Feature #8990
More rss feeds and fighting fingerprinting
0%
Description
tl;dr:Add as many popular rss feeds as possible (including non english language feeds) to avoid having unique rss feed lists for each user.
A user wishes to quickly skim world news headlines. To do this, they visit multiple sites, an aggregation site, or use the liferea rss feed reader program.
Visiting multiple sites can be slow, exposes the user to watering-hole attacks, and makes the user partially fingerprint-able if they always visit the same sites/pages in the same order. (The assumption is that an attacker may have previously fingerprinted the user’s surfing habits, and is watching a large amount of exit node traffic.)
Thus the user uses liferea. But cannot add other rss feeds permanently when running tails off a cd-rom.
Moreover, if they add custom rss feeds on a persistent install, those feeds become a unique fingerprint. As:
1)Lifera updates all feeds at program startup.
2)Lifera downloads the feeds in a unique (user defined?) order.
3)Rss feeds are usually provided via http, and thus visible to attackers monitoring exit nodes.
Solutions:
A) Add as many rss news feeds as possible.
B) Use the same default rss feed list as other feedreaders that use TOR (see android “courier” app from https://guardianproject.info/apps/courier)
C) Have Lifera start in offline mode at program start / Do not automatically update all feeds.
D) Replace Lifera with a tor hidden site that caches rss feeds.
E) Prevent the user from adding custom rss feeds.
F) Force Lifera to update feeds in alphabetical order regardless of user’s classifications / custom drag and drop order.
I vote A/B and C.
Should take 20min to compile a list of the top100 feeds and another 20 to figure out how to add them in bulk.
Problems: (These should all be their own bug reports but I’m lazy)
1)Lifera also downloads FAVICONS by default. Every time? Only once? Does Lifera check for new favicon file versions and THEN decide to download them? What library does Lifera use to open/display the .ico/.png image for the favicon? Does it have any buffer overflows?
2)Lifera has support for COOKIES (/home/amnesia/.liferea_1.8/cookies.txt) can it be disabled/scrubbed/ set to read-only?
3)Lifera has JAVASCRIPT (!?) enabled by default. This IS A TERRIBLE IDEA. Javascript adds no benefit to rss feeds. An attacked doing a MitM attack on an exit node could insert some malicious scripts. It should be disabled. (Could not find where liferea stores the settings)
4)Does Lifera do Version control when downloading feeds? Does it ALWAYS download ALL the feeds or just the ones that have changed? Does it do “delta” updates? Can this be used as another form or fingerprinting?
Subtasks
History
#1 Updated by BitingBird 2015-03-01 23:21:39
A) No, see https://tails.boum.org/support/faq/index.en.html#index21h2 to learn why we limit the software that we ship
B) we already have Liferea default feeds, why would the others be better?
C) I don’t see the point, why would anybody start Liferea if not to check the feeds? (I also doubt that’s an existing option in Liferea, and we won’t implement it)
D) who would host this site? How would we trust them?
E) kills the purpose of Liferea (if you don’t want to add custom feeds, don’t, but preventing isers to do it doesn’t make sense to me)
F) i don’t see how it would change the unique fingerprint issue.
Please note that we plan to remove Liferea at some point, see Feature #6403 for its closing reasons.
In conclusion: if nobody says otherwise, I’ll close this ticket in a few days.
#2 Updated by intrigeri 2015-03-03 12:01:57
> Visiting multiple sites can be slow, exposes the user to watering-hole attacks, and makes the user partially fingerprint-able if they always visit the same sites/pages in the same order. (The assumption is that an attacker may have previously fingerprinted the user’s surfing habits, and is watching a large amount of exit node traffic.)
I think your analysis doesn’t take into account Tor streams isolation
> Problems: (These should all be their own bug reports but I’m lazy)
Given we plan to remove Liferea anyway, as BitingBird said: don’t expect us to put lots of efforts in this area. Please create these other tickets yourself if you want to give them more exposure.
#3 Updated by intrigeri 2015-03-03 12:02:15
> In conclusion: if nobody says otherwise, I’ll close this ticket in a few days.
ACK.