Critical Tor flaw leaks users’ real IP address
> TorMoil, as the flaw has been dubbed by its discoverer, is triggered when users click on links that begin with file:// rather than the more common <a href="https://" rel="nofollow">https://</a> and <a href="http://" rel="nofollow">http://</a> address prefixes. When the Tor browser for macOS and Linux is in the process of opening such an address, "the operating system may directly connect to the remote host, bypassing Tor Browser," according to a brief blog post published Tuesday by We Are Segment, the security firm that privately reported the bug to Tor developers.<p>Oh, well ... This is basically the same vulnerability exploited by the FBI's NIT. And this is the key aspect ...<p>> ... "the operating system may directly connect to the remote host, bypassing Tor Browser," ...<p>Well, in any sort of secure Tor implementation, such a thing should be impossible. The Tor client should be running in a router or gateway VM, and the machine used for browsing should not even have a public IP address. That's easy to manage with Whonix.<p>I've badgered Tor Project about this for years. And they've ignored me. Their mantra has been about keeping things simple, so more people will use Tor.<p>Damn.<p>Edit: They've plugged this leak, but the fundamental weakness remains. Tor Browser doesn't even block non-Tor connectivity with firewall rules. Even VPN clients block non-VPN connectivity.