Linking logins to IP addresses would stop this, unless that operator was also able to successfully spoof their IP address to match yours.Ĭookie copying is not an issue specific to Tor, anyone with access to any part of the network connection between you and the site concerned can do it. However a malicious Tor exit node operator could monitor such cookies and use them later to try to impersonate you. Presenting that cookie on subsequent page requests then tells the site who you are. When you log into most sites, they give you a cookie typically with a session ID. templates/**template_name**/index_body.tpl, try this Ĭlick to expand.Actually, there are good security reasons for linking cookies with specific IP addresses, despite the inconvenience they cause Tor users. If you are allowing 'auto logins', and you would like to have the 'Log me on automatically each visit' box checked, in file. Here's another trick for those of you who have phpBB forums. So, even if you are selecting the 'Remember me' box, you will face those log-outs while using Tor and phpBB, if this was not modified properly according to the previous link. Although this is a mild risk, it is there all the same. The security risk is that removing the ip binding could allow someone to spoof/hijack your session.

In phpBB2 you will need to edit the core code to avoid this, phpBB3 had an Admin option where you can reduce or turn off the IP to session binding.Ībove on the link is the alteration for phpBB2, although this reduces security. PhpBB binds the session to the IP for security reasons, if your IP is changing your session will drop.

If you are using phpBB and Tor at the same time, check this out. There's also another issue that I should warn everyone of you about it.

Tor switch ip