4 ms·

Tor – Snowflake Makes It Easy for Anyone to Fight Censorship

35 points by Trouble_007 4y ago

tanseydavid 4y ago
Interesting choice of name (and logo) given the proliferation of Snowflake DB.
- MikeDelta 4y ago
  The title made me think it was about Snowflake the DB company indeed.
apeace 4y ago
I'm confused. The article states that Snowflake uses domain fronting to connect users to forwarding peers. They use Google as an example: > ... domain fronting lets the client make a request that looks like an ordinary web request for google.com ... To block Snowflake, a network or country would have to block all of Google But Google disabled domain fronting in 2018. Amazon did as well[0]. Cloudflare disabled it in 2015. The article even links to this Wikipedia page[1] on domain fronting, which states that all three of these providers have disabled domain fronting. So... how does it work? [0] https://signal.org/blog/looking-back-on-the-front/ https://signal.org/blog/looking-back-on-the-front/ [1] https://en.wikipedia.org/wiki/Domain_fronting#Disabling https://en.wikipedia.org/wiki/Domain_fronting#Disabling
- brianbrush 4y ago
  The Tor Project are currently using Fastly as the default for domain fronting in their Snowflake plugin, with cdn.sstatic.net (which serves various assets for Stack Exchange sites) as the front host, and snowflake-broker.torproject.net.global.prod.fastly.net as the target host. Prior to this, they were fronting via Azure, using ajax.aspnetcdn.com as the front for target snowflake-broker.azureedge.net. But they switched to Fastly after Microsoft announced they'd be changing their policy to explicitly block domain fronting: https://www.microsoft.com/security/blog/2021/03/26/securing-our-approach-to-domain-fronting-within-azure https://www.microsoft.com/security/blog/2021/03/26/securing-...
  - apeace 4y ago
    Thanks for that info. So it sounds like the article is just inaccurate wrt Google. But that has some pretty big implications. Blocking Stack Exchange is very different from blocking Google. Snowflake and anything else relying on domain fronting are quickly becoming non-viable. I wonder what the next stage in the rat race will be?
jrootabega 4y ago
> The security concerns for the Snowflake proxy operator are minimal. The Snowflake client will not be able to interact with your computer in any way or observe your network traffic, and you will not be able to see their traffic. From the perspective of your ISP it will look like you are connecting to a Tor bridge, which if you are running a Snowflake proxy should be legal and unrestricted in your country. There is no more risk running a Snowflake proxy than running Tor browser. Isn't this a little sugarcoated? Your IP will now be known/knowable as a target to people you may consider bad. Running a Tor browser is between you, your ISP, and the bridge/entry.
sterwill 4y ago
Years ago, I ran a tor relay (not exit node!) on my stable home internet connection. I forgot all about it for months and months, and then when I was trying to update a home insurance claim, I kept getting weird site errors. Pages would half-load, I'd get 500 errors submitting forms, etc. I wasn't _using_ tor at all, just normal Firefox like always. I peeked at the failed AJAX calls and I saw that the site was denying my traffic because I was classified as a high risk endpoint. The name of their WAF/filtering vendor was in the error responses or headers, so I found a free way to query that company's threat database for my home IP. There it was, my IP was marked high risk because it was associated with a tor relay. It's a silly threat correlation, in my opinion, but it was enough of an annoyance that I stopped running the relay so I didn't have to worry about flaky firewalls. The ironic thing was, I could have probably fired up Tor Browser and tried new exit nodes until I found a fresh one their system didn't know about, just to finish updating my claim! I actually just tethered my laptop to my phone, I think. PS I forgot to ask: does anyone know if Snowflake is as detectable as a normal bridge or relay node? If so, there's the risk that your home connection gets a risk/reputation strike against like mine did.
- xx__yy 4y ago
  Cool story - thanks for sharing. I've got a spare laptop and started a TOR relay (no exit) recently - I'll be on the look out for these kind of errors
xx__yy 4y ago
I wish there were some sort of monitoring tool for the docker container, so you know if you're actually doing any good (it's working), like the browser extension. Something like nyx (for tor) but for snowflake.

35 points by Trouble_007 4y ago

tanseydavid 4y ago

Interesting choice of name (and logo) given the proliferation of Snowflake DB.

MikeDelta 4y ago
The title made me think it was about Snowflake the DB company indeed.

apeace 4y ago

I'm confused. The article states that Snowflake uses domain fronting to connect users to forwarding peers. They use Google as an example: > ... domain fronting lets the client make a request that looks like an ordinary web request for google.com ... To block Snowflake, a network or country would have to block all of Google But Google disabled domain fronting in 2018. Amazon did as well[0]. Cloudflare disabled it in 2015. The article even links to this Wikipedia page[1] on domain fronting, which states that all three of these providers have disabled domain fronting. So... how does it work? [0] https://signal.org/blog/looking-back-on-the-front/ https://signal.org/blog/looking-back-on-the-front/ [1] https://en.wikipedia.org/wiki/Domain_fronting#Disabling https://en.wikipedia.org/wiki/Domain_fronting#Disabling

brianbrush 4y ago
The Tor Project are currently using Fastly as the default for domain fronting in their Snowflake plugin, with cdn.sstatic.net (which serves various assets for Stack Exchange sites) as the front host, and snowflake-broker.torproject.net.global.prod.fastly.net as the target host. Prior to this, they were fronting via Azure, using ajax.aspnetcdn.com as the front for target snowflake-broker.azureedge.net. But they switched to Fastly after Microsoft announced they'd be changing their policy to explicitly block domain fronting: https://www.microsoft.com/security/blog/2021/03/26/securing-our-approach-to-domain-fronting-within-azure https://www.microsoft.com/security/blog/2021/03/26/securing-...
- apeace 4y ago
  Thanks for that info. So it sounds like the article is just inaccurate wrt Google. But that has some pretty big implications. Blocking Stack Exchange is very different from blocking Google. Snowflake and anything else relying on domain fronting are quickly becoming non-viable. I wonder what the next stage in the rat race will be?

jrootabega 4y ago

> The security concerns for the Snowflake proxy operator are minimal. The Snowflake client will not be able to interact with your computer in any way or observe your network traffic, and you will not be able to see their traffic. From the perspective of your ISP it will look like you are connecting to a Tor bridge, which if you are running a Snowflake proxy should be legal and unrestricted in your country. There is no more risk running a Snowflake proxy than running Tor browser. Isn't this a little sugarcoated? Your IP will now be known/knowable as a target to people you may consider bad. Running a Tor browser is between you, your ISP, and the bridge/entry.

sterwill 4y ago

Years ago, I ran a tor relay (not exit node!) on my stable home internet connection. I forgot all about it for months and months, and then when I was trying to update a home insurance claim, I kept getting weird site errors. Pages would half-load, I'd get 500 errors submitting forms, etc. I wasn't _using_ tor at all, just normal Firefox like always. I peeked at the failed AJAX calls and I saw that the site was denying my traffic because I was classified as a high risk endpoint. The name of their WAF/filtering vendor was in the error responses or headers, so I found a free way to query that company's threat database for my home IP. There it was, my IP was marked high risk because it was associated with a tor relay. It's a silly threat correlation, in my opinion, but it was enough of an annoyance that I stopped running the relay so I didn't have to worry about flaky firewalls. The ironic thing was, I could have probably fired up Tor Browser and tried new exit nodes until I found a fresh one their system didn't know about, just to finish updating my claim! I actually just tethered my laptop to my phone, I think. PS I forgot to ask: does anyone know if Snowflake is as detectable as a normal bridge or relay node? If so, there's the risk that your home connection gets a risk/reputation strike against like mine did.

xx__yy 4y ago
Cool story - thanks for sharing. I've got a spare laptop and started a TOR relay (no exit) recently - I'll be on the look out for these kind of errors

xx__yy 4y ago

I wish there were some sort of monitoring tool for the docker container, so you know if you're actually doing any good (it's working), like the browser extension. Something like nyx (for tor) but for snowflake.