Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic

github.com

Post reply on HN
Print view View original

41–50 of 63 posts

Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic

#41

Post by randomhodler84 »

rsync wrote: post #37
randomhodler84 wrote: post #33

Earlier quoted context omitted.

Why is DNS based blocking getting difficult? You run a bind server and tell it what it can and cannot resolve. It can even listen on DoH so you get transport security between peer and local dns server.

Your browser (or your tv) can just skip your entire dns infra and make its own lookups over https- which you won’t see. That’s the evil genius of doh- you can’t block 443 and their “dns server” could be the same hostname as the site you visit … and now we’re discussing mitm’ing ourselves… Sigh.

Could, but do? I have never seen DNS or DOH pinning. Seems fragile. Would likely fall back to host resolver anyway.

Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic

#42

Post by randomhodler84 »

atommclain wrote: post #39
randomhodler84 wrote: post #30

Earlier quoted context omitted.

Run your own DoH filtering DNS server, I set this up a few months ago. DNS blocking is not obsoleted by transport encryption.

Very curious about how you went about this as I would like to do the same.

Many options, take a look at https://wiki.archlinux.org/title/DNS_over_HTTPS_servers

Update the DHCP on your router, all done.

Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic

#43

Post by itintheory »

geoffeg wrote: post #26

I've really wanted a server-side uBlock Origin like this for a while now for devices that can't run uBlock (mobile, etc) or where uBlock is limited in functionality (Chrome). This looks like a great start.

In case you weren't aware, firefox on android can run uBlock Origin without root or any other modifications. This proxy would be nice to have system level ad blocking though!

Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic

#45

Post by mhils »

randomhodler84 wrote: post #33
mhils wrote: post #15

This approach is a natural escalation step as DNS-based blocking is getting increasingly difficult. But it's not without its drawbacks. For example, browsers tend to have by far the best TLS implementations. By MITMing yourself, you essentially trust the proxy's TLS implementation instead, which will receive much less scrutiny. There's a lot of precedent for TLS vulnerabilities introduced by middleboxes. If browser e…

Why is DNS based blocking getting difficult? You run a bind server and tell it what it can and cannot resolve. It can even listen on DoH so you get transport security between peer and local dns server.

AdTech increasingly uses CNAME cloaking-style tricks to evade DNS blocking. Some of those tricks are detectable, but DNS blocking will inevitably fail once ads are served from the first party domain. It's still rare, but simple CNAME cloaks specifically have seen an uptick in the last few years.

Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic

#46

Post by mhils »

pdimitar wrote: post #40
mhils wrote: post #16

Earlier quoted context omitted.

I wouldn't write it off - one possible trick here is to also MITM the DoH/DoQ server and disable ECH by removing the relevant records from the DNS response. We've just added DNS support to mitmproxy and this is a natural follow-up. :)

Oh? Do you guys have a blog writeup? I would LOVE to read more about this! I want to eliminate the small amount of ads that make it through my PiHole.

Not yet, but you might be lucky soon. We have an RSS feed on mitmproxy.org and a Twitter account. :-)

Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic

#47

Post by aesh2Xa1 »

randomhodler84 wrote: post #30
teddyh wrote: post #2

I fear that MITMing ads is a dead end: 1. IIUC, when SNI is encrypted (in TLS 1.3?) almost everything is out the window. 2. Local devices can do DNS over HTTPS (DoH) and DNS over QUIC (DoQ) to look up their stuff, so DNS-based blocking will soon be obsolete. 3. The browser itself is controlled by the biggest ad-vendor around (Google), so you’ll probably get no help there. The only solutions are: A. Use browsers not c…

Run your own DoH filtering DNS server, I set this up a few months ago. DNS blocking is not obsoleted by transport encryption.

OP is stating that "apps and devices" may circumvent DNS blocking by resorting to DoH. You can run your own DoH server, and you can even advertise it via your DHCP server, but clients ("apps and devices") do not need to accept the supplied servers for their own configuration.

Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic

#48

Post by trasz »

teddyh wrote: post #2

I fear that MITMing ads is a dead end: 1. IIUC, when SNI is encrypted (in TLS 1.3?) almost everything is out the window. 2. Local devices can do DNS over HTTPS (DoH) and DNS over QUIC (DoQ) to look up their stuff, so DNS-based blocking will soon be obsolete. 3. The browser itself is controlled by the biggest ad-vendor around (Google), so you’ll probably get no help there. The only solutions are: A. Use browsers not c…

D. Create a whole bunch of VMs with browsers and “fake users” to DoS the whole ad-based business model.

Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic

#49

Post by trasz »

mhils wrote: post #15

This approach is a natural escalation step as DNS-based blocking is getting increasingly difficult. But it's not without its drawbacks. For example, browsers tend to have by far the best TLS implementations. By MITMing yourself, you essentially trust the proxy's TLS implementation instead, which will receive much less scrutiny. There's a lot of precedent for TLS vulnerabilities introduced by middleboxes. If browser e…

A TLS proxy is something that’s trivially easy to sandbox; a browser is the exact opposite.

Re: Show HN: Privaxy – Adblocking / tracker blocking by MITMing HTTPS traffic

#50

Post by randomhodler84 »

aesh2Xa1 wrote: post #47
randomhodler84 wrote: post #30

Earlier quoted context omitted.

Run your own DoH filtering DNS server, I set this up a few months ago. DNS blocking is not obsoleted by transport encryption.

OP is stating that "apps and devices" may circumvent DNS blocking by resorting to DoH. You can run your own DoH server, and you can even advertise it via your DHCP server, but clients ("apps and devices") do not need to accept the supplied servers for their own configuration.

A lot of things are possible, but are they done?

I am yet to hear of any examples of hardcoded DNS servers. I believe this to be too fragile to implement.

Post reply on HN