Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic
1–10 of 63 posts
Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic
#2I fear that MITMing ads is a dead end:
1. IIUC, when SNI is encrypted (in TLS 1.3?) almost everything is out the window.
2. Local devices can do DNS over HTTPS (DoH) and DNS over QUIC (DoQ) to look up their stuff, so DNS-based blocking will soon be obsolete.
3. The browser itself is controlled by the biggest ad-vendor around (Google), so you’ll probably get no help there.
The only solutions are:
A. Use browsers not controlled by Google (i.e. not any Chrome fork either).
B. Use only apps and devices locally which do not display ads. (This is, in a way, a generalization of A.)
C. Legislate away the business models of ads and the media and “smart” devices which use ads.
(A very similar argument can be made for user tracking and telemetry.)
Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic
#3I really like this, built something similar in Golang a while ago (not open-source for various reasons). In general it's a good approach I think, you can also inject JS that can do additional stuff in the browser to suppress tracking/ads.
Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic
#4> Privaxy is also way more capable than DNS-based blockers as it is able to operate directly on URLs and to inject resources into web pages.
I'm not sure I understand why it would be more capable than a DNS blocker ?
If it's just because you can inject into the traffic that's comparing apples and oranges ? Or am I missing something ?
Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic
#5I fear that MITMing ads is a dead end: 1. IIUC, when SNI is encrypted (in TLS 1.3?) almost everything is out the window. 2. Local devices can do DNS over HTTPS (DoH) and DNS over QUIC (DoQ) to look up their stuff, so DNS-based blocking will soon be obsolete. 3. The browser itself is controlled by the biggest ad-vendor around (Google), so you’ll probably get no help there. The only solutions are: A. Use browsers not c…
[deleted]
Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic
#6I fear that MITMing ads is a dead end: 1. IIUC, when SNI is encrypted (in TLS 1.3?) almost everything is out the window. 2. Local devices can do DNS over HTTPS (DoH) and DNS over QUIC (DoQ) to look up their stuff, so DNS-based blocking will soon be obsolete. 3. The browser itself is controlled by the biggest ad-vendor around (Google), so you’ll probably get no help there. The only solutions are: A. Use browsers not c…
In my understanding ECH/ESNI shouldn't be an issue in this setup as long as the browser issues a domain-specific CONNECT request (i.e. "CONNECT google.com" instead of "CONNECT 24.154.13.11"). I think even with ECH enabled you should be able to impersonate the web server if you have a valid root CA certificate in the browsers' trust store. Remember, you're not performing "hostile" MITM-ing, but explicitly configure a proxy and root certificate in your browser. DNS shouldn't be an issue either as the browser leaves domain resolution to the proxy.
Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic
#7> Privaxy is also way more capable than DNS-based blockers as it is able to operate directly on URLs and to inject resources into web pages. I'm not sure I understand why it would be more capable than a DNS blocker ? If it's just because you can inject into the traffic that's comparing apples and oranges ? Or am I missing something ?
Because you can modify HTML and other resources on the fly, i.e. you can remove tracker scripts before they would even be able to send stuff to a third party.
Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic
#8> Privaxy is also way more capable than DNS-based blockers as it is able to operate directly on URLs and to inject resources into web pages. I'm not sure I understand why it would be more capable than a DNS blocker ? If it's just because you can inject into the traffic that's comparing apples and oranges ? Or am I missing something ?
Let’s say a text based ad shows up in a div with the id “advert”.
A DNS based blocker will not be able to block it, but an extension or a proxy based blocker that looks at the HTML content will be able to block it.
So yeah, inject as well as as modify the HTML directly.
It could do things like shimming advertising libraries as well defanging them potentially.
Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic
#9> Privaxy is also way more capable than DNS-based blockers as it is able to operate directly on URLs and to inject resources into web pages. I'm not sure I understand why it would be more capable than a DNS blocker ? If it's just because you can inject into the traffic that's comparing apples and oranges ? Or am I missing something ?
Simply because it isn't always enough to look at the domain to decide if it should be filtered (for serving ads or whatever). That's one reasons why DNS blockers can filter less effectively than e.g. browser addons.
So yes, the reason is exactly as stated in the quote. It is more capable because it can operate on URLs and on the resources of the website directly.
Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic
#10Why build something fresh and not join forces with pihole? Reinventing the wheel for a niche function doesn't get traction much.
I don't know the reason why the devs of this project think they need to start afresh, there are already tools like Firefox+unlock origin+ pihole which should solve most if not all of the problems. Why not incorporate the defining feature into pihole so that people don't have to add more complexity?
Do I switch off my pihole and set this up?