[HTTPS-E Rulesets] Fixed ruleset for Yahoo! Mail

David Dernoncourt patheticcockroach at yahoo.com
Tue Jan 10 04:08:50 PST 2012


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

I noticed that you replaced (.+) with ([^/:@\.]+) in the last
rule. Not matching the dot will break it because Yahoo uses
subdomains 2 levels deeper than mail.yahoo.com. For instance my
mailbox is on us.mg5.mail.yahoo.com. Is it a security issue to
match dots? If so, the following should be fine:


<rule
from="^http://([a-z0-9]+)\.([a-z0-9]+)\.mail\.yahoo\.com/"
to="https://$1.$2.mail.yahoo.com/" />

Plus maybe (not required for me but maybe it can happen to have
only 1 level deeper than mail.yahoo.com?):
<rule from="^http://([a-z0-9]+)\.mail\.yahoo\.com/"
to="https://$1.mail.yahoo.com/" />


- ----- Original Message -----
> From: Seth David Schoen
> Sent: Tuesday, January 10, 2012 1:30 AM
> Subject: Re: [HTTPS-E Rulesets] Fixed ruleset for Yahoo! Mail
>
> David Dernoncourt writes:
>>
>>  As a fix to ticket 4441
>>  (https://trac.torproject.org/projects/tor/ticket/4441), the
>>  following ruleset seems to work fine:
>
> Thanks!  We're putting this into the new development release
as a
> default_off and we'd encourage Yahoo! Mail users to try it
out.
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (MingW32)
Comment: Using VisualGPG v0.1.2.0

iQUcBAEBAgAGBQJPDCmPAAoJEGAcV4sYvqRCZdIoAJ1hYqdmvIjvVk7gBTsojT9W
jpkZwZMy1l/xnRyI6YD8I6Sw3l0kwdi4gDpwG0gIKmqyvwLWQhnhciYvk0e9IMqO
CWQzur8rv4oDvBq3MWjZFtGp+4VH7sJGDHFhRQGWQoRgxrMQJKioAsa3pmo1DKji
26lwBs+2J0NIp55sDI8i5tVzVjOSeHkb8KjksuXNLJYKJLlVqIEorBS4knFul7LW
GzEFIEPrF70wT0U5AbyrXGzesS3/VkZcEg/7aQKxtYC/rc3/AwLGxR/VWUuKaZkT
oEJmVEJmU+LDkz6/h3weAdStoGOMdkOm5Z9phKNo5uhkiVeCJ1kmS3vmehThjPro
iBcwHBcVP7psAg9gkN8S1JnF4LazDjm/s4XTirxBpsNDuEfJR/3YkmlJviaGlS3g
biAZjZo69TIOcr2fR98vN180VJ+jST0qVnW+oypRT8nWWgTcb9XFoDAXY2jqBAeZ
31Hvm51hVlNsuYg9qCECv60a12A+317XePRB1O38vNOYmAbyziVSqX/SfpNvxeoQ
dPQ305K0D28CJzV3Whh2ojPvy0yYE2FLsY5Ckjq5/lFTDU7FZtnNca5BRCSeum25
gf/e5dZr4JYw1ytmqeVypY4lX6XSBI++3AfNQQf29HQxs+Sn8Gl2wzZnHeFTSgNZ
6Cyr6NPWNhf0RyQgL1sqE8EkibIzcXjvBfviTbKI8SpZbiRjxArFNOInpcUG4Ue7
EgJuB1aLUgL3j69IZz5v5mQy0VrDjWd+JW7aW6SVCclXhNKoXZhvHZazaqoYD5rw
+kiasq8Jd/OcaWo7Xxj1eSYdHSch7v1yNqF+ELeDvCf2JIcf67E96pMSlg6gfPLJ
GWU+PcEUS7NT3b/nsu7eVZshBLy8u6lAjmgZOdUwueEk5rf2ClDEM52SIwVGt17T
VecPddSK31zUhlJ51YA57wSKn/9CjTFK3a5YyyKO2OUxpqJlROOx6i94J+HmRbu2
tsDDC+uByea7XHDpd/vq4GUQ18mA2TdzC6p1ycPnhXRkey+ZZIa2m84iMwtK6HTY
5TVt+X9lizmig3fK7G0j2YVJubf5HksrdU9bkfLx3EFXMg4f3QwidiRtl2RdYgwE
4E2DTJH6wY65rlVan2A0jc3aZKX/fjCiNPvdx57tan9wwAID8Greaf9EZ3dQbq3l
5vgE9Wmy8dxgqRSxXvlxT7dTL/IZOtCnUiNMoCgkwd5Rquo14N3xNZfW/Q1/IWqk
bztNqAsVlvj0+3f7gPyXP5DYOyRTTzupQ+kiXYCjKALig44rrYIzpNx95U/bFr5i
b1C5xuftD88kDTUljNBruYQR27mUE6y+g4t+QUfgJJafpxQGCrLyfxjD2SULkz3v
jYcbffk/uuVIVVWBP8TsRdWMQM7/Ej0phTX+qYCHdYRvXRWxpcHctmKbI3XqrkPd
/jgYnRR5OwZFe2cQg0+dhC7dSuOfw8bZQu05L6Y5HQvLi8M947D4LoYpENyoPKhA
PXQK261rVC2uZjHFwvPuCGidXE/iue//BjorEmfNZDS2CfyOCEVyJqodF3rhjyrK
J/MbBdzSaZ0GyI+M7F1YWY4pziwTp99413f7goUYkYkNOnhhdi+IT/7XbEA2cGxH
NB7XQ5qWFwqCQa6B2fGQRL5SppAVuNRgdy6z4p81WZZVE0pvJ/DDfVEY/s7Pv/s4
UbxV0xW84Ifby7sOAclT
=quy0
-----END PGP SIGNATURE-----



More information about the HTTPS-Everywhere-Rules mailing list