opened https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41115
On 8/23/22 16:01, elise.toradin@web.de wrote:
Hi, sadly I noticed that OCSP (security.OCSP.enabled) is still enabled in the latest TBB, I hope you are all aware that this data is sent unencrypted and can be used by CA's to track users. OCSP Stapling has been a common feature of web servers since 2017, so I suppose we should rely on that instead? Firefox is configured to use OCSP Stabling by default, but I still see an unencrypted OCSP connection for every https:// connection. security.ssl.enable_ocsp_stapling = true security.ssl.enable_ocsp_must_staple = true
security.OCSP.enabled = 0 Best Regards, Elise
tbb-dev mailing list tbb-dev@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tbb-dev