5 ms·

I'd never used Tor, though had to scrape a bunch of things that required different IPs. I figured their endpoints were already tarred. With the porn block in t

I'd never used Tor, though had to scrape a bunch of things that required different IPs. I figured their endpoints were already tarred. With the porn block in the UK though, the "New Private Window with Tor" in Brave is very convenient. Maybe not for long, or maybe not. I guess websites don't need to comply beyond a certain point. There are tons of "residential proxy" and whatnot type services available, IP being a source of truth doesn't seem to matter much in 2025. The Perplexity 'bot' recent topic being an example of that. Basically if you want to access any resource on the web for a dollar a GB or so you can use millions of IPs.

freedomben 1y ago
Indeed, I've investigated some cyber attacks recently that came from residential IPs in California and NY, though investigation turned up the real origins as coming from India. It's pretty easy to pull off nowadays
- deadbabe 1y ago
  Any tutorial?
  - mzajc 1y ago
    Residential proxies usually piggy back off unsuspecting users, either through hacked routers/IoT, malicious browser extensions, malicious smartphone applications, or any other kind of malware. If you're looking for a tutorial on how to infect and exploit users, you're not on the right site. As an illustration of how bad things are on just the browser extension front: https://sponsor.ajay.app/emails/ https://sponsor.ajay.app/emails/
    - deadbabe 1y ago
      I’m asking how do you determine the real origins as being from India when they are using residential ips as proxies.
      - freedomben 1y ago
        Yeah, I'm debating whether I should disclose that or not. I am generally a believer in disclosure, but simple awareness of how I figured it out would enable them to better hide their tracks. I think I probably will disclose it, but I need to think on it just a little bit more first
        deadbabe 1y ago
        Could you share privately somehow?
        chatmasta 1y ago
        Not OP but there are many methods, with more available as you gain more execution privileges. On the “no privileges” end, you have things like accept-language and ping times (which can be coupled with known location of exit node to get an extremely rough “ping to exit” time.. not very useful but at least another data point). Then you have linkage to other devices, e.g. same account logs into site with and without VPN. Or if you have any inputs from the user (search history), maybe they make some typos or Autocorrect that leaks metadata about their native language. On the “some privileges” point of the spectrum, if you’ve got JavaScript execution, you can learn a _lot_ about the region of the user. And on the “many privileges” side, where you’ve got native code execution in a mobile app or similar, it’s game over. For literature on this kind of thing, look into “PETS” (privacy enhancing technology) research. Incidentally, Tor spends a lot of time plugging these holes in their browser…
        teiferer 1y ago
        Tbh, all these sound like obvious noob mistakes. If I'd be trying to fake coming from NY then of course I don't use my russian-language browser or run Javascript code in a non-sandboxed environment that leaks where I am. The login and auto-complete channels don't really work either because all those things use HTTPS/SSL/TLS/... nowadays and you are rarely the endpoint. If you are and they still do this then again, they don't really know what they are doing. It doesn't need a highly skilled+funded state actor to avoid those mistakes.
    - freedomben 1y ago
      Indeed. Plenty of shady VPN providers over the years have done exactly this, offering a free VPN service but silently using your residential IP as an exit node for paying customers
trod1234 1y ago
The problem with most infrastructure is that there's a big gap in security where it centralizes, and its transparent. To understand how, you should review the Princeton Report's Raptor attack, and understand how it works (2015).
SV_BubbleTime 1y ago
>With the porn block in the UK though, the "New Private Window with Tor" in Brave is very convenient. Has someone interested in seeing privacy secured into the future, I’ve been happy that governments are accelerating their censorship for this reason.
- chii 1y ago
  Tho trying to solve a social issue with technological solutions is just going to force the other side's hand more. Tor/vpn might work today, but there's no telling what new laws tomorrow will be enacted to ban vpns. And having such laws (that everyone breaks) is just a way for the gov't to selectively punish those they deem troublesome - a great chilling effect. The way to fight these draconian laws is via democratic means - even if it takes long and arduous. For example, enshrining privacy into constitutional guarantees etc.
  - hkt 1y ago
    It depends on the motivations of the people behind the ban, though. VPNs aren't terribly interesting to the government over a porn age verification plan, largely because subscribing to a VPN costs money and requires a debit card. Some might manage that, but most probably won't. If the motivation was to ban porn entirely and they valued that more than they valued giving business a break (banning VPNs being rather bad news for some companies) then it'd be another story.
    - chii 1y ago
      > largely because subscribing to a VPN costs money and requires a debit card. there are VPNs that are proxied out of local residential IP because these gateways are running off users' machines; these VPNs are "free" (they make money by making you run their gateway, and then sell your IP to botnets for example). i would want to envision a true p2p vpn network not too dissimilar to bittorrent (but without the spyware/malware).
      - SV_BubbleTime 1y ago

freedomben 1y ago

Indeed, I've investigated some cyber attacks recently that came from residential IPs in California and NY, though investigation turned up the real origins as coming from India. It's pretty easy to pull off nowadays

deadbabe 1y ago
Any tutorial?
- mzajc 1y ago
  Residential proxies usually piggy back off unsuspecting users, either through hacked routers/IoT, malicious browser extensions, malicious smartphone applications, or any other kind of malware. If you're looking for a tutorial on how to infect and exploit users, you're not on the right site. As an illustration of how bad things are on just the browser extension front: https://sponsor.ajay.app/emails/ https://sponsor.ajay.app/emails/
  - deadbabe 1y ago
    I’m asking how do you determine the real origins as being from India when they are using residential ips as proxies.
    - freedomben 1y ago
      Yeah, I'm debating whether I should disclose that or not. I am generally a believer in disclosure, but simple awareness of how I figured it out would enable them to better hide their tracks. I think I probably will disclose it, but I need to think on it just a little bit more first
      - deadbabe 1y ago
        Could you share privately somehow?
        chatmasta 1y ago
        Not OP but there are many methods, with more available as you gain more execution privileges. On the “no privileges” end, you have things like accept-language and ping times (which can be coupled with known location of exit node to get an extremely rough “ping to exit” time.. not very useful but at least another data point). Then you have linkage to other devices, e.g. same account logs into site with and without VPN. Or if you have any inputs from the user (search history), maybe they make some typos or Autocorrect that leaks metadata about their native language. On the “some privileges” point of the spectrum, if you’ve got JavaScript execution, you can learn a _lot_ about the region of the user. And on the “many privileges” side, where you’ve got native code execution in a mobile app or similar, it’s game over. For literature on this kind of thing, look into “PETS” (privacy enhancing technology) research. Incidentally, Tor spends a lot of time plugging these holes in their browser…
        teiferer 1y ago
        Tbh, all these sound like obvious noob mistakes. If I'd be trying to fake coming from NY then of course I don't use my russian-language browser or run Javascript code in a non-sandboxed environment that leaks where I am. The login and auto-complete channels don't really work either because all those things use HTTPS/SSL/TLS/... nowadays and you are rarely the endpoint. If you are and they still do this then again, they don't really know what they are doing. It doesn't need a highly skilled+funded state actor to avoid those mistakes.
  - freedomben 1y ago
    Indeed. Plenty of shady VPN providers over the years have done exactly this, offering a free VPN service but silently using your residential IP as an exit node for paying customers

trod1234 1y ago

The problem with most infrastructure is that there's a big gap in security where it centralizes, and its transparent. To understand how, you should review the Princeton Report's Raptor attack, and understand how it works (2015).

SV_BubbleTime 1y ago

>With the porn block in the UK though, the "New Private Window with Tor" in Brave is very convenient. Has someone interested in seeing privacy secured into the future, I’ve been happy that governments are accelerating their censorship for this reason.

chii 1y ago
Tho trying to solve a social issue with technological solutions is just going to force the other side's hand more. Tor/vpn might work today, but there's no telling what new laws tomorrow will be enacted to ban vpns. And having such laws (that everyone breaks) is just a way for the gov't to selectively punish those they deem troublesome - a great chilling effect. The way to fight these draconian laws is via democratic means - even if it takes long and arduous. For example, enshrining privacy into constitutional guarantees etc.
- hkt 1y ago
  It depends on the motivations of the people behind the ban, though. VPNs aren't terribly interesting to the government over a porn age verification plan, largely because subscribing to a VPN costs money and requires a debit card. Some might manage that, but most probably won't. If the motivation was to ban porn entirely and they valued that more than they valued giving business a break (banning VPNs being rather bad news for some companies) then it'd be another story.
  - chii 1y ago
    > largely because subscribing to a VPN costs money and requires a debit card. there are VPNs that are proxied out of local residential IP because these gateways are running off users' machines; these VPNs are "free" (they make money by making you run their gateway, and then sell your IP to botnets for example). i would want to envision a true p2p vpn network not too dissimilar to bittorrent (but without the spyware/malware).
    - SV_BubbleTime 1y ago