Telegram Group & Telegram Channel
关于 v2ray/v2ray-core#2509 的 TLS 指纹漏洞

”漏洞“到底“漏”了什么

客户端代码中使用了一个固定的 TLS 密码套件列表进行握手,这个固定列表可能在 V2Ray 客户端发送 TLS 握手包时被防火墙用作识别 V2Ray 客户端的特征。

“漏洞”存在多长时间?

v2ray-core 项目在 2018 年中的版本(v3.23.1)中引入了 TLS 底层配置的功能,此后这个列表便一直存在于代码中。2019 年的版本(v4.18.1)中因为加入 TLS 1.3 的支持,列表增加了一些项目。

目前处理方法?

Golang 标准库的 crypto/tls 也在活跃的维护当中,已经有完善了密码套件的选择机制,标准库会根据运行的硬件平台性能选择适当的密码套件顺序。

新版本(v4.23.2+)去掉列表,设为空值(nil),由 Golang 底层处理。

后续改进?

进一步避免指纹被侦测的另外一个思路是把 TLS 配置成跟常见浏览器一致(注:浏览器不同版本的 TLS 指纹都有所区别)。目前有 项目 (tlsfingerprint.io) 在关注这个问题。

对 V2Ray 项目而言,这属于功能性加强,会在后续版本中引入由 uTLS 库提供的伪装指纹功能。



tg-me.com/v2fly/34
Create:
Last Update:

关于 v2ray/v2ray-core#2509 的 TLS 指纹漏洞

”漏洞“到底“漏”了什么

客户端代码中使用了一个固定的 TLS 密码套件列表进行握手,这个固定列表可能在 V2Ray 客户端发送 TLS 握手包时被防火墙用作识别 V2Ray 客户端的特征。

“漏洞”存在多长时间?

v2ray-core 项目在 2018 年中的版本(v3.23.1)中引入了 TLS 底层配置的功能,此后这个列表便一直存在于代码中。2019 年的版本(v4.18.1)中因为加入 TLS 1.3 的支持,列表增加了一些项目。

目前处理方法?

Golang 标准库的 crypto/tls 也在活跃的维护当中,已经有完善了密码套件的选择机制,标准库会根据运行的硬件平台性能选择适当的密码套件顺序。

新版本(v4.23.2+)去掉列表,设为空值(nil),由 Golang 底层处理。

后续改进?

进一步避免指纹被侦测的另外一个思路是把 TLS 配置成跟常见浏览器一致(注:浏览器不同版本的 TLS 指纹都有所区别)。目前有 项目 (tlsfingerprint.io) 在关注这个问题。

对 V2Ray 项目而言,这属于功能性加强,会在后续版本中引入由 uTLS 库提供的伪装指纹功能。

BY V2Fly - Notification and Updates, V2Ray the second new


Warning: Undefined variable $i in /var/www/tg-me/post.php on line 283

Share with your friend now:
tg-me.com/v2fly/34

View MORE
Open in Telegram


V2Fly Notification and Updates V2Ray the second new Telegram | DID YOU KNOW?

Date: |

Should You Buy Bitcoin?

In general, many financial experts support their clients’ desire to buy cryptocurrency, but they don’t recommend it unless clients express interest. “The biggest concern for us is if someone wants to invest in crypto and the investment they choose doesn’t do well, and then all of a sudden they can’t send their kids to college,” says Ian Harvey, a certified financial planner (CFP) in New York City. “Then it wasn’t worth the risk.” The speculative nature of cryptocurrency leads some planners to recommend it for clients’ “side” investments. “Some call it a Vegas account,” says Scott Hammel, a CFP in Dallas. “Let’s keep this away from our real long-term perspective, make sure it doesn’t become too large a portion of your portfolio.” In a very real sense, Bitcoin is like a single stock, and advisors wouldn’t recommend putting a sizable part of your portfolio into any one company. At most, planners suggest putting no more than 1% to 10% into Bitcoin if you’re passionate about it. “If it was one stock, you would never allocate any significant portion of your portfolio to it,” Hammel says.

How to Buy Bitcoin?

Most people buy Bitcoin via exchanges, such as Coinbase. Exchanges allow you to buy, sell and hold cryptocurrency, and setting up an account is similar to opening a brokerage account—you’ll need to verify your identity and provide some kind of funding source, such as a bank account or debit card. Major exchanges include Coinbase, Kraken, and Gemini. You can also buy Bitcoin at a broker like Robinhood. Regardless of where you buy your Bitcoin, you’ll need a digital wallet in which to store it. This might be what’s called a hot wallet or a cold wallet. A hot wallet (also called an online wallet) is stored by an exchange or a provider in the cloud. Providers of online wallets include Exodus, Electrum and Mycelium. A cold wallet (or mobile wallet) is an offline device used to store Bitcoin and is not connected to the Internet. Some mobile wallet options include Trezor and Ledger.

V2Fly Notification and Updates V2Ray the second new from us


Telegram V2Fly - Notification and Updates, V2Ray the second new
FROM USA