![]() Rationale: These cipher suites, which have assigned values Implementations SHOULD NOT negotiate cipher suites based on RSA Such cipher suites should be evaluated according to their Than their nominal key length (112 bits in the case of 3DES). (e.g., 168-bit 3DES) have an effective key length that is smaller O Implementations SHOULD NOT negotiate cipher suites that useĪlgorithms offering less than 128 bits of security. Specifically forbids the use of RC4 already.Ĭf. Rationale: The RC4 stream cipher has a variety of cryptographic O Implementations MUST NOT negotiate RC4 cipher suites. But unfortunately the their crypto library doesn't honor RFC7525 (May 2015) It just that someone recommended a secure messenger that uses golang and I thought golang doesn't use/support current ciphers and I was wrong it does use them. I looked at it from a user's perspective not from the point of go programmer (what I'm not). I like how it is done in CoyIM (in particular, they already implemented it), and would like to see something similar for TM. This is in proposal, AFAIK, but not yet implemented. The last, but not least, is the impossibility to use different tor chains for different tor accounts. Now imagine I must tell all this stuff to newbies who know nothing about XMPP or Tor before starting Tor Messenger. It results in error (surely, onion site is not valid for TLS certiciate), which I must manually overcome by clicking and adding it to exceptions (and do this every time I start TM). I chose "allow sending password unencrypted" and disabled OSCP in preferences, but still TM tries to establish TLS connection (usually, onion XMPP server has also DNS name and support for clearnet connections, so jid is " and server is "xxx.onion"). CoyIM did it even better: it recognizes that XMPP server has some onion name and use that automatically (the list is predefined with matches between names (DNS and onion) by CoyIM developers).Īnother headache is forceful TLS with onion services. ![]() In particular, option "username" is confusing, because actual username in XMPP is jid, not just nickname.There should be the single option "jabber id", and server must be taken from that by default (if option host is not set). I would like to see something similar for TM. The good way is CoyIM from SubgraphOS project: it is much easier to use. I believe all options must be on single page, so user should not list windows by pressing "next" 10 times and remember, where and what was written. It is especially hard with onion servers. The more options the user is required, the more probable he will type something wrong. I have experience to explain others (newbies) how to connect to onion XMPP (including registering the account) using tor messenger (TM). Bugzilla 1321641: Disable svg and mathml in content.Bugzilla 1321420: Add a pref to disable JavaScript in browser requests.Don't allow javascript: links in themes.Use the THUNDERBIRD_45_6_0_RELEASE tag on comm-esr45.Use the tor-browser-45.6.0esr-6.0-1-build1 tag on tor-browser.Please verify the fingerprint from the signing keys page on Tor Project's website. txt file containing hashes of the bundles is signed with the key 0xB01C8B006DA77FAA (fingerprint: E4AC D397 5427 A5BA 8450 A1BE B01C 8B00 6DA7 7FAA). ![]() At-risk users should not depend on it for their privacy and safety. The purpose of this release is to help test the application and provide feedback. Please note that Tor Messenger is still in beta. On installing and restarting, the update will be applied your account settings and OTR keys will be preserved. Tor Messenger 0.3.0b1 users will be automatically prompted to install the update (similar to Tor Browser). This release features important improvements to the stability and security of Instantbird. We are pleased to announce another public beta release of Tor Messenger.
0 Comments
Leave a Reply. |
Details
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |