[tor-bugs] #5761 [TorBrowserButton]: Decide if it's safe to pass the Dooble around the Tor Community

[Tor Bug Tracker & Wiki]

#5761: Decide if it's safe to pass the Dooble around the Tor Community
---------------------------------+------------------------------------------
    Reporter:  mike123           |       Owner:  mike123
        Type:  enhancement       |      Status:  closed 
    Priority:  normal            |   Milestone:         
   Component:  TorBrowserButton  |     Version:         
  Resolution:  invalid           |    Keywords:         
      Parent:                    |      Points:         
Actualpoints:                    |  
---------------------------------+------------------------------------------
Changes (by rransom):

  * status:  reopened => closed
  * resolution:  => invalid


Comment:

 Replying to [comment:29 textbrowser]:

 > Multiple passphrases? Not in Dooble. If the current passphrase is
 replaced, existing data is either re-encoded or discarded.

 Interesting.  Then there is no reason to put a hash of the current
 passphrase in every record.

 > Indeed, Dooble does use repetitive vectors. The cookie manager is not
 designed around encryption.

 The cookie-storage code is designed around a design flaw in Dooble's
 encryption -- it relies on the fact that each plaintext has only one
 ciphertext.

 > Regarding the impressive critique, I was being just as sarcastic as some
 previous commentator. People will use Dooble with or without Tor and it,
 Dooble, does not require Tor's blessing. Dooble is a whole lot of love.
 Offer suggestions, but PLEASE leave Dooble out of this community.

 You seem to not even be willing to add error-handling code to the
 functions which call `encodedString`, and that would be far less difficult
 than the redesign of Dooble's data-storage code that would be needed to
 make Dooble's encryption useful.  So I am in favor of keeping Dooble as
 far away from Tor as possible, too.  Bye.

-- 
Ticket URL: <https://trac.torproject.org:443/projects/tor/ticket/5761#comment:30>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online