9 ms·
Why are free proxies free? (2013)
- 99jessy 12y agoIts free and thats why its free
- jjp 12y agoWould be interesting to see how many free proxies are actually injectng JS or changing the html in anyway.
- Goopplesoft 12y agoMost do actually, most links on html are changed so that you continue using the proxy, JS is often removed, etc.
- Retr0spectrum 12y agoYou are referring to a web-based proxy.
- ryan-c 12y agoFor extra fun, the proxy may only start injecting things once you've been using it for a while - it can appear safe to a cursory check.
- olla 12y agoChanging advertisements, to take credit for views and clicks, would be quite beneficial. This would could go un-noticed by the viewer for a long time too. I would not be surprised if a lot of these free proxy servers do just that.
- chmars 12y agoZenMate (https://zenmate.com/ https://zenmate.com/) is a popular German proxy service – and it's free … cui bono?
- nonninz 12y agoWell ZenMate is a VERY well funded startup offering a freemium service. While their desktop proxy service is free, they also offer a premium account for their VPN services for mobile. See: http://techcrunch.com/2014/10/01/zenmate/ http://techcrunch.com/2014/10/01/zenmate/
- chmars 12y agoThe _plan_ to offer a premium account: https://zenmate.com/pricing/ https://zenmate.com/pricing/
- Goopplesoft 12y ago> extra piece of code that does things like send all data entered in forms to your server Assuming you're injecting JS, the site isn't SSL meaning all that data is available to the proxy anyway (its part of their operation). The botnet angle is much more interesting than the loss of privacy one.
- sillysaurus3 12y agoWhat happens if the user tries to visit a site with https, like gmail? Can the free proxy still be destructive? I assume yes, but I'm interested in hearing about the technical details.
- witty_username 12y agoMost of the web (you type the URL into the proxy's webpag) "HTTPS" proxies found by Google search only give results that the proxy has encrypted. However, through TCP proxies (through which HTTPS can be supported), the attacker can only do an SSL-strip attack.
- sillysaurus3 12y agoWait... If people can't use proxies to surf with HTTPS, then how does HTTPS provide any security when using Tor? Tor is basically a proxy, and the only reason Tor is safe is because of HTTPS-everywhere. I'm having trouble figuring out why HTTPS works on Tor but not for these kinds of proxies. My understanding is that you should be able to set up a TLS session with a destination server while you're routing your traffic through a robot-in-the-middle. And the robot shouldn't be able to harm your content in any way, due to the encryption. (I originally said that a free proxy could still cause harm, but if HTTPS is involved, I'm pretty sure that's not true, otherwise Tor wouldn't work. It could drop the connection, but it shouldn't be able to modify anything.)
- witty_username 12y agoTor is a TCP proxy. It doesn't matter to HTTPS; the TLS part is being done with the client through the TCP connection (which is actually routed through Tor but HTTPS doesn't care). And HTTPS through Tor is as secure as doing it through any other way. _However_, many free online proxies, e.g. HideMyAss, will simply fetch the page and send it to the client encrypted using their key. In this case, the TLS part is being done with the proxy website, not the actual website being requested. (Basically original website sends encrypted data to the proxy; proxy decrypts it and then encrypts it with its own key; proxy sends to browser.) (Tor, however, will simply send the raw TCP packets back to the client). HTTPS tries to perform two goals: encryption: all the data is encrypted which means that a malicious agent can not sniff the data authentication: since the data is signed by the website's key it can't be modified by an attacker. The way HTTPS works is so that it's impossible to sniff the data or modify the data without having the session key (that might not be the correct name; but I don't remember). The session key is stored on the client and server. Without access to either of these machines it's impossible to break HTTPS. However, the proxy could drop packets obviously.
- antimora 12y agoOnce my ISP (Cox Communication) injected a message into a web page I was reading to notify me of their planned service downtime. So I wonder the legality aspect of this type of injection. Is anyone who transmits data can modify pages?
- johansch 12y agoI'm not aware of any such case going to court anywhere, although it probably has by now. In Sweden a couple of years ago, the largest mobile operator Telia injected some toolbar with ads on top of all mobile web content. Within a working day literally all of the swedish media sites had collectively blocked all access to their web sites from Telia mobile IP ranges. The next day the ad toolbar was gone.
- yourad_io 12y ago> Within a working day literally all of the swedish media sites had collectively blocked all access to their web sites from Telia mobile IP ranges. The next day the ad toolbar was gone. That's amazing - the market kicking back in full force and putting a giant back in its place. In other markets/regions this would just pass. Do you have a source? I tried some googling but my English keywords seem to have no power ;)
- johansch 12y agohttps://translate.google.com/translate?sl=sv&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fjardenberg.se%2Ftelia-surf-closed-not-open%2F&edit-text= https://translate.google.com/translate?sl=sv&tl=en&js=y&prev... and https://translate.googleusercontent.com/translate_c?depth=1&hl=en&ie=UTF8&prev=_t&rurl=translate.google.com&sl=sv&tl=en&u=http://www.dagensmedia.se/nyheter/article13360.ece&usg=ALkJrhjV0Lmar5Sl0xQfoIvITPpfV7j7kw https://translate.googleusercontent.com/translate_c?depth=1&... Seems like my memory was a bit hazy. The issue was that not that they inserted their own ads on top of mobile content, but that they inadvertedly blocked some ad content in the actual sites.
- pizza 12y agoProbably what's happening across the world's middle schools: MSN/facebook/youtube blocked by the school firewall? No problem, I know a kid who can get us around it. Here, she says, just google proxies, and we click on the first one, and proceed to enter our credentials..
- ics 12y agoOne of the first things I did at that age whenever changing schools was to set up a couple proxies to get around SonicWall or whatever my school would be using. I added a link to my Facebook and usually a funny pic from around the web to the landing page... definitely one of the easiest ways for an introvert to get others to remember their name... Edit: Oddly, nobody from the schools ever called me out on it despite PII on the page and the WHOIS data (I was using personal domains at that point, .com and .info). I can't remember if Tor ever worked, but back then it was slow as hell anyway because even the school's "high-speed" connection wasn't close by today's standards. Further edit: I was trying to learn PHP at the time, and was using some existing scripts along with dinky little modifications. It wasn't malicious, but a couple times it was fun to manually post stats for which sites were the most visited. The type of sites people used it for was not surprising. Regrettably I never took it far enough to do anything clever, instead pretty much abandoning code for following couple years. Fun memories since I'd mostly buried that whole period as "boring, non-technical, and embarrassingly childish" stuff.
- halflings 12y agoWell, you were particularly techy' for that age :) ; It does remind me of my childhood though, and that even in elementary school there is such a thing as the "tech guy".
- JonnieCache 12y agoIndeed. CGIproxy ftw.
- skrebbel 12y agoI suspect most just use their phones instead.
- danjayh 12y agoI think an obvious, if not particularly harmful thing for a free proxy to do would be replacement of ads with ones that pay to the proxy owner, and injection of affiliate links whenever possible. I wonder how common that is?
- joshmn 12y agoSomeone I know very well runs one of the largest proxy networks. "Why wouldn't we? Our users aren't particularly tech-savvy, and we've calculated that 90% of our [user] base doesn't have an adblocker of such installed. ... [we] see 90% [of our income, combined with our VPN services] from injecting ads - sometimes, they are more relevant than what the visiting site serves."
- hackerboos 12y agoA lot of the Pirate Bay proxies did this. It's a good earner.
- flavor8 12y agoBack in 2001 I did some consulting for CyberRebate, who were building exactly this. In return for running their proxy you'd earn reward points that you could cash in on their site. They imploded (http://en.wikipedia.org/wiki/CyberRebate http://en.wikipedia.org/wiki/CyberRebate) before the product was launched.
- pranayairan 12y agointeresting, i never thought about such attack matrix.
- stepstep 12y agoIn the future, I imagine almost every site will use HTTPS—maybe browsers will even refuse to connect over plain HTTP. Then this kind of attack won't be possible.
- skrebbel 12y agoI'm sure that there will be free proxies that "require you to install this program" (which also installs a certificate) to work. But yeah, it helps for e.g. the middle schoolers who don't have admin rights on the computers anyway.
- TeMPOraL 12y agoI.e. it helps making our broken education system even worse?
- sleepychu 12y agoThis isn't really fair, you can't trust 100s/1000s of children you don't know to look after systems well.
- TeMPOraL 12y agoThis is called "learning experience". How children are supposed to not think of computers as magic boxes if they're prohibited from doing anything interesting on it (and that very much includes breaking them and fixing by themselves)? Restoring the machines back to original state should be a trivial task for whoever is responsible for the computer room.
- danneu 12y ago> How children are supposed to not think of > computers as magic boxes if they're prohibited > from doing anything interesting on it (and that > very much includes breaking them and fixing by > themselves)? The first thing every kid did in the computer lab was highlight all the icons on the desktop and try to delete them. We already knew how to use computers because we had one at home to mess with. The whole goal of the computer lab was to figure out how to create a bomb for the next user. Now pretend we aren't in the heights or mid/upper burbs anymore. There is no IT/networking staff. It's just Mr. Perkins, the English teacher that volunteered to look after the computer room. And there are kids without computers in their household. Too bad, all the computers are hosed because lol.
- msoad 12y agoSome proxy providers ask users to install client-side apps. You don't have to do all this dance to see what user is seeing if you can install a binary on users machine. This is what most of people in Iran and China do. One way or another, somebody is watching. Either it's the NSA or some ad agency interested in your browsing habits while you "bypass" the filters.
- jedisct1 12y agoQuite a few non-free "privacy apps" just route your traffic through free, open proxies that they keep scanning. So, of course, you end up being completely exposed to snooping and injections.
- ksrm 12y agoCould you name names?
- read 12y agoI would pay for a safe proxy. Why are there no proxy-as-a-service companies?
- higherpurpose 12y agoDoes ZenMate qualify? https://zenmate.com/ https://zenmate.com/
- shocks 12y agoWhy a proxy over a VPN?
- merqurio 12y agoEasier to configure some times ? dunno
- yc1010 12y agoOne reason would be if you have coded a robot to scrape http(s) content of other sites, its easier to configure wget/curl/own_code to use your proxy (or even a list of own proxies) than seting up vpn, see my post above in this thread about setting up tinyproxy can also use haproxy if its only one specific site you are scraping
- gog 12y agoWhat are the benefits (or use cases) over the classic VPN service?
- yc1010 12y ago1. Buy/spinup a cheap vps (aws or digitalocean) 2. Install tinyproxy (apt-get install tinyproxy) 3. Configure it to bind to the vps public ip, set a high port, limit access to your home/work ip address or range(s) 4. Set your browser proxy to vps.ip.add.res:12345 The above is simple and effective, only downside anyone else on your ip or range you specified can use that proxy too (if they find out the ip:port and if they done steps 3 and 4 above). You can switch off the vps when not using it (saving you money)
- binaryanomaly 12y ago"There ain't no such thing as a free proxy..." - Internet pirate
- alimoeeny 12y agoAnother group of users of free proxies (I had been in that group in the past), are people living in countries behind state run firewalls/filters. You want to read the news, or even check your email (in some cases) and you need a proxy. You cannot afford to run your own proxy. So you use the free ones, AND YOU KNOW they are not safe, but you don't have a choice.
- dogma1138 12y agoIf you live in one of those countries using the proxy will get you into the same trouble as reading those sites in the first place, heck probably into even more trouble.
- jrochkind1 12y agoAre you guessing, or have you seen actual reports/investigations that say that? I don't think it's so. China, for instance, doesn't have nearly the resources (or at least doesn't choose to use them) to 'get into trouble' anyone who looks at censored content, say, via a proxy. They just make it as difficult as possible to access. One study suggested that even posting unallowed content might escape without censorship (let alone punishment) -- unless the posted content attracts discussion from others, and thus the algorithms make it look like you might actually be organizing. http://gking.harvard.edu/files/gking/files/experiment_0.pdf http://gking.harvard.edu/files/gking/files/experiment_0.pdf
- eli 12y agoImagine you're sitting in a cafe trying to read nytimes.com. You're not worried about some Cyber Police kicking in the door, you just want a way around the block.
- jarfil 12y agoTL;DR: TANSTAAFL
- jldugger 12y agoAs the saying goes, if you're not paying for it, you're not the customer, you're the product.
- curiously 12y agoHow would you get a new ip address on demand or is there such service out there? What about all these sites that sell paid proxies, can be trusted?
- bbcbasic 12y agoWouldn't be hard for them to make your next executable download point to something with ransomware, but with the name you downloaded. Scary stuff.
- kbart 12y agoMD5 sum check is intended to protect against such situation. I just would like to see statistics of how often it is actually used..
- jfoster 12y agoCouldn't this also be applied to WiFi hotspots? This really makes quite a strong case for sites to add HTTPS.
- tbg 12y ago>Tell your friends never to use free proxies Nah, just use Private/Incognito windows when using "free" proxies
- blevinstein 12y agoA friend of mine setup a simple PHP-based proxy while he was in high school, to get around the firewall. Then, he modified it slightly to scrape facebook username/passwords, and gave the URL to all his friends. :) I wonder whether modern security practices (e.g. https everywhere) will make proxies less lucrative (and therefore less common).