrote:
> If you need to access those accounts anonymously you shouldn't. Your
> mail provider will know your identity whether you use SSL or not.

Oh my! I learn a lot here.

How does the mail provider KNOW my identity?

Here's what I do.

1. I log into http://mail.yahoo.com
2. I create a mail address and password
3. I access that mail address and password daily.

How does THAT give away my identity to my mail provider?

Please let me know what I'm doing wrong!

Posted by Ari on October 28, 2007, 2:35 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
On Sat, 27 Oct 2007 21:15:40 -0700, Joan Battaglia wrote:

> How does the mail provider KNOW my identity?
>
> Here's what I do.
>
> 1. I log into http://mail.yahoo.com
> 2. I create a mail address and password
> 3. I access that mail address and password daily.
>
> How does THAT give away my identity to my mail provider?

It doesn't. Yahoo would know your IP address which does *not*
authenticate *who YOU are* no matter how many Anonymous Nomen cretins
want to say it does. It simply says that some (perhaps unknown) computer
is using a particular ISP/Internet connection (which may geo-locate you
regionally).

They do not know with any certainty that Ari Silverstein (real name) or
"Joan Battaglia" (YNMMV lol) is the User. They lack that all important
biometric identifier (which is also not foolproof).

MOF, unless Yahoo was sitting in your office, had verified/authenticated
that you are Joan Battaglia, watched you keystroke by keystroke login,
with a complete trace that someone else didn't MITM phish to a fake
Yahoo site, then check their logs/realtime access, then on and on and on
and then what would you have?

A *high probability* that Joan Battaglia is logged into Joan Battaglia's
Yahoo account.

If you're zygotic, twin sister, Jane, passes the biometric identifier,
then there is a good chance you fucked them.
--
"You can't trust code that you did not totally create yourself"
Ken Thompson "Reflections on Trusting Trust"
http://www.acm.org/classics/sep95/

Posted by Anonymous on October 28, 2007, 7:04 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Ari wrote:

> On Sat, 27 Oct 2007 21:15:40 -0700, Joan Battaglia wrote:
>
> > How does the mail provider KNOW my identity?
> >
> > Here's what I do.
> >
> > 1. I log into http://mail.yahoo.com
> > 2. I create a mail address and password
> > 3. I access that mail address and password daily.
> >
> > How does THAT give away my identity to my mail provider?
>
> It doesn't. Yahoo would know your IP address which does *not*
> authenticate *who YOU are* no matter how many Anonymous Nomen cretins

Ari you're a real hoot. Out one side of your face you argue that
there's no such thing as anonymity or "security" because... well...
because of whatever black helicopter conspira-loon nonsense you're
spewing on any given day.

Out the other side of your face you're argue that someone who knows
your IP address really doesn't know who you are because Wilie Wonka's
evil Oompa Loompas might have snuck in your house and used your
computer under cloak of night without your permission or knowledge.

<laugh>

"Cant avoid being tracked, but IP addresses don't count."

Do you even have a definable position here, or is your mission in life
to be disagreeable no matter what's being said?

Never mind. Rhetorical question.


Similar ThreadsPosted
Re: How safe is Tor for logging into http (nont https) web sites October 26, 2007, 8:57 am
Re: How safe is Tor for logging into http (nont https) web sites October 27, 2007, 5:24 pm
Re: How safe is Tor for logging into http (nont https) web sites October 28, 2007, 10:06 am
Snort logging May 4, 2005, 4:52 am
snort file logging name December 18, 2004, 5:31 am
A question about firewall logging March 29, 2006, 7:42 am
How to keep sites from reading cookies? November 24, 2004, 6:37 am
ActiveX drive-by download Sites December 29, 2004, 1:01 pm
Determining which sites are blocked at the office February 10, 2005, 10:41 am
Yahoo sites hit by availability problems July 8, 2007, 3:46 pm

The site map in XML format XML site map

Contact Us | Privacy Policy