don't send SECURIXVERSION and SECURIXID to the server by default

[adrelanos]

https://github.com/martincmelik/Securix-Linux/blob/master/securix-control/securix-monitor#L209

# Check new version of Securix
f_download ${SECURIXUPDATE}/cgi-bin/current.py?sxver=${SECURIXVERSION}\&sxid=${SECURIXID} ${SECURIXUPDATEDR}/cgi-bin/current.py?sxver=${SECURIXVERSION}\&sxid=${SECURIXID}

I think opt-in by default without asking, sending SECURIXVERSION and SECURIXID to the server is something privacy conscious users will dislike.

Revealing version numbers (SECURIXVERSION) gives tips to adversaries which they can use to ease attacks.

Unique ID's such as SECURIXID can be used to track activity of pseudonymous users, even if they anonymize their traffic.

I advice having this disabled default and opt-in or totally dropping this for simplicity.

[martinholovsky]

Hi, as it is HTTPS traffic there is no worry about information disclosure (exit node will see only CONNECT request). Securix version is expected to be send from client so it is working as designed. Securix ID can be changed to whatever you want as it is not essential.

[adrelanos]

You could argue, that the transmission is protected by https. I'd say, well, SSL is not very secure.

• SSL CA's such as DigiNotar was hacked or
• comodo resellers that got hacked.

---

If you watch Jacob Appelbaum's latest talk, he says basically everything is broken except OTR and GPG: http://media.ccc.de/browse/congress/2014/31c3_-_6258_-_en_-_saal_1_-_201412282030_-_reconstructing_narratives_-_jacob_-_laura_poitras.html#video

This includes SSL being totally broken if I understand that right.

---

The Snowden revaliations are probably just the tip of the iceberg. I think it is sane to assume, that they got legal front door and/or backdoor access to almost any data center and using this for targeted attacks.

---

And even if you don't care about NSA. It's just what we know. Sane to assume that other adversaries have similar capabilities.

[martinholovsky]

Hi, please read more about Snowden and you will find an article where he mention that SSL is not broken, just some algorithms. In short websites not supporting SSLv1-3 (just TLS), using SHA-2 or better, supporting PFS and key at least 2048bit long are considered as safe. CA trust is different topic and so far nothing better exist. Using self-signed certificate is definitely not better. If NSA will be interested in hack of your computer, you can bet that securix website wouldn't be the target. There is nothing white or black only... even your GPG private key could be reconstructed by methods which are hard to imagine :] http://arstechnica.com/security/2013/12/new-attack-steals-e-mail-decryption-keys-by-capturing-computer-sounds/