Leaving an IPFS gateway open seems as intelligent as running a Tor exit node.
Someone used my IPFS gateway for phishing
31–40 of 44 posts
Re: Someone used my IPFS gateway for phishing
#32Sorry to hear, but you are not alone [0]. It was matter of time for a new tech to be exploited like that. Providing IPFS gateway is like opening up public HTTP proxy (popular back in 90s). You had good intentions, but there will be lot of nasty things going thru your machine. Of course guys like Cloudflare can absorb arising liability but I think they will shutdown their gateway at some point. I think the best way to…
Mozilla talks a lot and don't do much in this direction, they promised Tor integration like 4-5 years ago and all they did is setup 3 middle-nodes.
Brave Browser already has Tor integration in private tabs and working IPFS integration on -dev channel since beginning of this year https://github.com/brave/brave-browser/issues/819
Re: Someone used my IPFS gateway for phishing
#33Earlier quoted context omitted.
Without major players joining - browser vendors, it will be like IPv6 transition.
Firefox has partly added support recently. They recognise ipfs:// as a valid protocol and allow extensions to implement it.
Extensions can't implement the raw IPFS protocol though, they need a companion application running the actual gateway, or can maybe use the WebRTC transport.
Re: Someone used my IPFS gateway for phishing
#34It's very shitty of DigitalOcean to not at least give you a small window of opportunity to investigate and remove offending content, especially if first complaint. Given that their investigation would of been limited too (unlike yours) it makes it somewhat easy to knock off someone on DigitalOcean with a flimsy complaint.
If you don't want to be nullrouted at the first abuse or DMCA complaint, I recommend more professional hosters like Hetzner or OVH. They will forward abuse mail to you first and only react themselves if you ignore the mails entirely and repeatedly do nothing about it.
You don't have to go Hetzner or OVH to get some sensibility. We've worked with Linode over a somewhat dubious overreaching copyright claim some years ago, they were professional and available and we had some back and forth whilst my client sought legal advice, in the end it wasn't completely frivolous, we had to give an inch instead of a mile the legal compliantee desired. This was over a period of a few days and we were never suspended, we made the small modification, Linode was happy, compliantee went quiet eventually, we carried on...
I wouldn't trust DigitalOcean with this fire first ask questions later approach especially given the technical nature of OPs setup.
Re: Someone used my IPFS gateway for phishing
#35It's very shitty of DigitalOcean to not at least give you a small window of opportunity to investigate and remove offending content, especially if first complaint. Given that their investigation would of been limited too (unlike yours) it makes it somewhat easy to knock off someone on DigitalOcean with a flimsy complaint.
> especially if first complaint Well: > It was sent by PhishLabs to DigitalOcean, and DigitalOcean forwarded it to me. I don't think this is the first complaint from PhishLabs to DigitalOcean. I do think DO would have "investigated" up to the level where they'd click the link and see "yep, that's a google sign in form". It's not up to DO to dispute claims made by people who send them abuse e-mails. As for the dispute…
IPFS isn't even linking to illegal content.
IPFS has no knowledge of the illegal content whatsoever, it all comes from the URL fragment and Microsoft Azure.
Re: Someone used my IPFS gateway for phishing
#36Earlier quoted context omitted.
> especially if first complaint Well: > It was sent by PhishLabs to DigitalOcean, and DigitalOcean forwarded it to me. I don't think this is the first complaint from PhishLabs to DigitalOcean. I do think DO would have "investigated" up to the level where they'd click the link and see "yep, that's a google sign in form". It's not up to DO to dispute claims made by people who send them abuse e-mails. As for the dispute…
IPFS isn't even linking to illegal content. IPFS has no knowledge of the illegal content whatsoever, it all comes from the URL fragment and Microsoft Azure.
By the same merit, any site (big, small, government or otherwise) with an XSS like el.outerHTML = window.location.search or el.outerHTML = window.location.query is vunerable to be shutdown if hosted on DO. Makes one think..
Re: Someone used my IPFS gateway for phishing
#37Sorry to hear, but you are not alone [0]. It was matter of time for a new tech to be exploited like that. Providing IPFS gateway is like opening up public HTTP proxy (popular back in 90s). You had good intentions, but there will be lot of nasty things going thru your machine. Of course guys like Cloudflare can absorb arising liability but I think they will shutdown their gateway at some point. I think the best way to…
Mozilla talks a lot and don't do much in this direction, they promised Tor integration like 4-5 years ago and all they did is setup 3 middle-nodes. Brave Browser already has Tor integration in private tabs and working IPFS integration on -dev channel since beginning of this year https://github.com/brave/brave-browser/issues/819
I don't know how they worked on the Tor integration, but I do know they are actively working towards helping dweb implementations in the browser.
https://github.com/mozilla/libdweb is one of the efforts, and it provides experimental APIs needed in Firefox to have a nice experience. So AFAIK, Mozilla not only talks about dweb, but also helps with the effort.
Re: Someone used my IPFS gateway for phishing
#38We all should take actions against evil participants. Blocking that URL is part of it.
Re: Someone used my IPFS gateway for phishing
#39Earlier quoted context omitted.
Firefox has partly added support recently. They recognise ipfs:// as a valid protocol and allow extensions to implement it.
Extensions can't implement the raw IPFS protocol though, they need a companion application running the actual gateway, or can maybe use the WebRTC transport.
No, js-ipfs can run a full ipfs node right in a web page. It'll peer with other nodes over websockets, and do relaying if neccessary.
Re: Someone used my IPFS gateway for phishing
#40Sorry to hear, but you are not alone [0]. It was matter of time for a new tech to be exploited like that. Providing IPFS gateway is like opening up public HTTP proxy (popular back in 90s). You had good intentions, but there will be lot of nasty things going thru your machine. Of course guys like Cloudflare can absorb arising liability but I think they will shutdown their gateway at some point. I think the best way to…
Mozilla talks a lot and don't do much in this direction, they promised Tor integration like 4-5 years ago and all they did is setup 3 middle-nodes. Brave Browser already has Tor integration in private tabs and working IPFS integration on -dev channel since beginning of this year https://github.com/brave/brave-browser/issues/819
> they promised Tor integration like 4-5 years ago and all they did is setup 3 middle-nodes.
They never promised any Tor integration for the near future, see: https://news.ycombinator.com/item?id=17205441 and the first comment. Brave can do Tor integration because its user bases is much smaller than Mozilla's (scaling the Tor network to support the load from all FF users still requires much work).