[tor-bugs] #12974 [Tor Browser]: Disable NTLM and Negotiate HTTP Auth

Wed Aug 27 22:00:10 UTC 2014

#12974: Disable NTLM and Negotiate HTTP Auth
----------------------------------------------+--------------------------
 Reporter:  mikeperry                         |          Owner:  tbb-team
     Type:  defect                            |         Status:  new
 Priority:  critical                          |      Milestone:
Component:  Tor Browser                       |        Version:
 Keywords:  tbb-linkability, MikePerry201408  |  Actual Points:
Parent ID:                                    |         Points:
----------------------------------------------+--------------------------
 This is technically an embargoed Mozilla bug, so I probably shouldn't
 provide too many details.

 Suffice to say that NTLM and Negotiate auth are bad for Tor users, and I
 doubt very many (or any of them) actually need it.

 However, Mozilla's fix is going to be more involved and likely require
 several pref additions, and this issue is not as high a priority for them
 as it is for us.

 We're just going to take the blunt approach and fully disable all forms of
 this auth.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/12974>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online