Tor Browser 7.0a4 is released

dublinben wrote: post #3

libeclipse wrote: post #2

Could someone more knowledgeable than me comment on what Selfrando is, how it's useful, and how it works.

I recommend reading the linked blog post about it. [0] [0] https://blog.torproject.org/blog/selfrando-q-and-georg-koppe... There is also a research paper [1] and accompanying video [2]. [1] https://people.torproject.org/~gk/misc/Selfrando-Tor-Browser... [2] https://www.youtube.com/watch?v=IikpczzNyas

tl;dr seems to be a more advanced form of ASLR?

Re: Tor Browser 7.0a4 is released

#6

Post by notlambda » Tue, May 16, 2017, 6:27 PM UTC

TazeTSchnitzel wrote: post #5

dublinben wrote: post #3

Earlier quoted context omitted.

I recommend reading the linked blog post about it. [0] [0] https://blog.torproject.org/blog/selfrando-q-and-georg-koppe... There is also a research paper [1] and accompanying video [2]. [1] https://people.torproject.org/~gk/misc/Selfrando-Tor-Browser... [2] https://www.youtube.com/watch?v=IikpczzNyas

tl;dr seems to be a more advanced form of ASLR?

i think it's ASLR with more entropy by skimming through the paper, but most exploits have read primitives or infoleaks anyways so i don't see how more entropy affects them. If i am right it protects against attackers guessing the ASLR slide, but that's very unreliable and no FBI grade exploit should ever do that.

Re: Tor Browser 7.0a4 is released

#7

Post by libeclipse » Tue, May 16, 2017, 6:53 PM UTC

dublinben wrote: post #3

libeclipse wrote: post #2

Could someone more knowledgeable than me comment on what Selfrando is, how it's useful, and how it works.

I recommend reading the linked blog post about it. [0] [0] https://blog.torproject.org/blog/selfrando-q-and-georg-koppe... There is also a research paper [1] and accompanying video [2]. [1] https://people.torproject.org/~gk/misc/Selfrando-Tor-Browser... [2] https://www.youtube.com/watch?v=IikpczzNyas

That blog post is pretty much useless in terms of information, but that linked presentation is pretty informative. Cheers.

Re: Tor Browser 7.0a4 is released

#8

Post by jjawssd » Tue, May 16, 2017, 7:46 PM UTC

How do the Tor project developers continue the development of Tor without the interference and corruption efforts of state level actors?

Re: Tor Browser 7.0a4 is released

#9

Post by dataking » Tue, May 16, 2017, 7:55 PM UTC

libeclipse wrote: post #2

Could someone more knowledgeable than me comment on what Selfrando is, how it's useful, and how it works.

selfrando contributor here. it is correct that selfrando is intended as an improvement over ASLR by randomizing code at the function level (vs. module level). this improves resilience to information leaks somewhat, but with mitigations like these, there are no silver bullets.

selfrando github repo: https://github.com/immunant/selfrando feel free to open an issue or write us at team@immunant.com

cheers!

Re: Tor Browser 7.0a4 is released

#10

Post by beardog » Tue, May 16, 2017, 8:06 PM UTC

jjawssd wrote: post #8

How do the Tor project developers continue the development of Tor without the interference and corruption efforts of state level actors?

1. Tor is open source. Any backdoor attempts in the source would require careful hiding. Shutting down the Tor Project would just result in someone else picking it up.

2. The US Navy funded (maybe still does) Tor. Tor is useful for western allies & spies

3. Many of the developers live in western nations. While western nations like the US do have intel agencies who are interested in messing with Tor, it doesn't seem to have gotten to the point of shutting down the Tor Project or directly attacking their infrastructure much if at all, especially since Tor benefits the military as well.