Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Tor proxy that runs in your browser

crypto.stanford.edu

Post reply on HN
Print view View original

11–20 of 31 posts

Re: A Tor proxy that runs in your browser

#11

Post by picklefish »

chx wrote: post #6

How can I block this? For reals. I have no desire to run a Tor proxy and be shafted with CP charges. Edit: my understanding is that this can be put into any web page and then make anyone visiting that page a Tor exit node.

You are not an end node, so nothing but encrypted data is passed between a Tor user and another Tor node. These bridges help people in countries who block access to the tor network enter the Tor network. They don't use you to access any actual content.

That said. Don't go to websites that put the iframe in if you don't want to be one. It's not like it's going to be a common practice to throw that on your webpage.

Re: A Tor proxy that runs in your browser

#12

Post by javis »

jcoder wrote: post #2

> "Flash proxy" is a name that should make you think "quick" and "short-lived." Our implementation uses standard web technologies: JavaScript and WebSocket. I get it, but there's another (widely reviled) in-browser technology that goes by the name Flash, and it's entirely plausible that this could be written with it. Sometimes you need to be able to let go of a name.

Does this not require Flash Player at all then?

Re: A Tor proxy that runs in your browser

#13

Post by mmastrac »

javis wrote: post #12
jcoder wrote: post #2

> "Flash proxy" is a name that should make you think "quick" and "short-lived." Our implementation uses standard web technologies: JavaScript and WebSocket. I get it, but there's another (widely reviled) in-browser technology that goes by the name Flash, and it's entirely plausible that this could be written with it. Sometimes you need to be able to let go of a name.

Does this not require Flash Player at all then?

From a cursory investigation of the source, this is WebSockets only.

Re: A Tor proxy that runs in your browser

#14

Post by javis »

arscan wrote: post #10
emily37 wrote: post #8

Earlier quoted context omitted.

It's a good question, discussed a bit in the PETS paper: https://crypto.stanford.edu/flashproxy/flashproxy.pdf (section 6). The short answer is that communicating a small amount of information outside of the censored region to a blocked facilitator is an easier problem than full connectivity.

Yeah, it was a stupid question in that I should have read the paper ;-) Laziness on my part, sorry. Right, their idea is to basically leverage some protocols that allow unblocked entities forward information from the client to the facilitator (which is assumed to be directly blocked always). That seems to make sense. It seems to be that the flash proxy must be able to connect to the client directly (the client is not…

Doesn't the requirement that the client not be behind NAT render this somewhat useless?

Isn't the vast majority of the internet behind NAT?

Re: A Tor proxy that runs in your browser

#15

Post by thefreeman »

chx wrote: post #6

How can I block this? For reals. I have no desire to run a Tor proxy and be shafted with CP charges. Edit: my understanding is that this can be put into any web page and then make anyone visiting that page a Tor exit node.

While OP is wrong about this specific implementation, is there anything stopping someone from modifying it to make you an exit node?

While the authors clearly have good intentions, the basic idea of my browser relaying traffic transparently that I am not aware of is indeed disturbing.

Re: A Tor proxy that runs in your browser

#16

Post by thefreeman »

jcoder wrote: post #2

> "Flash proxy" is a name that should make you think "quick" and "short-lived." Our implementation uses standard web technologies: JavaScript and WebSocket. I get it, but there's another (widely reviled) in-browser technology that goes by the name Flash, and it's entirely plausible that this could be written with it. Sometimes you need to be able to let go of a name.

gotta agree here, I had the same reaction as probably every one else and instantly assumed it was using Adobe Flash before I read more.

Re: A Tor proxy that runs in your browser

#17

Post by xtacy »

jcoder wrote: post #2

> "Flash proxy" is a name that should make you think "quick" and "short-lived." Our implementation uses standard web technologies: JavaScript and WebSocket. I get it, but there's another (widely reviled) in-browser technology that goes by the name Flash, and it's entirely plausible that this could be written with it. Sometimes you need to be able to let go of a name.

Actually, when the project started they used Flash to set up connections. I guess the name stuck on. :-)

Re: A Tor proxy that runs in your browser

#18

Post by psionski »

javis wrote: post #14
arscan wrote: post #10

Earlier quoted context omitted.

Yeah, it was a stupid question in that I should have read the paper ;-) Laziness on my part, sorry. Right, their idea is to basically leverage some protocols that allow unblocked entities forward information from the client to the facilitator (which is assumed to be directly blocked always). That seems to make sense. It seems to be that the flash proxy must be able to connect to the client directly (the client is not…

Doesn't the requirement that the client not be behind NAT render this somewhat useless? Isn't the vast majority of the internet behind NAT?

Two words: port forwarding :) Yes, it makes using TOR a bit more difficult, but not by very much...

Re: A Tor proxy that runs in your browser

#20

Post by 2ndhand »

oftenwrong wrote: post #19
chx wrote: post #6

How can I block this? For reals. I have no desire to run a Tor proxy and be shafted with CP charges. Edit: my understanding is that this can be put into any web page and then make anyone visiting that page a Tor exit node.

Use NoScript.

Seconded
Post reply on HN