4 ms·

> extra piece of code that does things like send all data entered in forms to your server Assuming you're injecting JS, the site isn't SSL meaning all that dat

> extra piece of code that does things like send all data entered in forms to your server Assuming you're injecting JS, the site isn't SSL meaning all that data is available to the proxy anyway (its part of their operation). The botnet angle is much more interesting than the loss of privacy one.

sillysaurus3 12y ago
What happens if the user tries to visit a site with https, like gmail? Can the free proxy still be destructive? I assume yes, but I'm interested in hearing about the technical details.
- witty_username 12y ago
  Most of the web (you type the URL into the proxy's webpag) "HTTPS" proxies found by Google search only give results that the proxy has encrypted. However, through TCP proxies (through which HTTPS can be supported), the attacker can only do an SSL-strip attack.
  - sillysaurus3 12y ago
    Wait... If people can't use proxies to surf with HTTPS, then how does HTTPS provide any security when using Tor? Tor is basically a proxy, and the only reason Tor is safe is because of HTTPS-everywhere. I'm having trouble figuring out why HTTPS works on Tor but not for these kinds of proxies. My understanding is that you should be able to set up a TLS session with a destination server while you're routing your traffic through a robot-in-the-middle. And the robot shouldn't be able to harm your content in any way, due to the encryption. (I originally said that a free proxy could still cause harm, but if HTTPS is involved, I'm pretty sure that's not true, otherwise Tor wouldn't work. It could drop the connection, but it shouldn't be able to modify anything.)
    - witty_username 12y ago
      Tor is a TCP proxy. It doesn't matter to HTTPS; the TLS part is being done with the client through the TCP connection (which is actually routed through Tor but HTTPS doesn't care). And HTTPS through Tor is as secure as doing it through any other way. _However_, many free online proxies, e.g. HideMyAss, will simply fetch the page and send it to the client encrypted using their key. In this case, the TLS part is being done with the proxy website, not the actual website being requested. (Basically original website sends encrypted data to the proxy; proxy decrypts it and then encrypts it with its own key; proxy sends to browser.) (Tor, however, will simply send the raw TCP packets back to the client). HTTPS tries to perform two goals: encryption: all the data is encrypted which means that a malicious agent can not sniff the data authentication: since the data is signed by the website's key it can't be modified by an attacker. The way HTTPS works is so that it's impossible to sniff the data or modify the data without having the session key (that might not be the correct name; but I don't remember). The session key is stored on the client and server. Without access to either of these machines it's impossible to break HTTPS. However, the proxy could drop packets obviously.
      - sillysaurus3 12y ago
        Right, of course. Thanks so much for clarifying the concepts in my head. It's difficult to keep track sometimes. Would it be true to say that HTTPS-over-proxy provides zero security for the end user, since a proxy must be able to encrypt raw HTTP requests/results on behalf of the client? In other words, the proxy can be blatantly malicious against the user, and the client won't even be able to realize that. The only security would be against any third-party eavesdroppers (someone else besides the user, proxy, or final website). I might be wrong about that too, but I'm trying to grok it.
        icebraining 12y ago
        Yes, the proxy has full control of the connection, they're essentially a MITM with all that implies.
        MichaelGG 12y ago
  - nothrabannosir 12y ago
    Mainstream browsers do not readily support HTTPS connections to proxies. FF only very recently introduced this, Chrome needs you to specify the proxy URL on the command line. Even when you do, the connection to the proxy being HTTPS has nothing to do with the "https://" https://" you see in the browser. Bottom line: do you see a green "https://...google.com/..." https://...google.com/..." ? Then you are safe. SSL stripping will NOT go undetected, without compromising your computer in some way (fake root CA). For more info, search the net for SSL strip tools and look at their features. E.g.: homograph domain names, rewriting https:// https:// links to http:// http://, or using self-signed CAs (will cause SSL warning). If you find a real, clean SSL strip, make sure to post it here to HN. Guaranteed you will make the front page ;)
    - witty_username 12y ago
      oh nvm I misunderstood SSL strip.
    - deleted 12y ago
      [deleted]

sillysaurus3 12y ago

What happens if the user tries to visit a site with https, like gmail? Can the free proxy still be destructive? I assume yes, but I'm interested in hearing about the technical details.

witty_username 12y ago
Most of the web (you type the URL into the proxy's webpag) "HTTPS" proxies found by Google search only give results that the proxy has encrypted. However, through TCP proxies (through which HTTPS can be supported), the attacker can only do an SSL-strip attack.
- sillysaurus3 12y ago
  Wait... If people can't use proxies to surf with HTTPS, then how does HTTPS provide any security when using Tor? Tor is basically a proxy, and the only reason Tor is safe is because of HTTPS-everywhere. I'm having trouble figuring out why HTTPS works on Tor but not for these kinds of proxies. My understanding is that you should be able to set up a TLS session with a destination server while you're routing your traffic through a robot-in-the-middle. And the robot shouldn't be able to harm your content in any way, due to the encryption. (I originally said that a free proxy could still cause harm, but if HTTPS is involved, I'm pretty sure that's not true, otherwise Tor wouldn't work. It could drop the connection, but it shouldn't be able to modify anything.)
  - witty_username 12y ago
    Tor is a TCP proxy. It doesn't matter to HTTPS; the TLS part is being done with the client through the TCP connection (which is actually routed through Tor but HTTPS doesn't care). And HTTPS through Tor is as secure as doing it through any other way. _However_, many free online proxies, e.g. HideMyAss, will simply fetch the page and send it to the client encrypted using their key. In this case, the TLS part is being done with the proxy website, not the actual website being requested. (Basically original website sends encrypted data to the proxy; proxy decrypts it and then encrypts it with its own key; proxy sends to browser.) (Tor, however, will simply send the raw TCP packets back to the client). HTTPS tries to perform two goals: encryption: all the data is encrypted which means that a malicious agent can not sniff the data authentication: since the data is signed by the website's key it can't be modified by an attacker. The way HTTPS works is so that it's impossible to sniff the data or modify the data without having the session key (that might not be the correct name; but I don't remember). The session key is stored on the client and server. Without access to either of these machines it's impossible to break HTTPS. However, the proxy could drop packets obviously.
    - sillysaurus3 12y ago
      Right, of course. Thanks so much for clarifying the concepts in my head. It's difficult to keep track sometimes. Would it be true to say that HTTPS-over-proxy provides zero security for the end user, since a proxy must be able to encrypt raw HTTP requests/results on behalf of the client? In other words, the proxy can be blatantly malicious against the user, and the client won't even be able to realize that. The only security would be against any third-party eavesdroppers (someone else besides the user, proxy, or final website). I might be wrong about that too, but I'm trying to grok it.
      - icebraining 12y ago
        Yes, the proxy has full control of the connection, they're essentially a MITM with all that implies.
      - MichaelGG 12y ago
- nothrabannosir 12y ago
  Mainstream browsers do not readily support HTTPS connections to proxies. FF only very recently introduced this, Chrome needs you to specify the proxy URL on the command line. Even when you do, the connection to the proxy being HTTPS has nothing to do with the "https://" https://" you see in the browser. Bottom line: do you see a green "https://...google.com/..." https://...google.com/..." ? Then you are safe. SSL stripping will NOT go undetected, without compromising your computer in some way (fake root CA). For more info, search the net for SSL strip tools and look at their features. E.g.: homograph domain names, rewriting https:// https:// links to http:// http://, or using self-signed CAs (will cause SSL warning). If you find a real, clean SSL strip, make sure to post it here to HN. Guaranteed you will make the front page ;)
  - witty_username 12y ago
    oh nvm I misunderstood SSL strip.
  - deleted 12y ago
    [deleted]