Opened 2 years ago

Last modified 2 weeks ago

#17252 new enhancement

Confirm TLS session resumption/ID are isolated to the URL bar domain, and re-enable them

Reported by: gk Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: tbb-linkability, ff52-esr, tbb-performance, TorBrowserTeam201802
Cc: arthuredelstein Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

In #4099 we disabled both TLS session resumption and session IDs due to tracking risks. We should bind them to the URL bar domain instead if that is possible.

Child Tickets

Change History (9)

comment:2 Changed 15 months ago by gk

Keywords: ff52-esr added

That made it into ESR52 it seems. Let's check whether it is working as we want when we transtition to ESR52 and let's think about enabling both again then.

comment:3 Changed 4 months ago by arthuredelstein

Keywords: TorBrowserTeam201711 tbb-performance added
Summary: Isolate TLS session resumption/ID to the URL bar domainConfirm TLS session resumption/ID are isolated to the URL bar domain, and re-enable them

SSL session tickets and session IDs would be very nice to re-enable now if we can, given that every TLS handshake takes two round trips, a big performance penalty when using the tor network.

comment:4 Changed 4 months ago by arthuredelstein

Cc: arthuredelstein added

comment:5 Changed 4 months ago by arthuredelstein

I just noticed that the pref "security.enable_tls_session_tickets" was removed from Firefox in 2013: https://bugzilla.mozilla.org/show_bug.cgi?id=917049. So we can definitely remove that pref from browser/app/profile/000-tor-browser.js.

Fortunately, the pref we uplifted in 2014, "security.ssl.disable_session_identifiers" is still present in Firefox, and is designed to disable both session IDs and session tickets. The question remains whether we should remove this pref as well.

comment:6 Changed 3 months ago by gk

Moving tickets to December 2017

comment:7 Changed 3 months ago by gk

Keywords: TorBrowserTeam201712 added; TorBrowserTeam201711 removed

Moving tickets to December 2017, for realz.

comment:8 Changed 6 weeks ago by gk

Keywords: TorBrowserTeam201801 added; TorBrowserTeam201712 removed

Moving tickets to 2018.

comment:9 Changed 2 weeks ago by gk

Keywords: TorBrowserTeam201802 added; TorBrowserTeam201801 removed

Moving tickets to Feb

Note: See TracTickets for help on using tickets.