8 ms·
Opera VPN behind the curtains is just a proxy
- SomeCallMeTim 11y agoSo the problem is that, e.g., DNS isn't also queried over a VPN, so the sites you're looking at will still be 100% visible to anyone watching your network stream? Or is the problem just that they're using the wrong terminology?
- bwat48 11y agopeople are complaining about the terminology they're using, because it only effects Opera and not other applications, even though that was completely obvious from the start. They clarify it here: https://www.opera.com/blogs/news/2016/04/opera-doubling-server-capacity-vpn/ https://www.opera.com/blogs/news/2016/04/opera-doubling-serv... "Our VPN feature is still in development. We are currently working hard to implement support for proxying even more of the browser traffic, including WebRTC and plug-ins. Having this functionality built into the browser, instead of as an extension, allows us to catch more situations, such as certificate revocation checks made by the system. Yes, the VPN feature is free, and we do not plan to charge for it. Our VPN is something we call a browser VPN. Under the hood it works by routing all the browser traffic properly encrypted via our secure proxies in various parts of the world. It will not route the traffic from other applications – as a system wide VPN would do – it’s a browser VPN after all."
- davb 11y agoWhich is actually a really interesting idea. Network interface level VPNs are great in certain situations. For instance, when using untrusted WiFi networks I'll connect to my VPS VPN hosted in the US or my UK RasPI VPN. But when I want to circumvent a geo-block to watch some sports on Al Jazeera Sport (now BeIn Sport), I don't want all of my traffic going through the public VPN provider in Saudia Arabia. I don't really trust public VPN providers. Normally I'd run a dedicated local VM which I'd connect to a public VM just to watch geo-blocked streaming media. Proxies, though. Per-application proxies. Or even better - per tab/window/browser profile proxies. This would solve my problem more elegantly.
- delroth 11y agoOn Linux I configure a network namespace that routes everything through my VPN, and I run a separate Chrome profile within that namespace (or whatever else I want to run and route through the VPN). http://pastie.org/private/fzx7btxmvxbnftgkx31k8g http://pastie.org/private/fzx7btxmvxbnftgkx31k8g is what I use as openvpn up/down script. Feel free to study/reuse.
- betaby 11y agoYou create that namespace under root? What next? You run nsenter NNNN and su - $username -c chromium? It's still able to communicate with Xorg thereafter?
- delroth 11y agoIndeed, something like "sudo ip netns exec myvpn sudo -u delroth -- google-chrome-stable --user-data-dir=~/.config/myvpn-google-chrome"
- gz5 11y agoYes, and app-specific VPNs too. So a SaaS app with embedded VPN in order to achieve certain security, quality or visibility goals between user network and their first cloud hop. Each app VPN using a virtual IP?
- pt 11y agoI am actually working on build something similar. So, you could roll out an app-specific VPN like secure tunnel real easy. It is inspired by the work at Google IT called BeyondCorp [1]. The target market is companies whose employees require secure remote access to internal apps, but IT does not want to give a broad network access via VPN. So, marketing/sales like employees who simply want to access internal portals, etc. without the hassle of dialing into a VPN. [1] http://research.google.com/pubs/archive/43231.pdf http://research.google.com/pubs/archive/43231.pdf
- homero 11y ago
- betaby 11y agoYes, it's an https proxy. And DNS queries are not leaked. Again since it's a HTTPS proxy your traffic is hard to inspect/intercept/MITM. Earlier discussion https://news.ycombinator.com/item?id=11540389 https://news.ycombinator.com/item?id=11540389
- danielparks 11y ago> DNS queries are not leaked. I imagine that you mean the proxy takes care of resolving hosts. For example, requesting https://google.com https://google.com doesn't resolve google.com. on the client, rather it sends a request for https://google.com https://google.com to the proxy server and the proxy server resolves google.com. Attacking the DNS lookup for the proxy itself won't work because the attacker would need the SSL certificate for the proxy. Hopefully Opera has pinned that certificate (or better, its signer), which prevents a rogue CA attack.
- tyingq 11y agoIt does leak via WebRTC unless you install a 3rd party plugin and configure it a specific way.
- feduzi 11y agoThis has a small benefit of protecting information routed to Opera's proxy (on your LAN, ISP or whatever there is till the Opera's proxy), even when trying to reach HTTP-only website. Though it is still not secure as HTTP-only website will have data delivered to it in non-encrypted form. "Browser VPN" is another misleading made-up term.
- arca_vorago 11y agoYet my post on the story about that said basically "do not want until open sourced" got downvoted into oblivion with no response...
- deleted 11y ago[deleted]
- chris_wot 11y agoThat'd be a fair position to hold.
- cpach 11y agoSome people want all their applications open source. Which is fine, do that if that’s what you want. But it’s quite tedious if we need have to have that discussion for every thread related to a proprietary application/service.
- deelowe 11y agoK. To be honest, this was pretty obvious to me. Did people really think it was a full VPN?
- lvs 11y agoI agree. There's no good reason why a web browser would make its own network layer connection to support non-HTTP sessions. Session layer proxies have forever been how this is done.
- pbreit 11y agoBaking OpenVPN into the browser doesn't seem like a horrible idea.
- brokemanchild 11y agoThere's no way it can stay free can it? It seems like a crazily expensive feature for them to bake in..
- Vexs 11y agoI mean they can insert a client that allows people to use their server of choice.
- newjersey 11y agoI can install the browser without root privileges. This is an absolute must have for me. Installing a browser for a user shoukd not require root. How would you get a non-privileged executable to take control of full network?
- 4ad 11y agoIt doesn't. While that's the most common way to run a VPN, it's not the only way. You use TUN/TAP devices because you want arbitrary programs to use them. In this case, you only want Opera to use the VPN connection. You don't need a TUN device for that.
- Mpamios 11y agoI am wondering.. how about logging? I don't see anything about logging.. VPN is useless if the VPN service provider hands out all logs to anyone who ask for it.. anonymity goes bye-bye
- berdario 11y agoI think they added a bit of polish/magic compared to what you'd get in a plain https proxy that you could setup yourself, since when visiting an HTTPS page it'll show the certificate information from the site that you're visiting, and not the one from the actual machine you're connecting to (the proxy). Similarly (unlike poorly setup proxies like Lenovo's Superfish) it also prevents connection to sites with invalid certificates. (I wrote the same comment in the gist)
- mistaken 11y agoI'm pretty sure that they just don't inspect the HTTPS traffic. Otherwise I'd be worried that they have patched Opera to accept their fake certificate and replace the cert information with details from the original.
- quotemstr 11y agoAll VPNs are proxies. It's just a matter of at what layer of the stack you do the proxying. This post is a non-story.
- chris_wot 11y agoI'm currently trying to setup an OpenVPN based VPN server on OS X. That's because several iPad apps I use seem to bypass my regular DNS servers and go to Google's DNS servers and OpenDNS, which I don't want them to do. I could stick a gateway on my network, but frankly I just don't want to spend any more money and OS X should do fine for what I want. There is surprisingly little documentation on how to setup OpenVPN on OS X. However, in my travails through OS X I've had to learn a whole bunch of tools I've never used before, the main ones are how to create launcher files, how to setup OpenVPN and how to use pf - in the way OS X wants me to. I'm think of uploading the setup onto GitHub - would anyone be interested?
- Razengan 11y agoSure, that might be helpful to some.
- NetStrikeForce 11y agoIsn't this very similar to what they used to do with Opera Mini? The purpose was of course different. Opera Mini added value by optimising the pages for your device (tiny screens, underpowered CPUs, insufficient RAM, small batteries), while the added value of the current proposal is actually defeated when it's offered only for free (meaning they get something out of it - not just marketing for a paid offering). "" Opera Mini requests web pages through Opera Software's servers, which process and compress them before sending them to the mobile phone, speeding up transfer by two to three times and dramatically reducing the amount of data transferred, chargeable on many mobile phone data plans. The pre-processing increases compatibility with web pages not designed for mobile phones. However, interactive sites which depend upon the device processing JavaScript do not work properly. "" https://en.wikipedia.org/wiki/Opera_Mini https://en.wikipedia.org/wiki/Opera_Mini
- metastart 10y agoBetter to use Epic Privacy Browser with a built-in ENCRYPTED proxy that's fast over SPDY (not a simple unencrypted http proxy).
- spaze 10y agoBased on my research (I'm the author of the linked content), I've built a simple Python Script which will do all the API calls and fetch the credentials and list available proxies: https://github.com/spaze/oprah-proxy https://github.com/spaze/oprah-proxy