Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic

github.com

Post reply on HN
Print view View original

21–30 of 63 posts

Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic

#21

Post by 2Gkashmiri »

dredmorbius wrote: post #19
2Gkashmiri wrote: post #10

Why build something fresh and not join forces with pihole? Reinventing the wheel for a niche function doesn't get traction much. I don't know the reason why the devs of this project think they need to start afresh, there are already tools like Firefox+unlock origin+ pihole which should solve most if not all of the problems. Why not incorporate the defining feature into pihole so that people don't have to add more com…

Does PiHole do anything other than DNS-based blocking?

i dont know. my point is the "fragmentation" thing

Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic

#22

Post by mindslight »

dredmorbius wrote: post #19
2Gkashmiri wrote: post #10

Why build something fresh and not join forces with pihole? Reinventing the wheel for a niche function doesn't get traction much. I don't know the reason why the devs of this project think they need to start afresh, there are already tools like Firefox+unlock origin+ pihole which should solve most if not all of the problems. Why not incorporate the defining feature into pihole so that people don't have to add more com…

Does PiHole do anything other than DNS-based blocking?

It would actually be pretty sweet if something like PiHole bundled and incorporated something like this as a configuration option, to deal with sites where DNS-only blocking didn't work.

Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic

#23

Post by cal85 »

What are the potential benefits of a ‘MITM’ approach, compared to other approaches like acting as DNS (like pihole)?

Edit: I should have read the About section more carefully:

> Privaxy is also way more capable than DNS-based blockers as it is able to operate directly on URLs and to inject resources into web pages.

Makes sense. So it potentially has the fine-grained control of a browser-based blocker but also has good performance like a pihole. Sounds compelling. Now I’m interested to know why it’s not been done this way before? Is it just a hard problem to solve, and no one has attempted it yet?

Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic

#24

Post by dredmorbius »

2Gkashmiri wrote: post #21
dredmorbius wrote: post #19

Earlier quoted context omitted.

Does PiHole do anything other than DNS-based blocking?

i dont know. my point is the "fragmentation" thing

As Privaxy includes blocklists, I'd argue that it is a superset of PiHole functionality. DNS blocklisting is actually pretty straightforward, and there are many tools which do it. PiHole is only one.

That said, which would be better suited to incorporate the other is an interesting question.

Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic

#25

Post by dredmorbius »

captn3m0 wrote: post #20
dredmorbius wrote: post #17

Earlier quoted context omitted.

There were numerous of these. Privoxy, dansguardian, Squid (AFAIR), and others. The notion that SSL/TLS means that ONLY the webserver origin and web browser client are permitted to see or mitigate content ... is itself harmful. Trusted proxies under your control do have a place, though yes, that introduces new points of contention as well.

I used to swear by Privoxy till the internet realised HTTPS was actually important and it stopped working everywhere.

Largely the same. Privaxy actually looks pretty sweet in that regard.

Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic

#27

Post by sumtechguy »

captn3m0 wrote: post #8
bilekas wrote: post #4

> Privaxy is also way more capable than DNS-based blockers as it is able to operate directly on URLs and to inject resources into web pages. I'm not sure I understand why it would be more capable than a DNS blocker ? If it's just because you can inject into the traffic that's comparing apples and oranges ? Or am I missing something ?

Let’s say a text based ad shows up in a div with the id “advert”. A DNS based blocker will not be able to block it, but an extension or a proxy based blocker that looks at the HTML content will be able to block it. So yeah, inject as well as as modify the HTML directly. It could do things like shimming advertising libraries as well defanging them potentially.

To add to that. DNS block is basically 'built in' for this type of filtering as you can just make your filter strings your list of DNS sites. It does have the downside that not everything is http. That is where a real DNS filter comes into play with known malicious endpoints. So a combination is very nice to have.

Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic

#28

Post by teddyh »

ThePhysicist wrote: post #6
teddyh wrote: post #2

I fear that MITMing ads is a dead end: 1. IIUC, when SNI is encrypted (in TLS 1.3?) almost everything is out the window. 2. Local devices can do DNS over HTTPS (DoH) and DNS over QUIC (DoQ) to look up their stuff, so DNS-based blocking will soon be obsolete. 3. The browser itself is controlled by the biggest ad-vendor around (Google), so you’ll probably get no help there. The only solutions are: A. Use browsers not c…

In my understanding ECH/ESNI shouldn't be an issue in this setup as long as the browser issues a domain-specific CONNECT request (i.e. "CONNECT google.com" instead of "CONNECT 24.154.13.11"). I think even with ECH enabled you should be able to impersonate the web server if you have a valid root CA certificate in the browsers' trust store. Remember, you're not performing "hostile" MITM-ing, but explicitly configure a…

This is, of course, assuming that you can trust the browser to obey its proxy settings. (And proxy setting do not apply at all to local “smart” devices.)

Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic

#29

Post by XorNot »

teddyh wrote: post #2

I fear that MITMing ads is a dead end: 1. IIUC, when SNI is encrypted (in TLS 1.3?) almost everything is out the window. 2. Local devices can do DNS over HTTPS (DoH) and DNS over QUIC (DoQ) to look up their stuff, so DNS-based blocking will soon be obsolete. 3. The browser itself is controlled by the biggest ad-vendor around (Google), so you’ll probably get no help there. The only solutions are: A. Use browsers not c…

Anyone who cares about ad blocking should not be using any Chromium based browser at this point, but isn't this the sort of tool you'd use at a network or virtual network level?

There's no reason to let applications on your device bypass your own network settings - and this is something we probably need to start accommodating in Linux distros to start with (specifically: disabling all the weaponized E2E encryption that vendors are using, and forcibly MITM'ing it with keys under the users control).

Network-namespaces should make this eminently possible - launch the user's entire environment into a network namespace which can only speak to "user rights" networking stack.

Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic

#30

Post by randomhodler84 »

teddyh wrote: post #2

I fear that MITMing ads is a dead end: 1. IIUC, when SNI is encrypted (in TLS 1.3?) almost everything is out the window. 2. Local devices can do DNS over HTTPS (DoH) and DNS over QUIC (DoQ) to look up their stuff, so DNS-based blocking will soon be obsolete. 3. The browser itself is controlled by the biggest ad-vendor around (Google), so you’ll probably get no help there. The only solutions are: A. Use browsers not c…

Run your own DoH filtering DNS server, I set this up a few months ago. DNS blocking is not obsoleted by transport encryption.
Post reply on HN