Live data from Hacker News

Show HN: Privaxy – Like uBlock but through a MitM proxy and no browser extension

github.com

11–14 of 14 posts

Re: Show HN: Privaxy – Like uBlock but through a MitM proxy and no browser extension

#11
post #8

Earlier quoted context omitted.

You have to give up trust in some way. I trust extensions running on all websites less than I trust a mitm proxy, because the mitm proxy doesn't have the ability to run code in the browser process itself. Its capabilities are similar or even higher and unlike intentional TLS mitm attacks, addon redirection is near impossible to find in the browser UI. Reading through the code I see very little in the way of webPKI nu…

I use mitm proxies for my research, and very much understand their purpose. what I am objecting to is using it as a general purpose privacy policy network filter. That is not what a MiTM proxy should be used for. The mitm proxy can inject js into the stream and fake any origin. At least the extension has limits of what it can access, and the code is fixed, unlike a proxy that can say something is anything from anywhe…

That's the thing though, uBlock rules can also inject scripts and addons can intercept and replace contents of network calls through the injected code.

I think mitm proxies should be used for whatever people find them suitable. I don't have a problem with this use case, especially as this is clearly something you will only get working with a moderate understanding of the underlying concepts.

Tools like Privoxy have existed for years and I don't know why you wouldn't trust a proxy over an addon. Just don't set it up for other people who can't make the risk/reward judgement (though the same goes for adblockers and other extensions).

Re: Show HN: Privaxy – Like uBlock but through a MitM proxy and no browser extension

#12
post #8

Subverting browser trust by installing a mitm root is not a good way to implement network policy. Many have tried to do this, such as AV vendors, and it generally ends badly. Do I trust your TLS and certificate trust implementation over a mainline browsers? Do you understand the nuances of implementing webPKI for browsers? I think asking the user to give up traffic authentication and confidentiality for a privacy fea…

You have to give up trust in some way. I trust extensions running on all websites less than I trust a mitm proxy, because the mitm proxy doesn't have the ability to run code in the browser process itself. Its capabilities are similar or even higher and unlike intentional TLS mitm attacks, addon redirection is near impossible to find in the browser UI. Reading through the code I see very little in the way of webPKI nu…

> I trust extensions running on all websites less than I trust a mitm proxy, because the mitm proxy doesn't have the ability to run code in the browser process itself.

No, but it is absolutely able to inject code which will then be run in the browser.

Re: Show HN: Privaxy – Like uBlock but through a MitM proxy and no browser extension

#13

Earlier quoted context omitted.

What are the things that you think are best handled by the browser while negotiating a session?

The connection parameters including encryption parameters and certificate from the origin. There are a lot of weird rules in WebPKI you may miss, this is beyond a general purpose TLS library. Enforcing Certificate Transparency rules or CAA records, is the proxy doing this?

Which browser enforces CAA?

it's a certificate misissuance, but AFAIK it's not up to the browser.

Post reply on HN