Brave Browser permanently timestamps & logs connection times for all v2 domains ~/.config/BraveSoftware/Brave-Browser/tor/data/tor.log
该报告还没有中文解读。
原文摘录
摘自原文（6982 字符中的一小部分）
A vulnerability in the Brave Browser v1.28.43 and below allows a local or physical attacker to view the exact timestamps that a user connected to a v2 onion address. A local or physical attacker could read ~/.config/BraveSoftware/Brave-Browser/tor/data/tor.log identify the exact moment a user …
原文中的代码
Jul 01 08:40:50.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline Jul …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Brave Software 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @sickcodes · 版权归作者与 Brave Software 所有