[tor-bugs] #6978 [Website]: Create Magnet links for download

[Tor Bug Tracker & Wiki]

#6978: Create Magnet links for download
-------------------------+--------------------------------------------------
 Reporter:  ioerror      |          Owner:     
     Type:  enhancement  |         Status:  new
 Priority:  normal       |      Milestone:     
Component:  Website      |        Version:     
 Keywords:               |         Parent:     
   Points:               |   Actualpoints:     
-------------------------+--------------------------------------------------
Changes (by proper):

 * cc: adrelanos@… (added)


Comment:

 > Do BitTorrent clients actually download it over HTTPS properly?

 I made a quick test to answer that question with
 [http://packages.debian.org/wheezy/transmission transmission] (and
 apache2, default-ssl, ssl snakeoil, tested https://127.0.0.1/testfile in
 browser and got an invalid certificate as expected). Then used "mktorrent
 --announce=http://announce.torrentsmd.com:6969/announce -w
 https://127.0.0.1/testfile ~/testfile".

 Result: It downloaded from HTTPS, but the invalid ssl certificate was
 ignored.

 Is this a problem?

 To my knowledge, Bittorrent clients do hash verification, they still and
 only use SHA-1. If SHA-1 is still considered safe enough is another topic.
 And if Bittorrent clients do hash verification well or can be tricked,
 would probable be a fine topic for research.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/6978#comment:13>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online