{"action":"created","issue":{"url":"https://api.github.com/repos/TokTok/c-toxcore/issues/596","repository_url":"https://api.github.com/repos/TokTok/c-toxcore","labels_url":"https://api.github.com/repos/TokTok/c-toxcore/issues/596/labels{/name}","comments_url":"https://api.github.com/repos/TokTok/c-toxcore/issues/596/comments","events_url":"https://api.github.com/repos/TokTok/c-toxcore/issues/596/events","html_url":"https://github.com/TokTok/c-toxcore/issues/596","id":256437835,"number":596,"title":"Proposal for reworking the way onion paths are created","user":{"login":"zugz","id":590069,"avatar_url":"https://avatars0.githubusercontent.com/u/590069?v=4","gravatar_id":"","url":"https://api.github.com/users/zugz","html_url":"https://github.com/zugz","followers_url":"https://api.github.com/users/zugz/followers","following_url":"https://api.github.com/users/zugz/following{/other_user}","gists_url":"https://api.github.com/users/zugz/gists{/gist_id}","starred_url":"https://api.github.com/users/zugz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zugz/subscriptions","organizations_url":"https://api.github.com/users/zugz/orgs","repos_url":"https://api.github.com/users/zugz/repos","events_url":"https://api.github.com/users/zugz/events{/privacy}","received_events_url":"https://api.github.com/users/zugz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2017-09-09T13:05:04Z","updated_at":"2017-09-18T18:55:09Z","closed_at":null,"author_association":"NONE","body":"https://github.com/zugz/tox-onionPathsProposal/blob/master/onionPathsProposal.md\r\n\r\nThis expands substantially on #547.\r\n"},"comment":{"url":"https://api.github.com/repos/TokTok/c-toxcore/issues/comments/330321724","html_url":"https://github.com/TokTok/c-toxcore/issues/596#issuecomment-330321724","issue_url":"https://api.github.com/repos/TokTok/c-toxcore/issues/596","id":330321724,"user":{"login":"GrayHatter","id":243408,"avatar_url":"https://avatars3.githubusercontent.com/u/243408?v=4","gravatar_id":"","url":"https://api.github.com/users/GrayHatter","html_url":"https://github.com/GrayHatter","followers_url":"https://api.github.com/users/GrayHatter/followers","following_url":"https://api.github.com/users/GrayHatter/following{/other_user}","gists_url":"https://api.github.com/users/GrayHatter/gists{/gist_id}","starred_url":"https://api.github.com/users/GrayHatter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GrayHatter/subscriptions","organizations_url":"https://api.github.com/users/GrayHatter/orgs","repos_url":"https://api.github.com/users/GrayHatter/repos","events_url":"https://api.github.com/users/GrayHatter/events{/privacy}","received_events_url":"https://api.github.com/users/GrayHatter/received_events","type":"User","site_admin":false},"created_at":"2017-09-18T18:55:09Z","updated_at":"2017-09-18T18:55:09Z","author_association":"NONE","body":">> @zugz the risk here is \"only\" that an attacker can possibly know what friends we are connected to. so our friendship net.\r\n\r\n>*If* we're connected via TCP relays which the attacker doesn't control, then yes. Otherwise a deanonymisation attack is also possible - see the \"current implementation\" section in the proposal for details.\r\n\r\nIf the attacker has access to the users ISP, then yes. A silent DoS would be trivial. \r\n\r\n>> but the message contents are safe.\r\n\r\n> To my knowledge yes, in all cases.\r\n\r\nThis is correct, (the birthday attack still applies)\r\n\r\n>> is there also a DoS possibility? that the attacker can make our messages never arrive at the correct friend?\r\n\r\n> The only DoS attack that I know of is that an attacker can occupy our announce neighbourhood and pretend it hasn't seen us when others ask. This prevents us receiving friend requests. If a friend of ours is simultaneously attacked in same way, then we and the friend won't be able to find each other. This is a serious problem, and there are ways we could try to mitigate it, but it's a separate issue which this proposal doesn't touch on at all.\r\n\r\nYou could use this attack to learn/confirm a friends list. There's also another attack that would allow you to force any DHT node it's friends list. Combining the two attacks, you could trivially, and silently, DoS selected connections at will/whim with very little resources."}}
{"actor":{"display_login":"GrayHatter"}}