Re: SSL for debian.org/security?

[Djones Boni <07ea86bb4e@gmail.com>]

On 29-10-2013 08:36, burgers.rob@gmail.com wrote:

Its not tor itself that was compromised but the version of Firefox bundled with the Tor browser bundle. They used a 0day to install a tracking cookie in FF.

The FF bug exploited by Freedom Hosting script was not a 0day one.
There was a updated TBB which fixed it a month before the attack (only MSOSs were exploited with that script).

If anyone use TBB to access Debian hidden service to verify security updates and TBB leak information to LEA. What could they do?
"Aham! He uses Debian. Let's arrest him!"

A Debian THS is a good idea for the security it provides, not for anonymity or down rate.
It would be harder to someone MITM and hide updates from you.
That is why Debian should use SSL (and THS).