4 ms·

To this me and a friend started sketching on a VPN/HTTP proxy that will have a set of say 100 outgoing IPs, look at the domains being connected to and distribut

by 3np 6y ago

To this me and a friend started sketching on a VPN/HTTP proxy that will have a set of say 100 outgoing IPs, look at the domains being connected to and distribute request destinations over IPs. So e.g. Google would always see the same IP, which would be different from the one Facebook sees. While access times cross-references and identification is still theoretically possible, it should be an entirely different game. Would anyone else reading this be interested in working on this or joining in? I'm not thinking to make it a startup or business per se but 1) reliable IPs are a bit too expensive to make sense for just 1 person 2) anonymity in numbers. I'm thinking ideal would be something FOSS and easy to self-host and replicate so you can pool together a group of friends for a shared VPN among semi-trusted parties (at least the user should trust the operator to not index requests and sell the data, and the operator should trust users to not run botnets)

nemothekid 6y ago
I think an easier approach is that once you have good IPv6 connectivity you could do something like a unique address per day per host. Every device could have 100M ip addresses and it wouldn't touch the IPv6 address space (10 billion humans * 100 devices = 0.000005% of the IPv6 address space). Edit: My math is wrong. I thought IPv6 was 2^64, but it's actually 2^128, so that percentage is 10^20 times more miniscule.
- 3np 6y ago
  In that scenario those 100 IPv6 addresses in the subnet would be practically equivalent to an IPv4 address today and would provide no extra benefit.
  - croon 6y ago
    It would if hundreds of different users came through those IPs, wouldn't it?
- Fnoord 6y ago
  You get a range from your ISP (e.g. a /64). Everything within that range would be tied to "you" (rather, your connection, but something like user agent would tell its your wife's iPhone or your MacBook Pro).
skinner927 6y ago
Look up browser fingerprinting. It’s a lot more complicated than just obscuring IPs.
- 3np 6y ago
  Oh absolutely, it's not a silver bullet - just an attempt at alleviating that single dimension, which I still think is significant enough to take seriously. IMO there will never be a complete solution but that means we have to tackle each issue or dimension individually within the larger context, not just throw our hands in the air and give up. Maybe should have been more clear on the scope ambition in the OC but can't edit the comment anymore.
- 1vuio0pswjnm7 6y ago
  Yes, but the primary identifier is IP address. The detailed profiles built with fingerprinting and other data are attached to the small set of IP addresses a person uses over the course of her lifetime. Most internet users have limited choice when it comes to internet access. A user cannot change her IP address with the same ease as she can change her software fingerprints. If a company is trying to sell online ad services, then having a database of browser fingerprints purportedly representing real people is not very valuable unless the company can link those fingerprints to real physical locations.
  - oarsinsync 6y ago
    Given the prevalence of CGN, especially in mobile / cellular internet, and the reality that mobile is first for a large number, the use of IPs as a primary key feels less likely these days than a decade ago. > A user cannot change her IP address with the same ease as she can change her software fingerprints. I dunno. It’s a lot easier for my less techie friends to reboot their router and get a new IP than it is to talk them through installing some privacy enforcing software they required regular maintenance or results in weird and wonderful breakage of their favourite websites.
    - 1vuio0pswjnm7 6y ago
jefftk 6y ago
> While access times cross-references and identification is still theoretically possible, it should be an entirely different game. How are you planning to handle communicating identity across sites with link decoration?
- 3np 6y ago
  Could you elaborate on what you mean by this specifically? query params like fbclid? That could be stripped client-side, e.g. via a browser extension. There are already extensions that do this. Previous discussion: https://news.ycombinator.com/item?id=22386388 https://news.ycombinator.com/item?id=22386388
  - jefftk 6y ago
    It sounds to me like your threat model here is that two sites (A and B) which would like to share identity, and you want to stop them? Perhaps A has identity (for example, you log in), A gives you links to B, and B runs some third-party JavaScript served from A. For example, A could be FB/Google/etc and B could be a news site. Site A can add any query parameter it wants to the outgoing link, and then parse it on B in their third-party JavaScript. If they always used the same params (ex: fbclid/gclid) it would be easy to detect and block, but if they were trying to get around the blocking it would be easy to rotate these parameters as often as they wanted because the same entity (A) controls both the producer and the consumer. Now your two identity bubbles have been joined. (Disclosure: I work on ads at Google, speaking only for myself)
    - 3np 6y ago
      Yeah, you summed it up pretty well I think. It's definitely an arms race, and IMO it makes sense to push back on areas where one can. Are you implying that it's not a worthwhile effort and that the battle is lost? I'm thinking 1) DNS control with block lists 2) browser extensions (restricting canvas, removing tracking parts of urls) 3) be restrictive of disclosing PIIs 4) IP obfuscation along the lines I laid about above should make it a lot less deterministic and decrease confidence in merging of datasets. Rule lists obviously have to be continuously updated. Only a sith deals in absolutes but from your perspective am I missing something?
heavyset_go 6y ago
This sounds like a less secure Tor to me.

by 3np 6y ago

nemothekid 6y ago

I think an easier approach is that once you have good IPv6 connectivity you could do something like a unique address per day per host. Every device could have 100M ip addresses and it wouldn't touch the IPv6 address space (10 billion humans * 100 devices = 0.000005% of the IPv6 address space). Edit: My math is wrong. I thought IPv6 was 2^64, but it's actually 2^128, so that percentage is 10^20 times more miniscule.

3np 6y ago
In that scenario those 100 IPv6 addresses in the subnet would be practically equivalent to an IPv4 address today and would provide no extra benefit.
- croon 6y ago
  It would if hundreds of different users came through those IPs, wouldn't it?
Fnoord 6y ago
You get a range from your ISP (e.g. a /64). Everything within that range would be tied to "you" (rather, your connection, but something like user agent would tell its your wife's iPhone or your MacBook Pro).

skinner927 6y ago

Look up browser fingerprinting. It’s a lot more complicated than just obscuring IPs.

3np 6y ago
Oh absolutely, it's not a silver bullet - just an attempt at alleviating that single dimension, which I still think is significant enough to take seriously. IMO there will never be a complete solution but that means we have to tackle each issue or dimension individually within the larger context, not just throw our hands in the air and give up. Maybe should have been more clear on the scope ambition in the OC but can't edit the comment anymore.
1vuio0pswjnm7 6y ago
Yes, but the primary identifier is IP address. The detailed profiles built with fingerprinting and other data are attached to the small set of IP addresses a person uses over the course of her lifetime. Most internet users have limited choice when it comes to internet access. A user cannot change her IP address with the same ease as she can change her software fingerprints. If a company is trying to sell online ad services, then having a database of browser fingerprints purportedly representing real people is not very valuable unless the company can link those fingerprints to real physical locations.
- oarsinsync 6y ago
  Given the prevalence of CGN, especially in mobile / cellular internet, and the reality that mobile is first for a large number, the use of IPs as a primary key feels less likely these days than a decade ago. > A user cannot change her IP address with the same ease as she can change her software fingerprints. I dunno. It’s a lot easier for my less techie friends to reboot their router and get a new IP than it is to talk them through installing some privacy enforcing software they required regular maintenance or results in weird and wonderful breakage of their favourite websites.
  - 1vuio0pswjnm7 6y ago

jefftk 6y ago

> While access times cross-references and identification is still theoretically possible, it should be an entirely different game. How are you planning to handle communicating identity across sites with link decoration?

3np 6y ago
Could you elaborate on what you mean by this specifically? query params like fbclid? That could be stripped client-side, e.g. via a browser extension. There are already extensions that do this. Previous discussion: https://news.ycombinator.com/item?id=22386388 https://news.ycombinator.com/item?id=22386388
- jefftk 6y ago
  It sounds to me like your threat model here is that two sites (A and B) which would like to share identity, and you want to stop them? Perhaps A has identity (for example, you log in), A gives you links to B, and B runs some third-party JavaScript served from A. For example, A could be FB/Google/etc and B could be a news site. Site A can add any query parameter it wants to the outgoing link, and then parse it on B in their third-party JavaScript. If they always used the same params (ex: fbclid/gclid) it would be easy to detect and block, but if they were trying to get around the blocking it would be easy to rotate these parameters as often as they wanted because the same entity (A) controls both the producer and the consumer. Now your two identity bubbles have been joined. (Disclosure: I work on ads at Google, speaking only for myself)
  - 3np 6y ago
    Yeah, you summed it up pretty well I think. It's definitely an arms race, and IMO it makes sense to push back on areas where one can. Are you implying that it's not a worthwhile effort and that the battle is lost? I'm thinking 1) DNS control with block lists 2) browser extensions (restricting canvas, removing tracking parts of urls) 3) be restrictive of disclosing PIIs 4) IP obfuscation along the lines I laid about above should make it a lot less deterministic and decrease confidence in merging of datasets. Rule lists obviously have to be continuously updated. Only a sith deals in absolutes but from your perspective am I missing something?

heavyset_go 6y ago

This sounds like a less secure Tor to me.