5 ms·

Don't forget that historically, a "half-measure" a lot of people used to use to get around regional blocking was "web proxies" like those linked to by proxy.org

Don't forget that historically, a "half-measure" a lot of people used to use to get around regional blocking was "web proxies" like those linked to by proxy.org. I used to operate one as a young teen and I will say they are a security nightmare -- nothing stopping a web proxy operator from sniffing all user credentials passing through them, and modifying PHPRoxy to do this is trivial. Personally I used to run a domain parking service (back when I was a teen in the early 00s) that used the domains as web proxies and replaced all adsense blocks it could find in the content with my adsense code, and did a 50/50 split between my code and the domain owner's code. Google eventually became wise to this and banned that sort of thing but it was pretty cool while it lasted, and honestly I think it was super fair considering we didn't even add any ad blocks just re-used the existing ones already in the content.

lxgr 3y ago
With practically-ubiquitous HTTPS, these days proxy use is mainly a privacy risk since for HTTPS, they usually can only support transparent byte relaying anyway.
- sam0x17 3y ago
  web proxies completely bypass any protection offered by HTTPS as they act as a true man-in-the-middle and place requests on behalf of the user. Unlike traditional proxies, web proxies are entirely web based and use a web interface so literally all the data flows through the server side code of the web proxy.
- winternewt 3y ago
  So like a VPN?
  - lxgr 3y ago
    Not really. In my view, VPNs (at least the type discussed here) and proxies are complementary: VPNs are good at encrypting/redirecting all of your device's traffic, since they're per-computer by default. They're accordingly good at preventing metadata leaks (e.g. visited sites or used apps) on untrusted networks. Proxies are opt-in, but can accordingly be much more fine-grained. For example, Firefox supports per-domain (via various extensions) or per-tab (via the built-in "containers" feature) proxies – VPNs usually can't do that.
    - ignoramous 3y ago
      VPNs can, if they can be routed into via SOCKS or Http Connect gateways, for example. Generally, VPNs (L2/L3) can stoop to the level of proxies (L4) but not vice versa (at least not as cleanly).
      - lxgr 3y ago
        Sure, you can bridge in either direction (using e.g. this [1] excellent Wireguard-to-SOCKS adapter), but in my view, if you have bytestream semantics, you're often better off using a bytestream-oriented proxying protocol (like SOCKS, SSH or HTTP) and vice versa. These bridges/adapters do have their applications though – I have a home router that supports Wireguard natively, but not any of the higher-level protocols; this lets me use my per-tab approach with it. [1] https://github.com/pufferffish/wireproxy https://github.com/pufferffish/wireproxy
        dizhn 3y ago
        I don't really get the value proposition of wireproxy. Especially since it seems not to be complete yet. It is trivial to run a socks proxy on one of the peers and have your browser point to that. Both chrome and firefox can do this on demand and for the sites you select.
        lxgr 3y ago
        There is no peer capable of running a SOCKS proxy in my scenario. My home router only supports Wireguard. SOCKS is also usually not encrypted.
        dizhn 3y ago
        I have a docker based proxy running on a vm. (I've tried a bunch of them. They all work fine. None of them are hugely better at the bandwidth levels available to me - around 50-70mbps) The proxy is only listening on the wireguard IP. I have my clients connect to that wireguard peer and use the wireguard IP as the proxy. You can't install a proxy on the remote side? It should be possible seeing that you have to install something anyway. I am not sure about not needing root but it should not be a requirement for a proxy server since all it does is make http requests on your behalf.
- codetrotter 3y ago
  > for HTTPS, they usually can only support transparent byte relaying anyway. On my LAN I run Squid on a Raspberry Pi, and have my personal laptop configured to use that as a HTTP and HTTPS proxy. All TLS HTTP connections going through the Squid proxy are intercepted. This only requires that my laptop trusts a self-signed TLS certificate that Squid uses. Someone could easily run the same kind of thing on the internet, providing free proxy service and telling their users to trust a certificate signed by them, without properly explaining the consequences of that. And a lot of novice users would likely use that proxy service. Gleefully unaware that even the “encrypted” traffic is completely visible to the proxy. In fact, I would be extremely surprised if there aren’t a whole gazillion of services out there doing exactly that. But in many jurisdictions running a service like that would likely be cybercrime. And even if it wasn’t illegal, it’s still not nice. So, you know, don’t go and actually create a service like that.
  - deleted 3y ago
    [deleted]
  - josephcsible 3y ago
    > This only requires that my laptop trusts a self-signed TLS certificate that Squid uses. The word "only" is doing a lot of work there.
    - kelnos 3y ago
      Yeah, I've thought about having a CA for my home LAN services, and then have my phone and laptop trust that CA, but I'm terrified of the possibility that my CA could be compromised, and then someone could intercept my traffic to my bank or whatever. So I just put up with clicking through the TLS cert errors every now and then.
      - teakie 3y ago
        maybe just use LAN as it was intended? wired!? sounds as stupid as it get's to have something that can replace valid certs on your system.
      - 3y ago
AdmiralAsshat 3y ago
> nothing stopping a web proxy operator from sniffing all user credentials passing through them, and modifying PHPRoxy to do this is trivial That's why you go through seven proxies.
- sam0x17 3y ago
  web proxies aren't traditional proxies. They have a web interface and issue requests on behalf of the user server side, so all of the user's data flows through the user interface and the server side in plain text (though protected by the HTTPS of the web proxy itself). This is fine if you 100% trust the web proxy, but a malicious web proxy operator could easily look at all your data.
- hollerith 3y ago
  Uh, I hope you realize that that does not stop or even slow down credential sniffing.
  - coryrc 3y ago
    https://knowyourmeme.com/memes/good-luck-im-behind-7-proxies https://knowyourmeme.com/memes/good-luck-im-behind-7-proxies
- barkingcat 3y ago
  no, that's why you tunnel through seven proxies, each being used with different sets of credentials/encryption keys, all disposable. The last tunnel is not the main data channel, but the channel you use to coordinate command and control, and then you use a botnet to distribute pieces of your real communications.
Bluecobra 3y ago
I used to pay a small fee for a shell account by some UK provider so I could setup a SOCKS proxy over a SSH tunnel. I suppose they could have captured my egress traffic but I trusted them not to that. I was just using it to watch BBC iPlayer/Channel 4 from the US anyways. :)

lxgr 3y ago

With practically-ubiquitous HTTPS, these days proxy use is mainly a privacy risk since for HTTPS, they usually can only support transparent byte relaying anyway.

sam0x17 3y ago
web proxies completely bypass any protection offered by HTTPS as they act as a true man-in-the-middle and place requests on behalf of the user. Unlike traditional proxies, web proxies are entirely web based and use a web interface so literally all the data flows through the server side code of the web proxy.
winternewt 3y ago
So like a VPN?
- lxgr 3y ago
  Not really. In my view, VPNs (at least the type discussed here) and proxies are complementary: VPNs are good at encrypting/redirecting all of your device's traffic, since they're per-computer by default. They're accordingly good at preventing metadata leaks (e.g. visited sites or used apps) on untrusted networks. Proxies are opt-in, but can accordingly be much more fine-grained. For example, Firefox supports per-domain (via various extensions) or per-tab (via the built-in "containers" feature) proxies – VPNs usually can't do that.
  - ignoramous 3y ago
    VPNs can, if they can be routed into via SOCKS or Http Connect gateways, for example. Generally, VPNs (L2/L3) can stoop to the level of proxies (L4) but not vice versa (at least not as cleanly).
    - lxgr 3y ago
      Sure, you can bridge in either direction (using e.g. this [1] excellent Wireguard-to-SOCKS adapter), but in my view, if you have bytestream semantics, you're often better off using a bytestream-oriented proxying protocol (like SOCKS, SSH or HTTP) and vice versa. These bridges/adapters do have their applications though – I have a home router that supports Wireguard natively, but not any of the higher-level protocols; this lets me use my per-tab approach with it. [1] https://github.com/pufferffish/wireproxy https://github.com/pufferffish/wireproxy
      - dizhn 3y ago
        I don't really get the value proposition of wireproxy. Especially since it seems not to be complete yet. It is trivial to run a socks proxy on one of the peers and have your browser point to that. Both chrome and firefox can do this on demand and for the sites you select.
        lxgr 3y ago
        There is no peer capable of running a SOCKS proxy in my scenario. My home router only supports Wireguard. SOCKS is also usually not encrypted.
        dizhn 3y ago
        I have a docker based proxy running on a vm. (I've tried a bunch of them. They all work fine. None of them are hugely better at the bandwidth levels available to me - around 50-70mbps) The proxy is only listening on the wireguard IP. I have my clients connect to that wireguard peer and use the wireguard IP as the proxy. You can't install a proxy on the remote side? It should be possible seeing that you have to install something anyway. I am not sure about not needing root but it should not be a requirement for a proxy server since all it does is make http requests on your behalf.
codetrotter 3y ago
> for HTTPS, they usually can only support transparent byte relaying anyway. On my LAN I run Squid on a Raspberry Pi, and have my personal laptop configured to use that as a HTTP and HTTPS proxy. All TLS HTTP connections going through the Squid proxy are intercepted. This only requires that my laptop trusts a self-signed TLS certificate that Squid uses. Someone could easily run the same kind of thing on the internet, providing free proxy service and telling their users to trust a certificate signed by them, without properly explaining the consequences of that. And a lot of novice users would likely use that proxy service. Gleefully unaware that even the “encrypted” traffic is completely visible to the proxy. In fact, I would be extremely surprised if there aren’t a whole gazillion of services out there doing exactly that. But in many jurisdictions running a service like that would likely be cybercrime. And even if it wasn’t illegal, it’s still not nice. So, you know, don’t go and actually create a service like that.
- deleted 3y ago
  [deleted]
- josephcsible 3y ago
  > This only requires that my laptop trusts a self-signed TLS certificate that Squid uses. The word "only" is doing a lot of work there.
  - kelnos 3y ago
    Yeah, I've thought about having a CA for my home LAN services, and then have my phone and laptop trust that CA, but I'm terrified of the possibility that my CA could be compromised, and then someone could intercept my traffic to my bank or whatever. So I just put up with clicking through the TLS cert errors every now and then.
    - teakie 3y ago
      maybe just use LAN as it was intended? wired!? sounds as stupid as it get's to have something that can replace valid certs on your system.
    - 3y ago

AdmiralAsshat 3y ago

> nothing stopping a web proxy operator from sniffing all user credentials passing through them, and modifying PHPRoxy to do this is trivial That's why you go through seven proxies.

sam0x17 3y ago
web proxies aren't traditional proxies. They have a web interface and issue requests on behalf of the user server side, so all of the user's data flows through the user interface and the server side in plain text (though protected by the HTTPS of the web proxy itself). This is fine if you 100% trust the web proxy, but a malicious web proxy operator could easily look at all your data.
hollerith 3y ago
Uh, I hope you realize that that does not stop or even slow down credential sniffing.
- coryrc 3y ago
  https://knowyourmeme.com/memes/good-luck-im-behind-7-proxies https://knowyourmeme.com/memes/good-luck-im-behind-7-proxies
barkingcat 3y ago
no, that's why you tunnel through seven proxies, each being used with different sets of credentials/encryption keys, all disposable. The last tunnel is not the main data channel, but the channel you use to coordinate command and control, and then you use a botnet to distribute pieces of your real communications.

Bluecobra 3y ago

I used to pay a small fee for a shell account by some UK provider so I could setup a SOCKS proxy over a SSH tunnel. I suppose they could have captured my egress traffic but I trusted them not to that. I was just using it to watch BBC iPlayer/Channel 4 from the US anyways. :)