Stop caps from leaking to phishing-filter servers

[davidsarah]

Some phishing filters send URLs to a filter on some other machine. That's a bad idea and probably not very effective at preventing phishing, but they do it anyway. However, they strip query parts before sending it to the filter (according to Tyler Close and the web calculus documentation).

The webapi accepts URLs of the form http://host:port/uri?uri=..., but it redirects to an URL of the form http://host:port/uri/.... We should prefer to put the cap in the query, and we should probably also allow the shorter form http://host:port/?....

[davidsarah]

Replying to davidsarah:

[Phishing filters] strip query parts before sending it to the filter (according to Tyler Close and the web calculus documentation).

​http://waterken.sourceforge.net/web-key/#browser_how

The webapi accepts URLs of the form http://host:port/uri?uri=..., but it redirects to an URL of the form http://host:port/uri/.... We should prefer to put the cap in the query, and we should probably also allow the shorter form http://host:port/?....

Actually that would cause a regression in #52, because the query part isn't taken into account when resolving relative URLs. I don't know how to avoid that problem. Perhaps the answer is simply to document that users should turn phishing filters off.

[davidsarah]

Document leakage of cap URLs via phishing filters in known_issues.txt

[zooko]

Applied in 8a43361aaa7f1201. Thank you!

[davidsarah]

Since this is now documented as a known issue​ (with instructions on how to disable IE's phishing filter), I'm downgrading it to minor.

[davidsarah]

Bumping back up to major, because it appears that Firefox 3 does have a phishing filter that is enabled by default. The Firefox prefs UI does a poor job of labelling this as what it is: it's enabled by the "Block reported attack sites" and "Block reported web forgeries" options in the Tools | Options... | Security tab. The filter server provider is Google's ​Safe browsing API.

[davidsarah]

It appears from the ​specification that the "safe browsing API" protocol is not vulnerable in a way that would affect Tahoe. 32 bits of information about any particular URL is potentially leaked, but that would not be enough to either guess a cap or apply a cryptanalytic attack.

[zooko]

Here's a news story about an accusation that Google Chrome sends back a lot of information about the URL to a remote server:

​http://arstechnica.com/microsoft/news/2010/03/microsoft-google-chrome-doesn-your-privacy-microsoft-google-chrome-doesnt-respect-your-privacy.ars

[davidsarah]

Replying to zooko:

Here's a news story about an accusation that Google Chrome sends back a lot of information about the URL to a remote server:

​http://arstechnica.com/microsoft/news/2010/03/microsoft-google-chrome-doesn-your-privacy-microsoft-google-chrome-doesnt-respect-your-privacy.ars

I cannot reproduce the alleged behaviour of the address bar search at all using Chrome 5.0.366.2 dev. Perhaps it has been fixed since Chrome 3.

[davidsarah]

The documentation about this in docs/known_issues.txt (now docs/known_issues.rst​) was updated in 15b65ae54b199345.