Show Posts
991
Silk Road discussion / Re: Security warning and advisory
« on: August 06, 2013, 04:35 am »"The exploit attacked a vulnerability in the Windows version of the Firefox Extended Support Release 17 browser—the one used previously in the Tor Project's Tor Browser Bundle (TBB). That vulnerability had been patched by Mozilla in June, and the updated browser is now part of TBB. But the TBB configuration of Firefox doesn't include automatic security updates, so users of the bundle would not have been protected if they had not recently upgraded."
To anyone who attempted to visit Tormail.org since this all went down, as long as your browser is up to date, then you're good. Those of you who don't pay attention and don't keep up on their updates... if you visited Tormail.org in the last 5-6 days, good fucking luck. O_O
THANK YOU! Didn't see your post as I was posting myself. I believe that what you're saying is that if everytime I've logged into TOR and saw that there was a security update.. and immediately updated (which I have always done)... then no worries?
Correct. No worries if you're running the very latest version of Tor, and you accidentally 'visited' Tormail since this all went down. But I would still be concerned if you were openly communicating with people about drug deals, etc. via their service.
One thing worth quoting from Tormail.org, which no one seems to have mentioned:
"Tor Mail consists of several servers, a Tor hidden service, and an incoming and outgoing internet facing mail servers.
These internet facing mail servers are relays, they relay mail in and out of the Tor network, the relays are purchased anonymously and not tracable to us.
The only thing stored on the hard drive of those servers is the Exim mail server, and the Tor software.
No emails or logs or anything important are stored on those servers, thus it doesn't matter if they are seized or shut down.
We are prepared to quickly replace any relay that is taken offline for any reason."
I was reading this myself earlier and was hoping the Feds do not have access to the emails themselves, be very interested to find out the actual state of play re this.
