[tor-talk] Stricter NEWNYM?

[anonym]

Hi,

While I've been developing the LiveCDs Incognito and Tails I've got my
fair share of feature requests/bug reports that really are about Tor.
One recurring feature request is to make NEWNYM stricter.

Users have observed that issuing a NEWNYM doesn't necessarily stop using
the previous circuits, which is obviously the case for truly long lived
connections like IRC and SSH, but I don't think that is what bothers
them; web browsing connections also keep using the old circtuits, at
least with certain web browser and intermediate proxy configurations
that makes them "kinda" long lived (think http keep-alive timeouts).
This confuses users when they get the same exit node after a NEWNYM (for
instance by refreshing check.torproject.org afterwards).

Conclusion: NEWNYM doesn't do what the users expect.

That's no good. Why don't we make NEWNYM ruthlessly kill all circuits,
even the ones handling live connections, long lived or not? I strongly
believe this stricter NEWNYM behaviour is (at least closer to) what the
user expects from it. See the attached patch for a quick and dirty
implementation -- a patch says more than a thousand words, I suppose.

Of course, to use NEWNYM requires some caution from the user, e.g.
clearing cookies, session id etc. if revisiting the same site, but that
also affects the old NEWNYM approach. Maybe it's even the case that
NEWNYM gives a false sense of a new identity, given all application
level problems that Tor cannot (or at least shouldn't) do anything
about, and thus we should give a shite? In any case, are there any new
problems introduced by this more brutal approach that I haven't thought
of which would make it worse than the previous one?

Cheers!
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: tor-stricter-newnym.patch
URL: <http://lists.torproject.org/pipermail/tor-talk/attachments/20110304/650f4300/attachment.asc>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: OpenPGP digital signature
URL: <http://lists.torproject.org/pipermail/tor-talk/attachments/20110304/650f4300/attachment.pgp>