[tbb-bugs] #17252 [Applications/Tor Browser]: Confirm TLS session resumption/ID are isolated to the URL bar domain, and re-enable them

Tor Bug Tracker & Wiki blackhole at torproject.org
Fri Aug 10 19:55:49 UTC 2018

#17252: Confirm TLS session resumption/ID are isolated to the URL bar domain, and
re-enable them
 Reporter:  gk                                   |          Owner:  tbb-
                                                 |  team
     Type:  enhancement                          |         Status:  new
 Priority:  High                                 |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:  tbb-linkability, ff60-esr, tbb-      |  Actual Points:
  performance, TorBrowserTeam201808R             |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
Changes (by arthuredelstein):

 * keywords:  tbb-linkability, ff60-esr, tbb-performance,
     TorBrowserTeam201808 => tbb-linkability, ff60-esr, tbb-performance,


 Jonathan Hao at Mozilla implemented FPI (OriginAttribute isolation) of
 session identifiers and session tickets in https://hg.mozilla.org/mozilla-
 central/rev/9aba8184664d. That patch includes unit tests to show that
 isolation is effective when "privacy.firstparty.isolate" is enabled.

 I also reviewed the code to understand it better:

 Each session ticket or session identifier is stored in an instance of the
 same `sslSessionID` struct:

 `sslSessionID` instances are stored in the session cache, keyed by a
 `peerID` string:

 The security manager sets the `peerID` string to include OriginAttributes
 suffix from the socket:

 Therefore we can be confident that session tickets/identifiers are
 isolated by first party. So here's my patch for review:


Ticket URL: <https://trac.torproject.org/projects/tor/ticket/17252#comment:18>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online

More information about the tbb-bugs mailing list