4 ms·

I'm a big fan of the idea of independently-run proxy servers. Caddy has a secure forward proxy plugin born out of a research project at Google that does someth

by mholt 6y ago

I'm a big fan of the idea of independently-run proxy servers. Caddy has a secure forward proxy plugin born out of a research project at Google that does something similar, but works with any clients that let you configure HTTP proxies, and doesn't terminate TLS: instead it tunnels it over TLS. The proxy server itself can also be probe-resistant, i.e. difficult to detect that a website is acting as a proxy. I'm hoping more people can help test the patch to support Caddy v2: https://github.com/caddyserver/forwardproxy/pull/74 https://github.com/caddyserver/forwardproxy/pull/74 (Edit: Disclaimer - Don't use this in situations where your personal safety or freedom could be at risk... not yet. Not until more people with more experience can vet its implementation for bugs, and a very clear threat profile can drawn up. If you have experience with this, we'd love your help.)

2Gkashmiri 6y ago
how does something like this work against DPI? i guess not great? >Don't use this in situations where your personal safety or freedom could be at risk https://theintercept.com/2020/12/06/kashmir-social-media-police/ https://theintercept.com/2020/12/06/kashmir-social-media-pol... https://thewire.in/media/kashmir-journalist-auqib-javeed-police-assault https://thewire.in/media/kashmir-journalist-auqib-javeed-pol... reason why i have a general disregard for technologies that are based on some sort of "link" AFK, phone number or the stupid facebook real name policy. this is as of today being used to crack down on dissent. what you are saying is true but https://thenextweb.com/in/2020/01/08/kashmirs-police-want-people-to-register-their-whatsapp-groups/ https://thenextweb.com/in/2020/01/08/kashmirs-police-want-pe... when you have your govt do this, how can you keep your signal account private? your phone is already listed. isnt it? cant the police see if you are on signal and if online means you are bypassing them somehow regardless of what you might be saying?
- rfoo 6y ago
  > how does something like this work against DPI? i guess not great? No, it's pretty good. Think about it: all DPIs can see is an ordinary https connection. Since the traffic itself is encrypted, to discriminate this from normal web browsing the DPI device can only depend on metadata. Classic moves are: 1. Packet length pattern for TLS-in-TLS. 2. TLS fingerprinting. The first could be defeated by adding padding to the first few packets of each of your connections. [1] The second.. someone built a socks5 <-> https CONNECT proxy client [2] out of Chrome's codebase, which means it shares all the fingerprint with Chrome and you really can't tell. [1] https://github.com/klzgrad/forwardproxy/commit/2350f380f8db2451528863fd12aeed3d3d06ec65 https://github.com/klzgrad/forwardproxy/commit/2350f380f8db2... [2] https://github.com/klzgrad/naiveproxy https://github.com/klzgrad/naiveproxy
theptip 6y ago
Does this use TCP over TCP (painful in the face of packet loss[1]) or can you do something like using QUIC for the forward proxy to try to avoid breaking the tunneled TLS connection's retry timers? [1]: http://sites.inka.de/sites/bigred/devel/tcp-tcp.html http://sites.inka.de/sites/bigred/devel/tcp-tcp.html
- mholt 6y ago
  Http3 support is being talked about in an issue (am mobile so no link for you right now) but the first priority -- pending dev resources -- is to merge the v2 PR and vet for bugs.
- lxgr 6y ago
  It looks like a normal HTTP proxy supporting CONNECT (i.e. TLS over TLS), which wouldn't suffer from the problem you mention. Note that TLS over TLS is _not_ the same thing as TCP over TCP. TCP over TCP is usually only a problem for VPNs or something similar (i.e. anything that sends raw IP packets over TCP).
  - theptip 6y ago
    Ah, that's the piece I was missing. Thanks.
graaCHa 6y ago
White people are so naive that they believe the research sponsored by a giant advertisement company is net positive for the people of the world. Meanwhile Q lives in their closet

by mholt 6y ago

2Gkashmiri 6y ago

how does something like this work against DPI? i guess not great? >Don't use this in situations where your personal safety or freedom could be at risk https://theintercept.com/2020/12/06/kashmir-social-media-police/ https://theintercept.com/2020/12/06/kashmir-social-media-pol... https://thewire.in/media/kashmir-journalist-auqib-javeed-police-assault https://thewire.in/media/kashmir-journalist-auqib-javeed-pol... reason why i have a general disregard for technologies that are based on some sort of "link" AFK, phone number or the stupid facebook real name policy. this is as of today being used to crack down on dissent. what you are saying is true but https://thenextweb.com/in/2020/01/08/kashmirs-police-want-people-to-register-their-whatsapp-groups/ https://thenextweb.com/in/2020/01/08/kashmirs-police-want-pe... when you have your govt do this, how can you keep your signal account private? your phone is already listed. isnt it? cant the police see if you are on signal and if online means you are bypassing them somehow regardless of what you might be saying?

rfoo 6y ago
> how does something like this work against DPI? i guess not great? No, it's pretty good. Think about it: all DPIs can see is an ordinary https connection. Since the traffic itself is encrypted, to discriminate this from normal web browsing the DPI device can only depend on metadata. Classic moves are: 1. Packet length pattern for TLS-in-TLS. 2. TLS fingerprinting. The first could be defeated by adding padding to the first few packets of each of your connections. [1] The second.. someone built a socks5 <-> https CONNECT proxy client [2] out of Chrome's codebase, which means it shares all the fingerprint with Chrome and you really can't tell. [1] https://github.com/klzgrad/forwardproxy/commit/2350f380f8db2451528863fd12aeed3d3d06ec65 https://github.com/klzgrad/forwardproxy/commit/2350f380f8db2... [2] https://github.com/klzgrad/naiveproxy https://github.com/klzgrad/naiveproxy

theptip 6y ago

Does this use TCP over TCP (painful in the face of packet loss[1]) or can you do something like using QUIC for the forward proxy to try to avoid breaking the tunneled TLS connection's retry timers? [1]: http://sites.inka.de/sites/bigred/devel/tcp-tcp.html http://sites.inka.de/sites/bigred/devel/tcp-tcp.html

mholt 6y ago
Http3 support is being talked about in an issue (am mobile so no link for you right now) but the first priority -- pending dev resources -- is to merge the v2 PR and vet for bugs.
lxgr 6y ago
It looks like a normal HTTP proxy supporting CONNECT (i.e. TLS over TLS), which wouldn't suffer from the problem you mention. Note that TLS over TLS is _not_ the same thing as TCP over TCP. TCP over TCP is usually only a problem for VPNs or something similar (i.e. anything that sends raw IP packets over TCP).
- theptip 6y ago
  Ah, that's the piece I was missing. Thanks.

graaCHa 6y ago

White people are so naive that they believe the research sponsored by a giant advertisement company is net positive for the people of the world. Meanwhile Q lives in their closet