[tor-bugs] #5752 [Tor]: Isolate browser streams by url bar domain rather than by time interval

[Tor Bug Tracker & Wiki]

#5752: Isolate browser streams by url bar domain rather than by time interval
-------------------------+---------------------------------
     Reporter:  arma     |      Owner:
         Type:  project  |     Status:  new
     Priority:  normal   |  Milestone:  Tor: unspecified
    Component:  Tor      |    Version:
   Resolution:           |   Keywords:  SponsorZ tor-client
Actual Points:           |  Parent ID:
       Points:           |
-------------------------+---------------------------------

Comment (by mikeperry):

 George Danezis pointed out that there is currently a rather extreme
 vulnerability in Tor's path selection that we might want to try to fix as
 part of this. It turns out that if you make your exit allow a very rare
 port (like 25), you can cause clients to use that exit frequently by
 ensuring that content elements sourced from port 25 are injected. Once you
 get Tor to create a circuit for this port, it will currently keep using it
 for other connections on other ports that are allowed at that exit for at
 least 10 minutes. We should avoid this behavior if we can in the domain
 isolation implementation.

 One option might be to treat such rare port stream requests as their own
 isolation, which may or may not be what Tor does with SOCKS
 username+password right now (does anyone know?)

 FWIW: I think this attack might not actually work with port 25, because
 Firefox will refuse the load before Tor even gets the stream request due
 to port 25 being a banned port from the browser, but there may be other
 rare exit ports that can be abused for this purpose that Firefox will
 allow.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/5752#comment:9>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online