Re: Re: [tor-dev] [Proposal] A simple way to make Tor-Browser-Bundle more portable and secure

[Szabolcs Nagy <nsz@port70.net>]

* Tom Ritter <tom@ritter.vg> [2016-10-29 09:39:54 -0500]:
> On May 9, 2016 9:15 AM, "Daniel Simon" <ddanielsimonn@gmail.com> wrote:
> > How it's currently done - The Tor Browser Bundle is dynamically linked
> > against glibc.
> >
> > Security problem - The Tor Browser Bundle has the risk of information
> > about the host system's library ecosystem leaking out onto the
> > network.
> 
> So I'm not a libc expert, would you be willing to unpack this for me and
> explain what sorts of data can leak and how? It seems to me that it would
> require some high amount of attacker control - control of arguments to
> functions, inspecting memory layout, or code execution...
> 

if one rebuilds tor from source then there is a chance that
the final binary has subtly different behaviour than the
official tor bundle which may be observable via network
communication allowing the identification of the user, which
may break anonymity guarantees, simply because different
toolchain is used.

the same reasoning applies to different underlying hardware
or kernel or indeed library dependencies that may vary among
users (e.g. javascript Math.sin may call libc sin and different
versions of glibc have different precision result).

i don't know how much of this is a concern for the tor
project and it is hard to tell how much static linking
would improve things for linux users as the os can probably
be fingerprinted anyway.