[tor-bugs] #10887 [Obfsproxy]: ScrambleSuit should make it easy for bridge admins to learn password

[Tor Bug Tracker & Wiki]

#10887: ScrambleSuit should make it easy for bridge admins to learn password
-------------------------+-------------------------------------------------
     Reporter:  phw      |      Owner:  phw
         Type:           |     Status:  needs_revision
  enhancement            |  Milestone:
     Priority:  normal   |    Version:
    Component:           |   Keywords:  scramblesuit, password, shared
  Obfsproxy              |  secret
   Resolution:           |  Parent ID:
Actual Points:           |
       Points:           |
-------------------------+-------------------------------------------------

Comment (by phw):

 Replying to [comment:12 yawning]:
 > I would rather see the bridge line changed to only contain the password
 before merging (the generated bridge line also neglects to include a
 bridge fingerprint since the information is unavailable to the PT
 currently).  Only including a password line is better than having a bridge
 line that is wrong and incomplete.

 Yes, ideally including a comment that the password should be appended to
 the bridge descriptor.

 > The unittests fail because they don't set a state location

 I would modify `writeServerDescriptor()` so that instead of triggering an
 assert error, it should simply not write a server descriptor if the state
 location is not known (and perhaps log a warning message).  That way, we
 also don't need a default state directory?

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/10887#comment:14>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online