search

tor2web / Tor2web

Tor2web is an HTTP proxy software that enables access to Tor Hidden Services by mean of common web browsers
https://www.tor2web.org
GNU Affero General Public License v3.0
705 stars 176 forks source link

Tor2web should inform the TorHS about SSL/TLS Cipher negotiated by client #79

Open fpietrosanti opened 11 years ago

fpietrosanti commented 11 years ago

In order to let TorHS have a better understanding of the security context of the Client accessing it via Tor2web, Tor2web proxy should advise with an appropriate HTTP Header the SSL/TLS cipher negotiated by the client.

For example a TorHS operator may be willing to accept only Web clients that negotiated Forward Secrecy enabled ciphers.

The header maybe something like X-Tor2web-Cipher: Name_Of_SSL_Cipher.

This issue is related to #56

--- Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/14807174-tor2web-should-inform-the-torhs-about-ssl-tls-cipher-negotiated-by-client?utm_campaign=plugin&utm_content=tracker%2F318575&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F318575&utm_medium=issues&utm_source=github).
evilaliv3 commented 7 years ago

Now that GlobaLeaks is going to implement HTTPS internally it would be interesting to implement this feature there as well, in particular for the fact that for security reasons we would like to disable TLSv1 but for compatibility reason we are forced to keep it up for showing messages about the supported browsers alternatives.