[tor-dev] Grailo.net is live (but very young)

[Clay Graham]

Mike,

>I can't trust any javascript that your service sends to my browser over Tor,
because you don't use https.

Great feedback. We are installing the cert in the next couple of weeks,
there is a process for that, and the kind of cert we want takes a little
time and work. We are still looking for feedback during that period.

>How do I know that script came from your server and that it's not a
modified version which came from an exit node, which is going to report the
key back to them after it is generated?

This is one reason we would like to create a client side plugin for the TOR
browser. Any ideas how this would be done? I would also like some online
pointers about how the javascript client side encryption (we are using
cryptico https://github.com/wwwtyro/cryptico)  could be hijacked so we can
endeavor to thwart these exploits.

>HSTS should be used so browsers remember to use https, and you should
contact the Chromium project to get yourself on their list of pinned SSL
sites for first time visitors (which is also used in Firefox now I
believe), and is also used in the HTTPS-Everywhere project for rule
generation.

Wonderful! Thank you so much! All pointers and references are aprecciated!

Clay



On Sun, Dec 2, 2012 at 5:44 AM, <tor at lists.grepular.com> wrote:

> On 01/12/12 23:39, Clay Graham wrote:
>
> > You may remember an email from me about a week ago, and I could really
> > use some pointers.
> >
> > We just stealth launched an alpha version of http://grailo.net and I
> > would love all of you to try it out and give me feedback. Its 100% open
> > source, 100% free, and you can even fork the project yourself on github.
> >
> > Its goal: Create a simple to use client side, RSA public key encryption
> > for microblogging on the internet.
> >
> > The reason I am reaching out to you is I am I am interested in creating
> > a client side plugin for the TOR browser so that people can use the
> > client side encryption safely and privately, and without fear. Since
> > scripting is disabled in TOR, with good reason, I want a plugin that is
> > blessed by the TOR project as open and safe for encryption.
> >
> > Any leads on where to get started are greatly appreciated.
>
> I can't trust any javascript that your service sends to my browser over
> Tor, because you don't use https. That javascript on the signup page
> which generates your private key... How do I know that script came from
> your server and that it's not a modified version which came from an exit
> node, which is going to report the key back to them after it is generated?
>
> At a bare minimum, before I would even start considering using this
> service, every single resource that your site delivers should be sent
> over https, all http connections should be redirected to https. HSTS
> should be used so browsers remember to use https, and you should contact
> the Chromium project to get yourself on their list of pinned SSL sites
> for first time visitors (which is also used in Firefox now I believe),
> and is also used in the HTTPS-Everywhere project for rule generation.
>
> --
> Mike Cardwell  https://grepular.com/     http://cardwellit.com/
> OpenPGP Key    35BC AF1D 3AA2 1F84 3DC3  B0CF 70A5 F512 0018 461F
> XMPP OTR Key   8924 B06A 7917 AAF3 DBB1  BF1B 295C 3C78 3EF1 46B4
>
>
> _______________________________________________
> tor-dev mailing list
> tor-dev at lists.torproject.org
> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev
>
>


-- 
=================
Founder Welocally
http://welocally.com
helping local thrive
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.torproject.org/pipermail/tor-dev/attachments/20121202/ea31e0b2/attachment.html>