Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox and Fastly take another step toward a privacy upgrade for the internet

fastly.com

Post reply on HN
Print view View original

11–20 of 35 posts

Re: Firefox and Fastly take another step toward a privacy upgrade for the internet

#11

Post by skuhn »

7e wrote: post #6

How does this compare to Apple Private Relay?

This service with Mozilla utilizes OHTTP, whereas iCloud Private Relay uses MASQUE.

OHTTP is ideally suited for privacy enablement of APIs, whereas MASQUE is more for general purpose traffic.

OHTTP has similarities to MASQUE in that it uses a two hop proxy design where each proxy only knows part of the total requestor / request information. And in both cases these proxies must be operated by separate entities that do not collude.

However, the key difference is that in OHTTP the end destination is known, because there is a 1-1-1 mapping between OHTTP Relay -> OHTTP Gateway -> Target. This could become more generalized in future revisions to OHTTP, but right now it's all hardcoded behavior.

For more about OHTTP at Fastly, I wrote a blog post a while back at [1]. There is also the IETF draft spec at [2].

[1] https://www.fastly.com/blog/enabling-privacy-on-the-internet...

[2] https://datatracker.ietf.org/doc/html/draft-ietf-ohai-ohttp

Re: Firefox and Fastly take another step toward a privacy upgrade for the internet

#12

Post by autoexec »

Missing from this article is: How do I disable this.

My initial thoughts are: I don't have any reason to trust fastly or their motivations. I certainly don't have any desire to use them as a proxy server for all of my HTTP traffic.

I'll review the OHTTP spec carefully, which seems to have been put forward by mozilla (who I have limited faith in) and Cloudflare (whose motivations are suspect), and evaluate this in depth, but for now I just don't want to worry that a browser update is going to cause firefox to start sending my data to a third party.

If the concern is that websites know what our IP is due to HTTP requests, we already have some solutions for that, a VPN being a good one. Mozilla already offers a VPN.

Re: Firefox and Fastly take another step toward a privacy upgrade for the internet

#13

Post by skuhn »

autoexec wrote: post #12

Missing from this article is: How do I disable this. My initial thoughts are: I don't have any reason to trust fastly or their motivations. I certainly don't have any desire to use them as a proxy server for all of my HTTP traffic. I'll review the OHTTP spec carefully, which seems to have been put forward by mozilla (who I have limited faith in) and Cloudflare (whose motivations are suspect), and evaluate this in dep…

Without going into trust / motivation / etc. of various organizations, OHTTP is not used for general purpose web browsing. This Fastly service is used by Mozilla in conjunction with their own origins, not to random origins on the Internet.

Re: Firefox and Fastly take another step toward a privacy upgrade for the internet

#14

Post by TradingPlaces »

skuhn wrote: post #11
7e wrote: post #6

How does this compare to Apple Private Relay?

This service with Mozilla utilizes OHTTP, whereas iCloud Private Relay uses MASQUE. OHTTP is ideally suited for privacy enablement of APIs, whereas MASQUE is more for general purpose traffic. OHTTP has similarities to MASQUE in that it uses a two hop proxy design where each proxy only knows part of the total requestor / request information. And in both cases these proxies must be operated by separate entities that do…

>However, the key difference is that in OHTTP the end destination is known, because there is a 1-1-1 mapping between OHTTP Relay -> OHTTP Gateway -> Target. This could become more generalized in future revisions to OHTTP, but right now it's all hardcoded behavior.

So the Relay knows the requested URL? That’s not masked by the client?

Re: Firefox and Fastly take another step toward a privacy upgrade for the internet

#15

Post by zeroentropy »

TradingPlaces wrote: post #14
skuhn wrote: post #11

Earlier quoted context omitted.

This service with Mozilla utilizes OHTTP, whereas iCloud Private Relay uses MASQUE. OHTTP is ideally suited for privacy enablement of APIs, whereas MASQUE is more for general purpose traffic. OHTTP has similarities to MASQUE in that it uses a two hop proxy design where each proxy only knows part of the total requestor / request information. And in both cases these proxies must be operated by separate entities that do…

>However, the key difference is that in OHTTP the end destination is known, because there is a 1-1-1 mapping between OHTTP Relay -> OHTTP Gateway -> Target. This could become more generalized in future revisions to OHTTP, but right now it's all hardcoded behavior. So the Relay knows the requested URL? That’s not masked by the client?

OHTTP encapsulates a complete request, so the 1-1-1 mapping isn't right. The target can be any resource, but it generally should be on the same host/origin as the gateway. The gateway sees the request and the response, so there are very few cases where you would trust it to handle requests for any URL.

Re: Firefox and Fastly take another step toward a privacy upgrade for the internet

#16

Post by zeroentropy »

autoexec wrote: post #12

Missing from this article is: How do I disable this. My initial thoughts are: I don't have any reason to trust fastly or their motivations. I certainly don't have any desire to use them as a proxy server for all of my HTTP traffic. I'll review the OHTTP spec carefully, which seems to have been put forward by mozilla (who I have limited faith in) and Cloudflare (whose motivations are suspect), and evaluate this in dep…

OHTTP is designed for low latency or lightweight applications. A VPN (or MASQUE, to later comments) requires that you do two handshakes before making a request: one with the VPN and one with the server you want to talk to. OHTTP does away with the second and, where where you are making multiple requests, lets the first handshake only occur once (a VPN/MASQUE can do this too).

Now, this has very little to do with what you might trust Firefox or Mozilla to do. OHTTP only provides a degree of anonymity. If you don't want to share the data that is carried in the message, then you might want to disable the request, not the privacy protections that OHTTP provides. Firefox will use OHTTP for different purposes, so you need to look at each in turn.

Re: Firefox and Fastly take another step toward a privacy upgrade for the internet

#17

Post by kalupa »

tadpole172 wrote: post #8
7e wrote: post #6

How does this compare to Apple Private Relay?

Apple private relay uses Fastly as one of the providers so I wouldn't be surprised if this is implemented the same way.

would that be true for providers that aren't Fastly? why would there be a different implementation for non-fastly? or are they the sole providers for private relay?

Re: Firefox and Fastly take another step toward a privacy upgrade for the internet

#18

Post by TradingPlaces »

zeroentropy wrote: post #15
TradingPlaces wrote: post #14

Earlier quoted context omitted.

>However, the key difference is that in OHTTP the end destination is known, because there is a 1-1-1 mapping between OHTTP Relay -> OHTTP Gateway -> Target. This could become more generalized in future revisions to OHTTP, but right now it's all hardcoded behavior. So the Relay knows the requested URL? That’s not masked by the client?

OHTTP encapsulates a complete request, so the 1-1-1 mapping isn't right. The target can be any resource, but it generally should be on the same host/origin as the gateway. The gateway sees the request and the response, so there are very few cases where you would trust it to handle requests for any URL.

Thanks

Re: Firefox and Fastly take another step toward a privacy upgrade for the internet

#19

Post by skuhn »

zeroentropy wrote: post #15
TradingPlaces wrote: post #14

Earlier quoted context omitted.

>However, the key difference is that in OHTTP the end destination is known, because there is a 1-1-1 mapping between OHTTP Relay -> OHTTP Gateway -> Target. This could become more generalized in future revisions to OHTTP, but right now it's all hardcoded behavior. So the Relay knows the requested URL? That’s not masked by the client?

OHTTP encapsulates a complete request, so the 1-1-1 mapping isn't right. The target can be any resource, but it generally should be on the same host/origin as the gateway. The gateway sees the request and the response, so there are very few cases where you would trust it to handle requests for any URL.

Yes, that's true. However in practice most deployments that I've worked on are a relay which maps all requests to a gateway which maps all requests to a target. It's not an inherent property of the protocol, and I expect that to evolve over time.

Re: Firefox and Fastly take another step toward a privacy upgrade for the internet

#20

Post by skuhn »

kalupa wrote: post #17
tadpole172 wrote: post #8

Earlier quoted context omitted.

Apple private relay uses Fastly as one of the providers so I wouldn't be surprised if this is implemented the same way.

would that be true for providers that aren't Fastly? why would there be a different implementation for non-fastly? or are they the sole providers for private relay?

There are other providers of the second hop proxy for iCloud Private Relay, Fastly is one of them.
Post reply on HN