3 ms·

However, ForceTLS will only work if the server supports HTTPS. IMO, a better solution is that of a SOCKS proxy as outlined in this comment: http://news.ycombin

by jazzyb 16y ago

However, ForceTLS will only work if the server supports HTTPS. IMO, a better solution is that of a SOCKS proxy as outlined in this comment: http://news.ycombinator.com/item?id=1828631 http://news.ycombinator.com/item?id=1828631 Using ssh as a SOCKS server has the added benefit of tunneling all traffic securely, not just that of Firefox.

chaosmachine 16y ago
I've been using a SOCKS proxy over SSH for a while now, but I find it very slow, especially when loading a page that requires a few dozen HTTP requests. So, today I set up a VPN using these instructions: http://library.linode.com/networking/vpn-services/openvpn-ubuntu-9.10-karmic http://library.linode.com/networking/vpn-services/openvpn-ub... Problem solved.
pmjordan 16y ago
SOCKS has no inherent encryption and is insecure as hell. Although there is an encrypted mode available in some servers, it's not supported by all clients, and it doesn't defend against MITM attacks, which limits its usefulness. (ever see a SOCKS client with a tickbox "only allow encrypted connections? didn't think so) SOCKS alone doesn't gain you any security advantage, it's SSH that does. Note that if you have a tun/tap driver installed on both endpoints, ssh can even operate as a full-on VPN (-w option), thus not requiring any client software support. None of the above (or OpenVPN) will work on a non-jailbroken iPhone/iPod/iPad, unfortunately. You'll need a pptp or IPSEC server for that. Also beware of apps which do use SSL to communicate but don't check certificates. You'd be surprised how many get this wrong. This leaves the connection wide open to MITM attacks. EDIT: objective arguments > downvoting
- atleta 16y ago
  You didn't get it. SSH can be used for tunneling (encrypting) TCP connections between two machines and it can be set up so that the SSH client acts as a SOCKS proxy. Client apps connect to the SSH client, it tunnels the traffic trough the encrypted SSH connection to the other side where the SSH server decrypts it and connects to the target host. The traffic is thus encrypted between your machine and the SSH server, can't be sniffed from the air (unless the server is also connected to an insecure WIFI ;) ).
  - pmjordan 16y ago
    You didn't read my post: "SOCKS alone doesn't gain you any security advantage, it's SSH that does."

by jazzyb 16y ago

chaosmachine 16y ago

I've been using a SOCKS proxy over SSH for a while now, but I find it very slow, especially when loading a page that requires a few dozen HTTP requests. So, today I set up a VPN using these instructions: http://library.linode.com/networking/vpn-services/openvpn-ubuntu-9.10-karmic http://library.linode.com/networking/vpn-services/openvpn-ub... Problem solved.

pmjordan 16y ago

SOCKS has no inherent encryption and is insecure as hell. Although there is an encrypted mode available in some servers, it's not supported by all clients, and it doesn't defend against MITM attacks, which limits its usefulness. (ever see a SOCKS client with a tickbox "only allow encrypted connections? didn't think so) SOCKS alone doesn't gain you any security advantage, it's SSH that does. Note that if you have a tun/tap driver installed on both endpoints, ssh can even operate as a full-on VPN (-w option), thus not requiring any client software support. None of the above (or OpenVPN) will work on a non-jailbroken iPhone/iPod/iPad, unfortunately. You'll need a pptp or IPSEC server for that. Also beware of apps which do use SSL to communicate but don't check certificates. You'd be surprised how many get this wrong. This leaves the connection wide open to MITM attacks. EDIT: objective arguments > downvoting

atleta 16y ago
You didn't get it. SSH can be used for tunneling (encrypting) TCP connections between two machines and it can be set up so that the SSH client acts as a SOCKS proxy. Client apps connect to the SSH client, it tunnels the traffic trough the encrypted SSH connection to the other side where the SSH server decrypts it and connects to the target host. The traffic is thus encrypted between your machine and the SSH server, can't be sniffed from the air (unless the server is also connected to an insecure WIFI ;) ).
- pmjordan 16y ago
  You didn't read my post: "SOCKS alone doesn't gain you any security advantage, it's SSH that does."