[tbb-dev] Data Leak: Disable old, unencrypted OCSP verification in TBB.

[Richard Pospesel]

opened https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41115

On 8/23/22 16:01, elise.toradin at web.de wrote:
> Hi, sadly I noticed that OCSP (security.OCSP.enabled) is still enabled in the latest TBB, I hope you 
> are all aware that this data is sent unencrypted and can be used by CA's to track users.
> OCSP Stapling has been a common feature of web servers since 2017, so I suppose we should rely on 
> that instead?
> Firefox is configured to use OCSP Stabling by default, but I still see an unencrypted OCSP 
> connection for every https:// connection.
> security.ssl.enable_ocsp_stapling 	= true
> security.ssl.enable_ocsp_must_staple 	= true
> 
>   security.OCSP.enabled = 0
> Best Regards,
> Elise
> 
> _______________________________________________
> tbb-dev mailing list
> tbb-dev at lists.torproject.org
> https://lists.torproject.org/cgi-bin/mailman/listinfo/tbb-dev
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0xDE47360363F34B2C.asc
Type: application/pgp-keys
Size: 5560 bytes
Desc: OpenPGP public key
URL: <http://lists.torproject.org/pipermail/tbb-dev/attachments/20220823/c67d5a18/attachment.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <http://lists.torproject.org/pipermail/tbb-dev/attachments/20220823/c67d5a18/attachment.sig>