Circuit Display in Tor Browser being Refactored Upstream

[nyxnor]

@JeremyRand

Just to make sure I understand the threat model: the security issue with this is that we don’t want one application to be able to inject streams into another application’s circuits, right? Or is there some other reason why this is a problem?

As far as I know, the SOCKS credentials do not have the purpose of authentication, although may seem like it, it is only useful for Applications/Clients to follow along their streams, such as Tor Browser Bundle Tabs, where each tab has a circuit.
About ‘inject’:

• It can’t manipulate the stream as REDIRECTSTREAM is filtered
• It will reuse the circuit as the SOCKS credentials are the same, meaning it can confuse the client.
  The SOCKS_USERNAME in the case of TBB is the host the stream is targeted to, so even if trying to not show the host, it will be shown.

As of know, as it is blocked the WS can still try to find every site it is trying to reach, but I prefer not to be the GW to show that information.

@JeremyRand

That issue in particular is already on my radar for fixing due to also affecting Namecoin. However, since this issue does not affect Tails, I don’t think it should block work from being done, since if we can get this working properly on Tails, that’s still a benefit, and we can worry about supporting Whonix afterward.

See onion-grater development - #58 by nyxnor
And yes, it is not a blocker, just mentioning.

@JeremyRand

1. If the circuit details are not available via control port, detect that case and hide the entire circuit display. (Basically the same as the status quo before Torbutton was removed.)

Preferred by me.

@JeremyRand

3. Same as (2), but also support an environment variable to disable even attempting to read the circuit details.

Also good but without the item 2.

@JeremyRand

4. Same as (3), but request+show exit relay details if available. Testing the UX on this can be done before the Arti transition, but doing it securely in production will be blocked by the Arti transition.

That is not something the browser knows via external means, such as using an IP checker, rather it tries the tor control method.