25 ms·

Block YouTube ads on AppleTV by decrypting and stripping ads from Profobuf

1198 points by rolph 3y ago

SergeAx 3y ago
Actually, YouTube as a service holds quite a bit value for me, so I am happily paying for premium subscription, which removes ads and also gives access to YouTube Music.
sgammon 3y ago
Remember, app authors, pin your cert roots! :)
- lucb1e 3y ago
  if you want to DRM your app, yeah. In that case, also don't forget to check for microG or root (super scary stuff, a user having admin on their own device, imagine!) and ensure that the device isn't muted during ads as well as disabling app backups (they might be able to get at their own data!!1) and turning off screenshots (no benefit, but it can be claimed to be a security benefit just like denying root and turning off backups, and it will serve to further annoy the user). If you don't mind that users can see what you're leaking to the server from their device, or sending to their device, then please don't use certificate pinning, or at least make it an option... Not sure which side you're on here
  - lxgr 3y ago
    Unfortunately, there's two types of users MITMing apps, opening their browser's dev console etc.: Those that know what they are doing (i.e. tinkering with the app to find out what makes it work or to modify it), and those that have no idea what any of this means and that get instructed by scammers on the internet (e.g. phone support scams) to do so.
  - sgammon 3y ago
    I’m on the side of guaranteed transport security. What in the world are you talking about? I’m all for privacy but that is regulated via other means — the law.
taspeotis 3y ago
The real tragedy: > In fact, the YouTube app is zippier because fewer connections are made to ad URLs in the first place. I swear on LG TV that webOS runs at a smooth 60 FPS when it's not connected to Wi-Fi and slows down as soon as it phones home for whatever telemetry and ads LG intend to serve me...
- todd3834 3y ago
  In a previous role I was tasked with increasing the lighthouse/pagespeed score across some web properties. After some iterations and very little improvements we would be asked what else we could do. Did we need to speed up the backend? Could we lower latency, etc… The solution: I set up a query param that would disable google tag manager. All of the crazy tracking and telemetry stuff we didn't control was the biggest issue.
  - j16sdiz 3y ago
    Those analystic spend most of its time trying to tell bots apart from real browsers. This is basically an arm race. I am not sure who is to blame, but I guess there is no way we can get the simple web we loved back.
- j16sdiz 3y ago
  This shows how little they care, or poor engineering, or both. Failing all engineering effort, they could have use a beefer CPU...
  - gabereiser 3y ago
    So they can run more ads, negating the performance boost. The answer isn’t simply throw more cpu at the problem.
- te_chris 3y ago
  I’ve never connected my c2 to the internet and it’s great.
- internet101010 3y ago
callalex 3y ago
This write up is a great answer to the often-asked question “how do I learn to be a hacker?”. It does a great job of demonstrating the thought process and painstaking work that goes into any exploit.
- deleted 3y ago
  [deleted]
- deleted 3y ago
  [deleted]
megraf 3y ago
This is an incredible write up. As soon as I saw the steps about patching mitm, I knew this would be special... wow!
quwert95 3y ago
I applaud the author for the depth and detail - this is fantastic. Well done!
sgammon 3y ago
that's not really a "flaw" in protobuf; the protobuf is Working As Intended by decoding the field in a different place when you modify it. i am not sure how one could possibly characterize that as a "flaw," since protobuf is a field-numeric length-prefixed protocol in the first place. it makes a (reasonable) assumption that bytes won't be messed with over the wire, leaving integrity to the reader, so even if this _was_ a flaw, it would be a flaw in the YouTube app for iOS, not in protobuf... since it isn't a flaw, it isn't an "exploit," unless you are referring to the fact that youtube's protobuf exchange on their iOS app isn't checking hashes for returned payloads. i suspect after this post they will
- playingalong 3y ago
  It says January 2022. So likely if they wanted to harden the protocol after the blog post, they would already have.
  - can16358p 3y ago
    But perhaps the article has just got popular now, due to HN?
  - sgammon 3y ago
    Thanks for pointing that out, I hadn't noticed that.
- newaccount74 3y ago
  Yeah, that's some weird editorializing on behalf of the author. The "flaw" is mentioned only in the headline, the text just explains how the format works. It's not a flaw, just working as designed. There's also this bit: > Google makes it computationally expensive to decode, alter, and re-encode without the C++ source proto files Yeah, it's computationally expensive if you use unoptimized Python code to do it. If you write your code in C (or another compiled language) then scanning 1.8MB of protobuf code should be trivial, with or without the proto source files. I'm pretty sure that making Protobuf files hard to decode without sources is not a design goal. If it was, they did a pretty lousy job.
phito 3y ago
Very nice writeup. I was kinda hoping to find a way to MITM devices that don't allow the installation of custom CA's. I have some IoT devices that do not expose a local API and only exposes the data through the cloud, and would like to capture the device to cloud traffic... I guess the only way to do that would be to dump the flash memory, replace the CA and reupload the dump to the device?
- punnerud 3y ago
  It’s called certificate-pinning if they “hard coded” a certificate, yes then you have to replace/remove it and move the same certificate to your MITM proxy to decrypt traffic. A good write up here for ways to try to intercept IoT devices without any hardware/firmware job: https://robertheaton.com/2019/11/21/how-to-man-in-the-middle-your-iot-devices/ https://robertheaton.com/2019/11/21/how-to-man-in-the-middle...
  - lucb1e 3y ago
    Note for other readers: the two sentences in the parent post have nothing to do with each other. The Robert Heathon post does not describe how to break cert pinning without needing hardware/firmware modifications unfortunately. The only relevant thing to repeat here might be this > if you can’t get access to your IOT device’s hardware in order to add a new root CA to it, your journey mostly ends here. Don’t lose hope though. Leave your setup running for a while and see if anything strange happens. When I attempted the above process on my baby’s crib, the device refused to trust Burp’s certificate and so refused to complete a TLS handshake with my laptop. But after a minute or two of repeated failures, the crib started sending out some of its system status data over plain, unencrypted HTTP!
- denkmoon 3y ago
  > I was kinda hoping to find a way to MITM devices that don't allow the installation of custom CA's The point of TLS is to prevent that... You'd be relying on implementation flaws if it were ever achieved. Frankly I expect the days of being able to install our own trusted certificates are numbered on the few devices that do currently allow it.
deleted 3y ago
[deleted]
userbinator 3y ago
I've been MITM'ing my traffic to, among other things, strip ads and rewrite pages with things like custom CSS, ever since I discovered The Proxomitron over 2 decades ago. It does tend to get me profiled as a "bot" by CloudFlare and such, but there are not-so-trivial ways around that too. It also shows why things like remote attestation are hazardous for user freedom.
- greyface- 3y ago
  > It does tend to get me profiled as a "bot" by CloudFlare Since Cloudflare employees are known to lurk here, I'd like to know: is this considered a false positive, or working as intended?
  - rs_rs_rs_rs_rs 3y ago
    Not a CF employee but I am pretty sure it's working as intended as they built and use this: https://github.com/cloudflare/mitmengine https://github.com/cloudflare/mitmengine
    - fulafel 3y ago
      Here's hoping that, if they do it, they'll start blocking corporate TLS mitm regimes too.
      - michaelt 3y ago
        Blocking? Cloudflare provides corporate TLS MITM regimes.
        sgammon 3y ago
        "Corporate MITM" is built into the very idea of PKI. Running your own custom PKI is a completely valid way to operate a network. This is a feature because it allows anyone to establish their own trust tree, completely outside of the public certificate trust network. "Regimes" sounds pejorative but in truth, companies have a duty and in many cases a legal obligation to protect their networks. Prima facie, I don't see any reason at all why interception of traffic in this circumstance is "bad," except maybe a potential for political misuse like any other written medium. I actually think the reverse would be substantially worse: if _only_ the public trust chain was valid in major browsers, we would be completely hosed and there would be no distinguishing factor at all between remote attestation and trust. Thus, corporate TLS interception is, at worst, a necessary byproduct of a very well chosen tradeoff.
Noumenon72 3y ago
Why is toggling `has_premium_lite_entitlement` cheating compared to anything else? What would it do?
- yasoob 3y ago
  I am assuming it would completely prevent ads (so no need to figure out how to filter/block them) as the name of this field suggests that it might be used by YouTube to figure out if someone has a premium subscription or not. Toggling this field would not have led the author to the later protobuf rabbit hole as there would have been no need for it. From personal experience, we programmers/hackers sometimes like to make things more complicated than they need to be just for the fun of it (and learning experience too!).
  - 867-5309 3y ago
    I highly doubt that. it is still only a client-side parameter. the server will still know whether you have paid or not it's a bit like inspecting source on a banking website, altering the balance html, then expecting the displayed value to reflect actual account funds
redrove 3y ago
>I propose heuristically scanning for query and path parameters of ad URLs with high entropy and using those as keys (fingerprints). >https://rr6—sn-uxa0n-t8gz.googlevideo.com/initplayback?source=youtube https://xn--rr6sn-uxa0n-t8gz-vg6i.googlevideo.com/initplayba... &orc=1&oeis=1&c=IOS&oss=1&oda=1&oad=5500&ovd=5500&oaad=11000&oavd=11000 &ocs=700&oputc=1&oses=1&ofpcc=1&osbr=1&osnz=1&msp=1&odeak=1&odepv=1 &osfc=1&id=58cc678216d6aaca&ip=121.35.98.26&initcwndbps=2125000 &mt=1640373902 This is one of the many things that make it _exactly_ like malware. Ads are delivered the same way malicious code or artifacts would be delivered to your device. Weird-ass random subdomains, obfuscated query params -- no legitimate service that works for the user's benefit should behave like this.
- thrdbndndn 3y ago
  >_exactly_ like malware But it's googlevideo.com. I know this is Google/YouTube's domain so the rest doesn't matter.
  - redrove 3y ago
    Which is besides the point and a minor nitpick at best. The fact of the matter is these techniques are well established black hat ways of preventing the user from discovering what you're doing on their device.
    - thrdbndndn 3y ago
      Discovering what exactly? To bad they don't use a subdomain called "adplayback" I guess, but the query parameters are obviously only useful for YouTube internal, not the users. And I won't even call them "obfuscated" -- it's just a batch of switches and plain IP and ID hash.
  - BLKNSLVR 3y ago
    But it's googlevideo.com, how could it be a video of some shyster pimping get-rich-quick investment schemes that are convincing enough to appear totally legit to anyone below the half-way point of the bell curve? But it's a google ad, how could it link to a scam that looks exactly like my bank's website?
speedgoose 3y ago
On a side note, I noticed a rare tracking consent banner. You may want to update it to track users and respect GDPR correctly. It should be possible to refuse as easily as accepting to be tracked, with the same button size and colour, for example. The tracking should start after consent is given. Also, GDPR isn’t so much about accepting cookies but giving consent to be tracked. So many websites get it wrong, and the likelihood that you will have issues is very close to zero, but since it looks like you implemented your banner yourself, you may be interested.
- jampekka 3y ago
  I interpret this as an opt-in as you can just scroll past the banner and not be tracked. If the site starts tracking without clicking the consent the banner is useless, or maybe even worse than useless, from the legal point of view. It's maddening how people just refuse to understand the GDPR. This is likely partly due to intentional misinformation campaigns from the spyware (i.e. advertisement) industry. And then the cargo cult takes care of the rest. The general gist of GDPR is that if you're not doing some shady shit that your visitors wouldn't want you to do, you don't need a consent. As you said, it has nothing to do with cookies. And yes, Google Analytics etc are shady shit that your visitors wouldn't want you to do. Also most of the nags you see all the time are illegal for any sane intepretation of the law. But the regulators just don't care to enforce the law at all. So if you want to do shady shit, just do it without adding to the insult with having to bother with your illegal nag.
- deleted 3y ago
  [deleted]
ajkblue 3y ago
This reminds me of a now-dockerized Privaxy, which is a UBlock-origin blocklist compatible MITM proxy. It’s crazy to see how many ads and tracking scripts are on smart products, especially my TV where so far in my testing it’s over 40% unnecessary traffic. Its been pretty fun to try and strip out ads on my smart-tv apps. https://github.com/deetungsten/webui-privaxy https://github.com/deetungsten/webui-privaxy is the dockerized fork of https://github.com/Barre/privaxy https://github.com/Barre/privaxy
- glitchcrab 3y ago
  How do you get your TV to trust the self signed cert?
  - boesboes 3y ago
    It would not surprise me if most TVs don't check. I remember LG or Samsung using unencrypted FTP to upload viewing data a few years back, so unverified TLS would be an improvement >_<
    - leni536 3y ago
      This should be a scandal if true.
      - jackweirdy 3y ago
        Definitely should be checking certs, though I always worry about the flip side of these device security decisions. if there is no way to update the trusted root certs, your TV becomes terminally ill with software ewaste disease when the manufacturer updates stop coming. I really don’t like hardware becoming waste because we don’t have a better iot cert pool update story I trust YouTube to know how to bake their own cert and trustworthy tls libraries into their apps but I’m not sure if that’s common in other apps
        cassianoleal 3y ago
omnicognate 3y ago
The only alternatives to a service like youtube showing people ads are for its users to pay for it, for it to be funded through donations, for it to be run by the government and paid for through taxation or for it not to exist. I prefer the first or second approaches and Youtube is unusual among social media sites in actually giving me the first option. So I happily pay for premium and while I'd rather that were the only option (I think ad supported content is an inherently socially corrosive model) I dislike the attitude of those who reject ads but also refuse to pay. (Some people are unable to afford it but that's an entirely separate social problem, and it would be unusual for somebody with the skills demonstrated in the article to be struggling to earn a living wage.) What I would be interested in this protobuf inspection approach for would be implementing some decent parental controls. I would very much like to be able to enable/disable individual youtube channels. Currently all I can do is switch the whole site on and off. I have all the necessary infrastructure already, so I might give it a try.
- dijit 3y ago
  I’m in the exact same mindset as you; youtube allows you to pay to rid yourself of ads (which is ironic because the more free you are with money the more attractive you must be to advertisers)- so I think they are better than most. but if I must take an alternative position: the last time I used youtube without premium (which happens sometimes because its not so smooth to log in if its a temporary session); the number and length of the ads was absurd, multiple levels of unskippable ads, minutes long, with volume that is much higher than the content itself. Awful experience and I can see why people who don’t have the free money want to lower it a little. Thats of course not including sponsored content which contains an ad inside the video itself- even YT premium users get those.
  - nerbert 3y ago
    There are extensions that mark these "premium" ads and let you skip them.
- harshitaneja 3y ago
  Very well put. I have tried to argue the same point here and on reddit in past. The only real argument against I get is from the privacy perspective. That people tend to use alternative youtube clients or other such hacks to be able to consume ad free content anonymously and with the current state of google are not very keen on providing it with more information about them. Personally I am trying to degooglify my life including working my own open source alternatives for some services I don't find much other good alternatives for- google keep and google books. But my youtube usage pattern being the data shared with google is quite low on the priority list for me but reasonable minds can differ. On the other hand, if enough do start to pay for youtube premium then we would be able to much more fruitfully present our demands including for privacy when we are actual customers and not the product as in the current dynamics.
figmert 3y ago
Incidentally, this is probably the best getting started guide for pfSense. When I set mine up last year, all tutorials were lacking. It was usually just installing pfSense, or some random settings that anyone would probably go through anyway. Took me awhile to collate the relevant information and set up my pfSense. I did eventually removed it and installed OPNSense, which has similar issues.
vachina 3y ago
I find it easier to install AdGuard extension on Safari and then Apple play the video to the TV. You get native player and no ads.
lacoolj 3y ago
[flagged]
- nelblu 3y ago
  Because for some of us it is distracting, they are loud and obnoxious. Also, the obvious one - limited time to watch TV.
- regedit728 3y ago
  You bought the laptop/PC/television. You request for data from a remote host. The remote host serves you the content. The remote host is also entitled to serve you ads, since they own their end of the communication. You view the content. You are also entitled to not view the ad, since you own the device at which you're viewing their content.
jjallen 3y ago
I just subscribe to YouTube premium to support my favorite application out there. I learn so much from the people who spend hours and hours making videos every month that I am more than happy to pay a measly $13 or whatever it is every month to YouTube.
- hedora 3y ago
  Why not pay via Patreon instead? They take 5-12% of revenue. YouTube premium takes 45%. Also you have more control over where the money goes with Patreon, and they’re far better corporate citizens than google.
- j_bum 3y ago
  *now a monthly $19. Still worth it for me as well, given how much I use it for entertainment and education.
  - mrweasel 3y ago
    I believe you can get it for $9.99 or something like that, if you don't need YouTube Music. The product is called YouTube Premium Lite.
    - o1y32 3y ago
      Only exists in a few countries https://www.theverge.com/2021/8/2/22605455/youtube-premium-lite-pilot-benelux-nordics-experiment-ad-free-subscription https://www.theverge.com/2021/8/2/22605455/youtube-premium-l...
      - carlosjobim 3y ago
        And in other countries full premium is already cheaper than premium lite.
- ThePowerOfFuet 3y ago
  Nebula sounds like a better fit.
dewey 3y ago
Easier solution: You can get YouTube Premium for $2 a month if you just happen to be in Argentinia while you sign up, even if you are using a US credit card to pay.
- Jowsey 3y ago
  Does anyone know if this changes how much your view is worth to creators?
- znpy 3y ago
  Nah. I’m old enough that i don’t care about playing the “catch the mouse” game with all the various ways to borderline-legally pay less (and maybe get your account flagged and suspended - good luck appealing to that). I’ll just block ads, alphabet is doing fine anyway.
  - dewey 3y ago
    > I’ll just block ads, alphabet is doing fine anyway. But as the OP says…the problem is that this is not feasible on mobile or TVs.
    - znpy 3y ago
      I self host one of those proxy services that plays the videos skipping the ads on my phone. I access it in my lan and in my vpn. On my tv… i purposedly picked a tv without any form of smart feature, and have a small nuc to use the aforementioned proxy.
  - npteljes 3y ago
    In the same line of thinking, I just pay what they are asking in my region. It's very good value for money anyways.
- deleted 3y ago
  [deleted]
- zo1 3y ago
  You're not just paying $2 or 5$. You're paying by the fact that you have to "login" to remove those ads with that measly $2.
barbs 3y ago
I know this article is centred on Apple devices but is there a way to block ads on YouTube on Chromecast?
deleted 3y ago
[deleted]
samcat116 3y ago
Cool but I’ll just keep paying for YouTube premium since it provides me incredible value
- kibwen 3y ago
  [flagged]
lobochrome 3y ago
Or just pay for YouTube premium.
- kleiba 3y ago
  This is Hacker News.
dishsoap 3y ago
Surprised to learn that google doesn't make use of certificate pinning in these apps.
iaminsane 3y ago
what the fuck am i reading, so much efforts to get rid of ads. there is much easier way to do that - just buy russian vpn for 3$/month. no ads at all
- sgt 3y ago
  So YouTube works in Russia, but is completely without ads?
  - diimdeep 3y ago
    yes
- npteljes 3y ago
  One of the things I never do is paying someone else to circumvent paying to the original vendor. I either buy it legally, in the correct region, or pirate it for free.
- Moldoteck 3y ago
  Ok, 3 bucks and inconvenience of using a vpn(if free it's also tracking you) and no blocking sponsored blocks and works worse in some countries without vpn? Yeah sure... I pay for premium, but i du this solely for blocking tv ads and yt music, for the rest, ublock and sponsorblock do offer a better experience in browsers and completely free
drt5b7j 3y ago
A few years ago pihole was all the rage. What happened? I'm genuinely asking what are the difference between the two approaches and when is one better than the other.
- cheschire 3y ago
  The article briefly talks about that. I’ll save you the hunt. “ This unboxing and setup has been fun, but I’d like to block all the bad traffic on my network. I’ve been using a workhorse of a DNS-level adblocker called Pi-Hole on a… yes, Pi, but it would be nice if I can reclaim that wee bit of hardware for something else and use a comparable add-on module in pfSense. Let’s explore that now.” So basically that was only doing DNS level blocking. This article is about traffic decryption and manipulation.
- soma8088 3y ago
  Pihole is still a wonderful application. I use it on my home network. One drawback that the pihole has vs pfSense is pihole cannot do anything about devices that have hard coded DNS ips (aka 1.1.1.1 or 8.8.8.8 etc).
  - syntaxing 3y ago
    The hardcoded issue is more of a consumer router limitation than a pihole issue. Any router that can redirect DNS request + dnsmasq can do what pf-blockerng does. You just don’t see it since pfsense does this in the background. All my ubiquiti stuff or Opnsense uses pihole fine with hardcoded DNS including chromecast (I use NextDNS instead of pihole but essentially the same thing).
    - lnauta 3y ago
      Indeed, how it is described in section 3.2 of the article is how I also did it on my home router+pihole combo. Still have add that rule 1 though, dns over tls.
  - ComputerGuru 3y ago
    DNS is really easy to redirect (at the firewall level) since it goes over UDP. The growing problem is DNS over HTTPS, which uses certificates and tcp and is much harder to redirect (without setting up a MITM and distributing the CA to all devices). Fortunately just blocking the DoH domains at the DNS level works, but unlike the global udp port 53 redirect, it’s a cat-and-mouse game.
elif 3y ago
[flagged]
- LUmBULtERA 3y ago
  YouTube Premium starts at $14, not $10, as far as I can see. Maybe only a $4 difference, but 40% higher. In the US.
  - pohuing 3y ago
    Same but in Euro in Germany
- ecshafer 3y ago
  Because YouTube ads like all ads are annoying. For the couple of times a month I end up watching something on YouTube by luck, why would I care about “creators”. I don’t use Spotify.
  - aidos 3y ago
    If you don’t care about the creators then why watch the content? Sure, the subscription might not make sense to you, but either the content has some value or not. The ads are the value exchange. Don’t get me wrong, I don’t like the ads either.
    - fnord123 3y ago
      They made it addictive and it's not possible to uninstall on Android. You can only deactivate the application.
      - lpapez 3y ago
        And what is the effective difference between uninstalling and deactivating it for you, assuming you want to do either of those to prevent over use?
        3y ago
derwiki 3y ago
Great write up — small nit that the Knight and immortality water is from Last Crusade, not Raiders
pers0n 3y ago
The setup looks like it would take a week to setup right.
nntwozz 3y ago
Replacing the YouTube client on tvOS/iOS/macOS with https://github.com/yattee/yattee https://github.com/yattee/yattee and using either https://github.com/iv-org/invidious https://github.com/iv-org/invidious https://github.com/TeamPiped/Piped https://github.com/TeamPiped/Piped as backend is a nice alternative.
- ComputerGuru 3y ago
  > and using either […] as backend [emphasis added] is a nice alternative. Both those links are to alternative YT frontends, though?
  - nntwozz 3y ago
    Yattee connects to these, there is no other way to use the frontend on iOS/tvOS otherwise.
tho2i34234234 3y ago
How long before Google splices in ads into the codec stream ?
lxgr 3y ago
> We’re going to use WireGuard – we have the Intel AES-NI crypto instruction set WireGuard doesn’t actually use AES, as far as I know. In general, it seems like the author somewhat overestimates the CPU requirements for TLS encryption (or equivalently underestimates modern single-board computers): > The CPU requirements to decrypt and re-encrypt HTTPS traffic greatly exceed those available to Raspberry Pis. I'd be really surprised if MITMing TLS on an RPi 4 was actually infeasible, even when using RSA cryptography purely in software. There are Android phones still in use with weaker CPUs than that of the RPi 4, and these use TLS too.
- coder543 3y ago
  I think you're underestimating the CPU requirements. If a weak Android phone is only able to decode 50Mb/s of TLS traffic, that's not a big problem in practice. It's a slow phone, usually connected to slow networks. On the other hand, if you have a gigabit internet connection at home and it is being bottlenecked to 50Mb/s by that weak device sitting between all of your computers and the internet, then that is a big problem. The CPU requirements for TLS are extremely dependent on the desired bandwidth. At even higher bandwidth, offloading onto accelerators becomes important to be able to do it at all. The cost of handshakes is also nontrivial, and can limit the number of connections per second. For a single device, rarely a big deal. For an entire network of devices, it can be a bigger problem.
  - lxgr 3y ago
    > If a weak Android phone is only able to decode 50Mb/s of TLS traffic That's a lower, not an upper bound. An RPi 4 can encrypt/decrypt AES-256-GCM at more than 300 Mbit/s, according to my rough measurements. That's per core, of which it has four. RSA can be much more expensive, but that's besides the point – the author was claiming that AES-NI makes a meaningful difference here, which I'd really doubt even in the case of TLS. (As mentioned above, it can't help at all for Wireguard.)
    - coder543 3y ago
      > That's per core, of which it has four. Which only matters for multiple concurrent connections... a single download would still be a sequential task on a single core at 300Mb/s, which I would find to be an unacceptable bottleneck on my gigabit connection. In reality, it would probably only be 300Mb/s for up to 2 connections, since it needs to both decrypt and reencrypt, which could be parallelized onto 2 cores, otherwise 150Mbps for 4 connections if each connection was handled only on a single core. Either way, it would not be possible to MitM 1Gbps of traffic on a Raspberry Pi 4, with the numbers you provided, only 600Mbps total, and only across multiple connections. It would be an extremely noticeable bottleneck.
z7 3y ago
I just use https://yewtu.be https://yewtu.be. No ads, problem solved.
- teolandon 3y ago
  On an Apple TV?
esaym 3y ago
I found it odd that the article complained about squid proxy being slow. There was a memory leak issue in the 4.x versions, it was fixed sometime in the 5.x version. I dealt with it for like 2 years but could never figure out where the leak was. I charted[0] the process size, you can see in June where I upgraded to 5.7. Before then, I had just cron'd a restart every week. [0] https://i.imgur.com/hRromEd.png https://i.imgur.com/hRromEd.png
hedora 3y ago
From the table of contents: > New Goal: Let’s trick YouTube into believing I am a 70-year-old male living in Italy. Once I somehow convinced ad targeting I was in the market for $500 machine washable silk pajamas for my mistress. Best ads ever, though I wonder what they were paying per impression. After switching to Apple TV, we mostly get incorrectly geo-targeted local ads. It’s better on average, I guess.
lnauta 3y ago
Excellent write up! I learned a lot and there's still much I did not fully understand. In my spare time I got to the point in the article of trying to figure out which URLs are ads and blocking those with a pihole in section 4.11 and failing miserably. Cool to see some techniques I would never consider, and they work!
wg0 3y ago
I would never block ads on YouTube except for paying for it but from engineering standpoint, it's an excellent read.
SnowingXIV 3y ago
This is interesting, I’ve been trying to figure out the best solution for handling blackout rules for sports apps. You pay full price but they specifically block anything in your market which is absolutely ridiculous. Yes, you can slap an antenna on the back and view low resolution local stations assuming you’re picking up a decent signal. Haven’t found the most elegant way. Probably the path of least resistance is getting a separate router and connect the devices AppleTV, firestick, etc to that. But then you’re going to be constantly swapping networks if you wanted to use a different app with location. But even that feels weird because you’re paying monthly for a smart dns service just to appear in a different geolocation. There has to be a better way.
- blibble 3y ago
  vlans with vpns?
- darkstar999 3y ago
  One of the few good reasons to pay for a VPN service that lets you choose a location.
  - SnowingXIV 3y ago
    Any recommendations for this particular use case?
w0mbat 3y ago
MODS It is “protobuf” with a T, not “profobuf”. I know the typo is in the headline on the original article, but it is bad to spread it, and it looks bad on the front page here.
evulhotdog 3y ago
For those of you who use Android TV devices, SmartTube is a wonderful (side loaded) option which supports both hardcoded ad skipping as well as the standard YouTube ads. Completely unaffiliated, just a happy user.
foobarbazetc 3y ago
I know it’s not as fun, but you could also pay for YouTube Premium to remove the ads.
- mankyd 3y ago
  Pay a company for the services it provides!? Blasphemy.
- NorthernCapra 3y ago
  Block all ads, support creators directly if you feel content is worth your money.
  - mwidell 3y ago
    Problem is that everyone just blocks the ads and forget to pay the creators directly, which by the way would be extremely costly and time consuming if you want to pay everyone you watch, therefore the need for a product like YT Premium...
- deleted 3y ago
  [deleted]
remote_phone 3y ago
People create new content because they expect revenue from ads. Without ads, the entire content creation industry would die. If you watch and enjoy YouTube in any capacity you should be ensuring that the creators get paid otherwise you’re robbing yourself of content.
- deleted 3y ago
  [deleted]
kentonv 3y ago
Cool hack overall, but some of the statements about protobuf strike me as odd. > Exploit a Protobuf Flaw to Easily Remove All Ads by Changing One Byte He's intentionally corrupting the tag on one field of the protobuf. The "flaw" is apparently that Protobuf ignores tag numbers it doesn't recognize. But that's not a flaw, it's a core design feature of Protobuf, designed to allow extensibility. > Notice how the Protobuf response payload is 1.87 MiB? As I said, Google makes it computationally expensive to decode, alter, and re-encode without the C++ source proto files, but a quick linear scan takes no effort at all. 1.87MB is not that big, and presumably these messages only come through occasionally, not in a constant stream, so I'm a bit perplexed about the purported performance barrier here. The text seems to be claiming that Protobuf encoding is designed to be expensive to decode, but it's actually the opposite, Protobuf is intended to be efficient to decode. He says you need the source proto (schema) files to make it efficient, but this isn't really true, you can decode directly into UnknownFieldSet easily enough. Or better, he could have written his own fake .proto schema that covers just the one field he is aiming to remove. This would have been much less error-prone than the string-scanning approach which could accidentally match other data where the same byte sequence happened to appear by coincidence. > While computationally expensive, decoding, editing, and re-encoding without the original schema leads to a modified encoding. This is likely because we cannot detect if ZigZag encoding is being used, or if a number is an int32, int64, sint32/64, varint, etc., plus the order of object fields is normally non-deterministic. Here is some Protobuf trivia on the matter: I think he's misunderstanding here. The point is that the Protobuf encoder is allowed to encode fields in any order, hence decoding and immediately re-encoding a message can lead to different bytes. But, the receiver is supposed to treat the message the same regardless. It's unlikely that the YouTube app is going to notice if the field order changes. (I used to work on Protobufs, a long time ago.)
- notjoemama 3y ago
  Brilliant response and observations. I’m not sure I’d agree with this one tiny assertion though: “1.87MB is not that big“ I have lived in rural communities most of my life and unless I’m on my own Wi-Fi, this actually is a big file to download. Maybe they have a workaround for mobile? Mostly I just want to add that rural Wi-Fi still struggles with Web 2.0 architecture. More often we’re operating on 2-4G speeds. Although if you’re in any kind of metro area with a population that supports better infrastructure, 1.87MB has mostly become a small file size. Except maybe at 6pm when everyone on your cable trunk is streaming content. :)
paulcole 3y ago
I found a 16-digit code that I can give to YouTube that blocks ads on all my devices, not just my AppleTV — no additional hacking or effort needed. It works great!
yumraj 3y ago
Qs: to those who are running a MITM proxy Is there no risk running an MITM proxy, even if self hosted, that can see all your financial and other important private communication? I know a couple mentioned here are open source, but are they guaranteed to be safe? How do I know which one (s) are good to use and can be trusted. I want to rub it based on this thread, but have the above concern.
- hrrsn 3y ago
  If your root CA private key is compromised, there's a risk that a threat actor could generate certificates that your device will trust for any domain. MITMProxy is a pretty well known and trusted open source project, but I wrote my own proxy to keep Apollo alive.
- mhils 3y ago
  I can answer this as one of the mitmproxy devs: We're doing this for 10+ years as FOSS, we're a relatively well-known project (so lots of eyes hopefully), our software has absolutely zero telemetry / phone home functionality, and we're developing under our real names. We also have relevant backgrounds in either the security industry and academia, and absolutely no plans to monetize mitmproxy. Does that make it guaranteed to be safe? Not really. I'd personally trust our TLS stack over most IoT TLS implementations, but Chrome/Firefox/Safari will do a better job at e.g. revocation checking. That being said, I'd argue that this is unlikely to be the weakest link in your threat model.
  - deleted 3y ago
    [deleted]
xyst 3y ago
There is always a new way to block ads on YT or any platform. But then a few months later it gets changed rendering these methods useless. Instead, why don’t we attack the advertisers? YT/Google only appear to track “clicks”, but does it actually track purchases as well? In theory, if there are enough fake (bots) and real users clicking through ads but not buying anything. Then that should burn through the advertising budgets. Over time the marketing departments should see that clicks are at an all time high on X platform but conversions are a small percentage of those “clicks” or impressions. Thus pulling out from the platform all together.
- Larrikin 3y ago
  As Nauseum was banned in the Chrome store, so it seems to be fairly effective
Unfrozen0688 3y ago
I get it but... at this point we are back to a HTPC with a full OS that can run full desktop OS with Firefox + Ublock orign and/or Brave.
novok 3y ago
This guy could've had similar results with an android tv device and the smart tube app and saved a shit ton of time and made money in other ways instead.
mvncleaninst 3y ago
This article feels like a fever dream, it's like 5 separate articles rolled into one (where the title is referring to the last one) Makes it kind of hard to digest, impressive as the material is

1198 points by rolph 3y ago

Actually, YouTube as a service holds quite a bit value for me, so I am happily paying for premium subscription, which removes ads and also gives access to YouTube Music.

sgammon 3y ago

Remember, app authors, pin your cert roots! :)

lucb1e 3y ago
if you want to DRM your app, yeah. In that case, also don't forget to check for microG or root (super scary stuff, a user having admin on their own device, imagine!) and ensure that the device isn't muted during ads as well as disabling app backups (they might be able to get at their own data!!1) and turning off screenshots (no benefit, but it can be claimed to be a security benefit just like denying root and turning off backups, and it will serve to further annoy the user). If you don't mind that users can see what you're leaking to the server from their device, or sending to their device, then please don't use certificate pinning, or at least make it an option... Not sure which side you're on here
- lxgr 3y ago
  Unfortunately, there's two types of users MITMing apps, opening their browser's dev console etc.: Those that know what they are doing (i.e. tinkering with the app to find out what makes it work or to modify it), and those that have no idea what any of this means and that get instructed by scammers on the internet (e.g. phone support scams) to do so.
- sgammon 3y ago
  I’m on the side of guaranteed transport security. What in the world are you talking about? I’m all for privacy but that is regulated via other means — the law.

taspeotis 3y ago

The real tragedy: > In fact, the YouTube app is zippier because fewer connections are made to ad URLs in the first place. I swear on LG TV that webOS runs at a smooth 60 FPS when it's not connected to Wi-Fi and slows down as soon as it phones home for whatever telemetry and ads LG intend to serve me...

todd3834 3y ago
In a previous role I was tasked with increasing the lighthouse/pagespeed score across some web properties. After some iterations and very little improvements we would be asked what else we could do. Did we need to speed up the backend? Could we lower latency, etc… The solution: I set up a query param that would disable google tag manager. All of the crazy tracking and telemetry stuff we didn't control was the biggest issue.
- j16sdiz 3y ago
  Those analystic spend most of its time trying to tell bots apart from real browsers. This is basically an arm race. I am not sure who is to blame, but I guess there is no way we can get the simple web we loved back.
j16sdiz 3y ago
This shows how little they care, or poor engineering, or both. Failing all engineering effort, they could have use a beefer CPU...
- gabereiser 3y ago
  So they can run more ads, negating the performance boost. The answer isn’t simply throw more cpu at the problem.
te_chris 3y ago
I’ve never connected my c2 to the internet and it’s great.
internet101010 3y ago

callalex 3y ago

This write up is a great answer to the often-asked question “how do I learn to be a hacker?”. It does a great job of demonstrating the thought process and painstaking work that goes into any exploit.

deleted 3y ago
[deleted]
deleted 3y ago
[deleted]

megraf 3y ago

This is an incredible write up. As soon as I saw the steps about patching mitm, I knew this would be special... wow!

quwert95 3y ago

I applaud the author for the depth and detail - this is fantastic. Well done!

sgammon 3y ago

that's not really a "flaw" in protobuf; the protobuf is Working As Intended by decoding the field in a different place when you modify it. i am not sure how one could possibly characterize that as a "flaw," since protobuf is a field-numeric length-prefixed protocol in the first place. it makes a (reasonable) assumption that bytes won't be messed with over the wire, leaving integrity to the reader, so even if this _was_ a flaw, it would be a flaw in the YouTube app for iOS, not in protobuf... since it isn't a flaw, it isn't an "exploit," unless you are referring to the fact that youtube's protobuf exchange on their iOS app isn't checking hashes for returned payloads. i suspect after this post they will

playingalong 3y ago
It says January 2022. So likely if they wanted to harden the protocol after the blog post, they would already have.
- can16358p 3y ago
  But perhaps the article has just got popular now, due to HN?
- sgammon 3y ago
  Thanks for pointing that out, I hadn't noticed that.
newaccount74 3y ago
Yeah, that's some weird editorializing on behalf of the author. The "flaw" is mentioned only in the headline, the text just explains how the format works. It's not a flaw, just working as designed. There's also this bit: > Google makes it computationally expensive to decode, alter, and re-encode without the C++ source proto files Yeah, it's computationally expensive if you use unoptimized Python code to do it. If you write your code in C (or another compiled language) then scanning 1.8MB of protobuf code should be trivial, with or without the proto source files. I'm pretty sure that making Protobuf files hard to decode without sources is not a design goal. If it was, they did a pretty lousy job.

phito 3y ago

Very nice writeup. I was kinda hoping to find a way to MITM devices that don't allow the installation of custom CA's. I have some IoT devices that do not expose a local API and only exposes the data through the cloud, and would like to capture the device to cloud traffic... I guess the only way to do that would be to dump the flash memory, replace the CA and reupload the dump to the device?

punnerud 3y ago
It’s called certificate-pinning if they “hard coded” a certificate, yes then you have to replace/remove it and move the same certificate to your MITM proxy to decrypt traffic. A good write up here for ways to try to intercept IoT devices without any hardware/firmware job: https://robertheaton.com/2019/11/21/how-to-man-in-the-middle-your-iot-devices/ https://robertheaton.com/2019/11/21/how-to-man-in-the-middle...
- lucb1e 3y ago
  Note for other readers: the two sentences in the parent post have nothing to do with each other. The Robert Heathon post does not describe how to break cert pinning without needing hardware/firmware modifications unfortunately. The only relevant thing to repeat here might be this > if you can’t get access to your IOT device’s hardware in order to add a new root CA to it, your journey mostly ends here. Don’t lose hope though. Leave your setup running for a while and see if anything strange happens. When I attempted the above process on my baby’s crib, the device refused to trust Burp’s certificate and so refused to complete a TLS handshake with my laptop. But after a minute or two of repeated failures, the crib started sending out some of its system status data over plain, unencrypted HTTP!
denkmoon 3y ago
> I was kinda hoping to find a way to MITM devices that don't allow the installation of custom CA's The point of TLS is to prevent that... You'd be relying on implementation flaws if it were ever achieved. Frankly I expect the days of being able to install our own trusted certificates are numbered on the few devices that do currently allow it.

deleted 3y ago

[deleted]

userbinator 3y ago

I've been MITM'ing my traffic to, among other things, strip ads and rewrite pages with things like custom CSS, ever since I discovered The Proxomitron over 2 decades ago. It does tend to get me profiled as a "bot" by CloudFlare and such, but there are not-so-trivial ways around that too. It also shows why things like remote attestation are hazardous for user freedom.

greyface- 3y ago
> It does tend to get me profiled as a "bot" by CloudFlare Since Cloudflare employees are known to lurk here, I'd like to know: is this considered a false positive, or working as intended?
- rs_rs_rs_rs_rs 3y ago
  Not a CF employee but I am pretty sure it's working as intended as they built and use this: https://github.com/cloudflare/mitmengine https://github.com/cloudflare/mitmengine
  - fulafel 3y ago
    Here's hoping that, if they do it, they'll start blocking corporate TLS mitm regimes too.
    - michaelt 3y ago
      Blocking? Cloudflare provides corporate TLS MITM regimes.
      - sgammon 3y ago
        "Corporate MITM" is built into the very idea of PKI. Running your own custom PKI is a completely valid way to operate a network. This is a feature because it allows anyone to establish their own trust tree, completely outside of the public certificate trust network. "Regimes" sounds pejorative but in truth, companies have a duty and in many cases a legal obligation to protect their networks. Prima facie, I don't see any reason at all why interception of traffic in this circumstance is "bad," except maybe a potential for political misuse like any other written medium. I actually think the reverse would be substantially worse: if _only_ the public trust chain was valid in major browsers, we would be completely hosed and there would be no distinguishing factor at all between remote attestation and trust. Thus, corporate TLS interception is, at worst, a necessary byproduct of a very well chosen tradeoff.

Noumenon72 3y ago

Why is toggling `has_premium_lite_entitlement` cheating compared to anything else? What would it do?

yasoob 3y ago
I am assuming it would completely prevent ads (so no need to figure out how to filter/block them) as the name of this field suggests that it might be used by YouTube to figure out if someone has a premium subscription or not. Toggling this field would not have led the author to the later protobuf rabbit hole as there would have been no need for it. From personal experience, we programmers/hackers sometimes like to make things more complicated than they need to be just for the fun of it (and learning experience too!).
- 867-5309 3y ago
  I highly doubt that. it is still only a client-side parameter. the server will still know whether you have paid or not it's a bit like inspecting source on a banking website, altering the balance html, then expecting the displayed value to reflect actual account funds

redrove 3y ago

>I propose heuristically scanning for query and path parameters of ad URLs with high entropy and using those as keys (fingerprints). >https://rr6—sn-uxa0n-t8gz.googlevideo.com/initplayback?source=youtube https://xn--rr6sn-uxa0n-t8gz-vg6i.googlevideo.com/initplayba... &orc=1&oeis=1&c=IOS&oss=1&oda=1&oad=5500&ovd=5500&oaad=11000&oavd=11000 &ocs=700&oputc=1&oses=1&ofpcc=1&osbr=1&osnz=1&msp=1&odeak=1&odepv=1 &osfc=1&id=58cc678216d6aaca&ip=121.35.98.26&initcwndbps=2125000 &mt=1640373902 This is one of the many things that make it _exactly_ like malware. Ads are delivered the same way malicious code or artifacts would be delivered to your device. Weird-ass random subdomains, obfuscated query params -- no legitimate service that works for the user's benefit should behave like this.

thrdbndndn 3y ago
>_exactly_ like malware But it's googlevideo.com. I know this is Google/YouTube's domain so the rest doesn't matter.
- redrove 3y ago
  Which is besides the point and a minor nitpick at best. The fact of the matter is these techniques are well established black hat ways of preventing the user from discovering what you're doing on their device.
  - thrdbndndn 3y ago
    Discovering what exactly? To bad they don't use a subdomain called "adplayback" I guess, but the query parameters are obviously only useful for YouTube internal, not the users. And I won't even call them "obfuscated" -- it's just a batch of switches and plain IP and ID hash.
- BLKNSLVR 3y ago
  But it's googlevideo.com, how could it be a video of some shyster pimping get-rich-quick investment schemes that are convincing enough to appear totally legit to anyone below the half-way point of the bell curve? But it's a google ad, how could it link to a scam that looks exactly like my bank's website?

speedgoose 3y ago

On a side note, I noticed a rare tracking consent banner. You may want to update it to track users and respect GDPR correctly. It should be possible to refuse as easily as accepting to be tracked, with the same button size and colour, for example. The tracking should start after consent is given. Also, GDPR isn’t so much about accepting cookies but giving consent to be tracked. So many websites get it wrong, and the likelihood that you will have issues is very close to zero, but since it looks like you implemented your banner yourself, you may be interested.

jampekka 3y ago
I interpret this as an opt-in as you can just scroll past the banner and not be tracked. If the site starts tracking without clicking the consent the banner is useless, or maybe even worse than useless, from the legal point of view. It's maddening how people just refuse to understand the GDPR. This is likely partly due to intentional misinformation campaigns from the spyware (i.e. advertisement) industry. And then the cargo cult takes care of the rest. The general gist of GDPR is that if you're not doing some shady shit that your visitors wouldn't want you to do, you don't need a consent. As you said, it has nothing to do with cookies. And yes, Google Analytics etc are shady shit that your visitors wouldn't want you to do. Also most of the nags you see all the time are illegal for any sane intepretation of the law. But the regulators just don't care to enforce the law at all. So if you want to do shady shit, just do it without adding to the insult with having to bother with your illegal nag.
deleted 3y ago
[deleted]

ajkblue 3y ago

This reminds me of a now-dockerized Privaxy, which is a UBlock-origin blocklist compatible MITM proxy. It’s crazy to see how many ads and tracking scripts are on smart products, especially my TV where so far in my testing it’s over 40% unnecessary traffic. Its been pretty fun to try and strip out ads on my smart-tv apps. https://github.com/deetungsten/webui-privaxy https://github.com/deetungsten/webui-privaxy is the dockerized fork of https://github.com/Barre/privaxy https://github.com/Barre/privaxy

glitchcrab 3y ago
How do you get your TV to trust the self signed cert?
- boesboes 3y ago
  It would not surprise me if most TVs don't check. I remember LG or Samsung using unencrypted FTP to upload viewing data a few years back, so unverified TLS would be an improvement >_<
  - leni536 3y ago
    This should be a scandal if true.
    - jackweirdy 3y ago
      Definitely should be checking certs, though I always worry about the flip side of these device security decisions. if there is no way to update the trusted root certs, your TV becomes terminally ill with software ewaste disease when the manufacturer updates stop coming. I really don’t like hardware becoming waste because we don’t have a better iot cert pool update story I trust YouTube to know how to bake their own cert and trustworthy tls libraries into their apps but I’m not sure if that’s common in other apps
      - cassianoleal 3y ago

omnicognate 3y ago

The only alternatives to a service like youtube showing people ads are for its users to pay for it, for it to be funded through donations, for it to be run by the government and paid for through taxation or for it not to exist. I prefer the first or second approaches and Youtube is unusual among social media sites in actually giving me the first option. So I happily pay for premium and while I'd rather that were the only option (I think ad supported content is an inherently socially corrosive model) I dislike the attitude of those who reject ads but also refuse to pay. (Some people are unable to afford it but that's an entirely separate social problem, and it would be unusual for somebody with the skills demonstrated in the article to be struggling to earn a living wage.) What I would be interested in this protobuf inspection approach for would be implementing some decent parental controls. I would very much like to be able to enable/disable individual youtube channels. Currently all I can do is switch the whole site on and off. I have all the necessary infrastructure already, so I might give it a try.

dijit 3y ago
I’m in the exact same mindset as you; youtube allows you to pay to rid yourself of ads (which is ironic because the more free you are with money the more attractive you must be to advertisers)- so I think they are better than most. but if I must take an alternative position: the last time I used youtube without premium (which happens sometimes because its not so smooth to log in if its a temporary session); the number and length of the ads was absurd, multiple levels of unskippable ads, minutes long, with volume that is much higher than the content itself. Awful experience and I can see why people who don’t have the free money want to lower it a little. Thats of course not including sponsored content which contains an ad inside the video itself- even YT premium users get those.
- nerbert 3y ago
  There are extensions that mark these "premium" ads and let you skip them.
harshitaneja 3y ago
Very well put. I have tried to argue the same point here and on reddit in past. The only real argument against I get is from the privacy perspective. That people tend to use alternative youtube clients or other such hacks to be able to consume ad free content anonymously and with the current state of google are not very keen on providing it with more information about them. Personally I am trying to degooglify my life including working my own open source alternatives for some services I don't find much other good alternatives for- google keep and google books. But my youtube usage pattern being the data shared with google is quite low on the priority list for me but reasonable minds can differ. On the other hand, if enough do start to pay for youtube premium then we would be able to much more fruitfully present our demands including for privacy when we are actual customers and not the product as in the current dynamics.

figmert 3y ago

Incidentally, this is probably the best getting started guide for pfSense. When I set mine up last year, all tutorials were lacking. It was usually just installing pfSense, or some random settings that anyone would probably go through anyway. Took me awhile to collate the relevant information and set up my pfSense. I did eventually removed it and installed OPNSense, which has similar issues.

vachina 3y ago

I find it easier to install AdGuard extension on Safari and then Apple play the video to the TV. You get native player and no ads.

lacoolj 3y ago

[flagged]

nelblu 3y ago
Because for some of us it is distracting, they are loud and obnoxious. Also, the obvious one - limited time to watch TV.
regedit728 3y ago
You bought the laptop/PC/television. You request for data from a remote host. The remote host serves you the content. The remote host is also entitled to serve you ads, since they own their end of the communication. You view the content. You are also entitled to not view the ad, since you own the device at which you're viewing their content.

jjallen 3y ago

I just subscribe to YouTube premium to support my favorite application out there. I learn so much from the people who spend hours and hours making videos every month that I am more than happy to pay a measly $13 or whatever it is every month to YouTube.

hedora 3y ago
Why not pay via Patreon instead? They take 5-12% of revenue. YouTube premium takes 45%. Also you have more control over where the money goes with Patreon, and they’re far better corporate citizens than google.
j_bum 3y ago
*now a monthly $19. Still worth it for me as well, given how much I use it for entertainment and education.
- mrweasel 3y ago
  I believe you can get it for $9.99 or something like that, if you don't need YouTube Music. The product is called YouTube Premium Lite.
  - o1y32 3y ago
    Only exists in a few countries https://www.theverge.com/2021/8/2/22605455/youtube-premium-lite-pilot-benelux-nordics-experiment-ad-free-subscription https://www.theverge.com/2021/8/2/22605455/youtube-premium-l...
    - carlosjobim 3y ago
      And in other countries full premium is already cheaper than premium lite.
ThePowerOfFuet 3y ago
Nebula sounds like a better fit.

dewey 3y ago

Easier solution: You can get YouTube Premium for $2 a month if you just happen to be in Argentinia while you sign up, even if you are using a US credit card to pay.

Jowsey 3y ago
Does anyone know if this changes how much your view is worth to creators?
znpy 3y ago
Nah. I’m old enough that i don’t care about playing the “catch the mouse” game with all the various ways to borderline-legally pay less (and maybe get your account flagged and suspended - good luck appealing to that). I’ll just block ads, alphabet is doing fine anyway.
- dewey 3y ago
  > I’ll just block ads, alphabet is doing fine anyway. But as the OP says…the problem is that this is not feasible on mobile or TVs.
  - znpy 3y ago
    I self host one of those proxy services that plays the videos skipping the ads on my phone. I access it in my lan and in my vpn. On my tv… i purposedly picked a tv without any form of smart feature, and have a small nuc to use the aforementioned proxy.
- npteljes 3y ago
  In the same line of thinking, I just pay what they are asking in my region. It's very good value for money anyways.
deleted 3y ago
[deleted]
zo1 3y ago
You're not just paying $2 or 5$. You're paying by the fact that you have to "login" to remove those ads with that measly $2.

barbs 3y ago

I know this article is centred on Apple devices but is there a way to block ads on YouTube on Chromecast?

deleted 3y ago

[deleted]

samcat116 3y ago

Cool but I’ll just keep paying for YouTube premium since it provides me incredible value

kibwen 3y ago
[flagged]

lobochrome 3y ago

Or just pay for YouTube premium.

kleiba 3y ago
This is Hacker News.

dishsoap 3y ago

Surprised to learn that google doesn't make use of certificate pinning in these apps.

iaminsane 3y ago

what the fuck am i reading, so much efforts to get rid of ads. there is much easier way to do that - just buy russian vpn for 3$/month. no ads at all

sgt 3y ago
So YouTube works in Russia, but is completely without ads?
- diimdeep 3y ago
  yes
npteljes 3y ago
One of the things I never do is paying someone else to circumvent paying to the original vendor. I either buy it legally, in the correct region, or pirate it for free.
Moldoteck 3y ago
Ok, 3 bucks and inconvenience of using a vpn(if free it's also tracking you) and no blocking sponsored blocks and works worse in some countries without vpn? Yeah sure... I pay for premium, but i du this solely for blocking tv ads and yt music, for the rest, ublock and sponsorblock do offer a better experience in browsers and completely free

drt5b7j 3y ago

A few years ago pihole was all the rage. What happened? I'm genuinely asking what are the difference between the two approaches and when is one better than the other.

cheschire 3y ago
The article briefly talks about that. I’ll save you the hunt. “ This unboxing and setup has been fun, but I’d like to block all the bad traffic on my network. I’ve been using a workhorse of a DNS-level adblocker called Pi-Hole on a… yes, Pi, but it would be nice if I can reclaim that wee bit of hardware for something else and use a comparable add-on module in pfSense. Let’s explore that now.” So basically that was only doing DNS level blocking. This article is about traffic decryption and manipulation.
soma8088 3y ago
Pihole is still a wonderful application. I use it on my home network. One drawback that the pihole has vs pfSense is pihole cannot do anything about devices that have hard coded DNS ips (aka 1.1.1.1 or 8.8.8.8 etc).
- syntaxing 3y ago
  The hardcoded issue is more of a consumer router limitation than a pihole issue. Any router that can redirect DNS request + dnsmasq can do what pf-blockerng does. You just don’t see it since pfsense does this in the background. All my ubiquiti stuff or Opnsense uses pihole fine with hardcoded DNS including chromecast (I use NextDNS instead of pihole but essentially the same thing).
  - lnauta 3y ago
    Indeed, how it is described in section 3.2 of the article is how I also did it on my home router+pihole combo. Still have add that rule 1 though, dns over tls.
- ComputerGuru 3y ago
  DNS is really easy to redirect (at the firewall level) since it goes over UDP. The growing problem is DNS over HTTPS, which uses certificates and tcp and is much harder to redirect (without setting up a MITM and distributing the CA to all devices). Fortunately just blocking the DoH domains at the DNS level works, but unlike the global udp port 53 redirect, it’s a cat-and-mouse game.

elif 3y ago

[flagged]

LUmBULtERA 3y ago
YouTube Premium starts at $14, not $10, as far as I can see. Maybe only a $4 difference, but 40% higher. In the US.
- pohuing 3y ago
  Same but in Euro in Germany
ecshafer 3y ago
Because YouTube ads like all ads are annoying. For the couple of times a month I end up watching something on YouTube by luck, why would I care about “creators”. I don’t use Spotify.
- aidos 3y ago
  If you don’t care about the creators then why watch the content? Sure, the subscription might not make sense to you, but either the content has some value or not. The ads are the value exchange. Don’t get me wrong, I don’t like the ads either.
  - fnord123 3y ago
    They made it addictive and it's not possible to uninstall on Android. You can only deactivate the application.
    - lpapez 3y ago
      And what is the effective difference between uninstalling and deactivating it for you, assuming you want to do either of those to prevent over use?
      - 3y ago

derwiki 3y ago

Great write up — small nit that the Knight and immortality water is from Last Crusade, not Raiders

pers0n 3y ago

The setup looks like it would take a week to setup right.

nntwozz 3y ago

Replacing the YouTube client on tvOS/iOS/macOS with https://github.com/yattee/yattee https://github.com/yattee/yattee and using either https://github.com/iv-org/invidious https://github.com/iv-org/invidious https://github.com/TeamPiped/Piped https://github.com/TeamPiped/Piped as backend is a nice alternative.

ComputerGuru 3y ago
> and using either […] as backend [emphasis added] is a nice alternative. Both those links are to alternative YT frontends, though?
- nntwozz 3y ago
  Yattee connects to these, there is no other way to use the frontend on iOS/tvOS otherwise.

tho2i34234234 3y ago

How long before Google splices in ads into the codec stream ?

lxgr 3y ago

> We’re going to use WireGuard – we have the Intel AES-NI crypto instruction set WireGuard doesn’t actually use AES, as far as I know. In general, it seems like the author somewhat overestimates the CPU requirements for TLS encryption (or equivalently underestimates modern single-board computers): > The CPU requirements to decrypt and re-encrypt HTTPS traffic greatly exceed those available to Raspberry Pis. I'd be really surprised if MITMing TLS on an RPi 4 was actually infeasible, even when using RSA cryptography purely in software. There are Android phones still in use with weaker CPUs than that of the RPi 4, and these use TLS too.

coder543 3y ago
I think you're underestimating the CPU requirements. If a weak Android phone is only able to decode 50Mb/s of TLS traffic, that's not a big problem in practice. It's a slow phone, usually connected to slow networks. On the other hand, if you have a gigabit internet connection at home and it is being bottlenecked to 50Mb/s by that weak device sitting between all of your computers and the internet, then that is a big problem. The CPU requirements for TLS are extremely dependent on the desired bandwidth. At even higher bandwidth, offloading onto accelerators becomes important to be able to do it at all. The cost of handshakes is also nontrivial, and can limit the number of connections per second. For a single device, rarely a big deal. For an entire network of devices, it can be a bigger problem.
- lxgr 3y ago
  > If a weak Android phone is only able to decode 50Mb/s of TLS traffic That's a lower, not an upper bound. An RPi 4 can encrypt/decrypt AES-256-GCM at more than 300 Mbit/s, according to my rough measurements. That's per core, of which it has four. RSA can be much more expensive, but that's besides the point – the author was claiming that AES-NI makes a meaningful difference here, which I'd really doubt even in the case of TLS. (As mentioned above, it can't help at all for Wireguard.)
  - coder543 3y ago
    > That's per core, of which it has four. Which only matters for multiple concurrent connections... a single download would still be a sequential task on a single core at 300Mb/s, which I would find to be an unacceptable bottleneck on my gigabit connection. In reality, it would probably only be 300Mb/s for up to 2 connections, since it needs to both decrypt and reencrypt, which could be parallelized onto 2 cores, otherwise 150Mbps for 4 connections if each connection was handled only on a single core. Either way, it would not be possible to MitM 1Gbps of traffic on a Raspberry Pi 4, with the numbers you provided, only 600Mbps total, and only across multiple connections. It would be an extremely noticeable bottleneck.

z7 3y ago

I just use https://yewtu.be https://yewtu.be. No ads, problem solved.

teolandon 3y ago
On an Apple TV?

esaym 3y ago

I found it odd that the article complained about squid proxy being slow. There was a memory leak issue in the 4.x versions, it was fixed sometime in the 5.x version. I dealt with it for like 2 years but could never figure out where the leak was. I charted[0] the process size, you can see in June where I upgraded to 5.7. Before then, I had just cron'd a restart every week. [0] https://i.imgur.com/hRromEd.png https://i.imgur.com/hRromEd.png

hedora 3y ago

From the table of contents: > New Goal: Let’s trick YouTube into believing I am a 70-year-old male living in Italy. Once I somehow convinced ad targeting I was in the market for $500 machine washable silk pajamas for my mistress. Best ads ever, though I wonder what they were paying per impression. After switching to Apple TV, we mostly get incorrectly geo-targeted local ads. It’s better on average, I guess.

lnauta 3y ago

Excellent write up! I learned a lot and there's still much I did not fully understand. In my spare time I got to the point in the article of trying to figure out which URLs are ads and blocking those with a pihole in section 4.11 and failing miserably. Cool to see some techniques I would never consider, and they work!

wg0 3y ago

I would never block ads on YouTube except for paying for it but from engineering standpoint, it's an excellent read.

SnowingXIV 3y ago

This is interesting, I’ve been trying to figure out the best solution for handling blackout rules for sports apps. You pay full price but they specifically block anything in your market which is absolutely ridiculous. Yes, you can slap an antenna on the back and view low resolution local stations assuming you’re picking up a decent signal. Haven’t found the most elegant way. Probably the path of least resistance is getting a separate router and connect the devices AppleTV, firestick, etc to that. But then you’re going to be constantly swapping networks if you wanted to use a different app with location. But even that feels weird because you’re paying monthly for a smart dns service just to appear in a different geolocation. There has to be a better way.

blibble 3y ago
vlans with vpns?
darkstar999 3y ago
One of the few good reasons to pay for a VPN service that lets you choose a location.
- SnowingXIV 3y ago
  Any recommendations for this particular use case?

w0mbat 3y ago

MODS It is “protobuf” with a T, not “profobuf”. I know the typo is in the headline on the original article, but it is bad to spread it, and it looks bad on the front page here.

evulhotdog 3y ago

For those of you who use Android TV devices, SmartTube is a wonderful (side loaded) option which supports both hardcoded ad skipping as well as the standard YouTube ads. Completely unaffiliated, just a happy user.

foobarbazetc 3y ago

I know it’s not as fun, but you could also pay for YouTube Premium to remove the ads.

mankyd 3y ago
Pay a company for the services it provides!? Blasphemy.
NorthernCapra 3y ago
Block all ads, support creators directly if you feel content is worth your money.
- mwidell 3y ago
  Problem is that everyone just blocks the ads and forget to pay the creators directly, which by the way would be extremely costly and time consuming if you want to pay everyone you watch, therefore the need for a product like YT Premium...
deleted 3y ago
[deleted]

remote_phone 3y ago

People create new content because they expect revenue from ads. Without ads, the entire content creation industry would die. If you watch and enjoy YouTube in any capacity you should be ensuring that the creators get paid otherwise you’re robbing yourself of content.

deleted 3y ago
[deleted]

kentonv 3y ago

Cool hack overall, but some of the statements about protobuf strike me as odd. > Exploit a Protobuf Flaw to Easily Remove All Ads by Changing One Byte He's intentionally corrupting the tag on one field of the protobuf. The "flaw" is apparently that Protobuf ignores tag numbers it doesn't recognize. But that's not a flaw, it's a core design feature of Protobuf, designed to allow extensibility. > Notice how the Protobuf response payload is 1.87 MiB? As I said, Google makes it computationally expensive to decode, alter, and re-encode without the C++ source proto files, but a quick linear scan takes no effort at all. 1.87MB is not that big, and presumably these messages only come through occasionally, not in a constant stream, so I'm a bit perplexed about the purported performance barrier here. The text seems to be claiming that Protobuf encoding is designed to be expensive to decode, but it's actually the opposite, Protobuf is intended to be efficient to decode. He says you need the source proto (schema) files to make it efficient, but this isn't really true, you can decode directly into UnknownFieldSet easily enough. Or better, he could have written his own fake .proto schema that covers just the one field he is aiming to remove. This would have been much less error-prone than the string-scanning approach which could accidentally match other data where the same byte sequence happened to appear by coincidence. > While computationally expensive, decoding, editing, and re-encoding without the original schema leads to a modified encoding. This is likely because we cannot detect if ZigZag encoding is being used, or if a number is an int32, int64, sint32/64, varint, etc., plus the order of object fields is normally non-deterministic. Here is some Protobuf trivia on the matter: I think he's misunderstanding here. The point is that the Protobuf encoder is allowed to encode fields in any order, hence decoding and immediately re-encoding a message can lead to different bytes. But, the receiver is supposed to treat the message the same regardless. It's unlikely that the YouTube app is going to notice if the field order changes. (I used to work on Protobufs, a long time ago.)

notjoemama 3y ago
Brilliant response and observations. I’m not sure I’d agree with this one tiny assertion though: “1.87MB is not that big“ I have lived in rural communities most of my life and unless I’m on my own Wi-Fi, this actually is a big file to download. Maybe they have a workaround for mobile? Mostly I just want to add that rural Wi-Fi still struggles with Web 2.0 architecture. More often we’re operating on 2-4G speeds. Although if you’re in any kind of metro area with a population that supports better infrastructure, 1.87MB has mostly become a small file size. Except maybe at 6pm when everyone on your cable trunk is streaming content. :)

paulcole 3y ago

I found a 16-digit code that I can give to YouTube that blocks ads on all my devices, not just my AppleTV — no additional hacking or effort needed. It works great!

yumraj 3y ago

Qs: to those who are running a MITM proxy Is there no risk running an MITM proxy, even if self hosted, that can see all your financial and other important private communication? I know a couple mentioned here are open source, but are they guaranteed to be safe? How do I know which one (s) are good to use and can be trusted. I want to rub it based on this thread, but have the above concern.

hrrsn 3y ago
If your root CA private key is compromised, there's a risk that a threat actor could generate certificates that your device will trust for any domain. MITMProxy is a pretty well known and trusted open source project, but I wrote my own proxy to keep Apollo alive.
mhils 3y ago
I can answer this as one of the mitmproxy devs: We're doing this for 10+ years as FOSS, we're a relatively well-known project (so lots of eyes hopefully), our software has absolutely zero telemetry / phone home functionality, and we're developing under our real names. We also have relevant backgrounds in either the security industry and academia, and absolutely no plans to monetize mitmproxy. Does that make it guaranteed to be safe? Not really. I'd personally trust our TLS stack over most IoT TLS implementations, but Chrome/Firefox/Safari will do a better job at e.g. revocation checking. That being said, I'd argue that this is unlikely to be the weakest link in your threat model.
- deleted 3y ago
  [deleted]

xyst 3y ago

There is always a new way to block ads on YT or any platform. But then a few months later it gets changed rendering these methods useless. Instead, why don’t we attack the advertisers? YT/Google only appear to track “clicks”, but does it actually track purchases as well? In theory, if there are enough fake (bots) and real users clicking through ads but not buying anything. Then that should burn through the advertising budgets. Over time the marketing departments should see that clicks are at an all time high on X platform but conversions are a small percentage of those “clicks” or impressions. Thus pulling out from the platform all together.

Larrikin 3y ago
As Nauseum was banned in the Chrome store, so it seems to be fairly effective

Unfrozen0688 3y ago

I get it but... at this point we are back to a HTPC with a full OS that can run full desktop OS with Firefox + Ublock orign and/or Brave.

novok 3y ago

This guy could've had similar results with an android tv device and the smart tube app and saved a shit ton of time and made money in other ways instead.

mvncleaninst 3y ago

This article feels like a fever dream, it's like 5 separate articles rolled into one (where the title is referring to the last one) Makes it kind of hard to digest, impressive as the material is