Silk Road forums
Discussion => Security => Topic started by: TA on September 18, 2013, 03:46 am
-
So the Tails website says the .20.1 update will be a minor bugfix only release. I thought it was going to incorporate Tor 2.4? Does anyone know anything about this?
-
You can download nightlies/experimental here: http://nightly.tails.boum.org/build_Tails_ISO_experimental/
They already include 2.4
Hah, I tried https:// over Tor and was promptly MITM attacked with a fake cert. Guess download these clearnet, or ask on their IRC channel if torrents are available for nightlies, probably are.
More info:
https://mailman.boum.org/pipermail/tails-dev/2013-September/003607.html
Note none of them are signed, so would exercise caution using this for critical secrets.
-
Dude, you are always on top of it. +1
So .20.1 wont have tor 2.4?
-
Hah, I tried https:// over Tor and was promptly MITM attacked with a fake cert. Guess download these clearnet, or ask on their IRC channel if torrents are available for nightlies, probably are.
It's not an MITM attack, just a self-signed certificate. You can verify by changing identities and seeing that it's the same certificate serial and fingerprints no matter which exit node you use.
-
Hah, I tried https:// over Tor and was promptly MITM attacked with a fake cert. Guess download these clearnet, or ask on their IRC channel if torrents are available for nightlies, probably are.
It's not an MITM attack, just a self-signed certificate. You can verify by changing identities and seeing that it's the same certificate serial and fingerprints no matter which exit node you use.
Over Tor, the self signed cert was issued to "boum.org" instead of the usual "*.boum.org" and SHA-1 fingerprint did not match. On clearnet for that same site the cert is issued to "www.lizard"
-
nightly.tails.boum.org is a different server (or IP address at least) from tails.boum.org. The cert that I get over Tor is also for www.lizard, serial numbers starts with 00:92:34.
You might have been MITMed, but it's still a self-signed cert for that server, which is the error most people will see. Weirdly, it asks for authorization over HTTPS but not over HTTP.
They should upload a PGP signature and then it wouldn't matter.
-
Which exit node injected a different cert? That should be reported.
-
Which exit node injected a different cert? That should be reported.
I'm interested too......if you were man in the middle'd immediately on your first attempt that is a fairly worrying piece of information
-
Still wondering if the update will have 2.4.............