security bug: IP address is leaked to central servers (onion svc needed)
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 9.2k
- Forks
- 1.3k
- Avg merge
- 12h 58m
- Merged PRs (30d)
- 56
Description
Tor users are prevented from creating a transparent proxy due to bug https://github.com/keybase/client/issues/9757. This means our IP address is being leaked to the centralized keybase server. This happens even if --tor-mode= is supplied by client transactions because the local server is also listening for web-triggered chat requests.
Consequently, there is a need for proper Tor support. The server should establish a .onion address and use Tor to register the .onion address with the server at keybase.io.
The seriousness of this bug is sharp, in light of the fact that users don't even necessarily know they are running a server (ref https://github.com/keybase/client/issues/3869).
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the linked issues 9757 and 3869 to understand the transparent-proxy failure and when users unknowingly run a server. Done would require the server to establish a .onion address and register that address with keybase.io through Tor.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100