531–540 of 659 posts
Earlier quoted context omitted.
Not a CF employee but I am pretty sure it's working as intended as they built and use this: https://github.com/cloudflare/mitmengine
Here's hoping that, if they do it, they'll start blocking corporate TLS mitm regimes too.
Earlier quoted context omitted.
I think you're underestimating the CPU requirements. If a weak Android phone is only able to decode 50Mb/s of TLS traffic, that's not a big problem in practice. It's a slow phone, usually connected to slow networks. On the other hand, if you have a gigabit internet connection at home and it is being bottlenecked to 50Mb/s by that weak device sitting between all of your computers and the internet, then that is a big p…
> If a weak Android phone is only able to decode 50Mb/s of TLS traffic That's a lower, not an upper bound. An RPi 4 can encrypt/decrypt AES-256-GCM at more than 300 Mbit/s, according to my rough measurements. That's per core, of which it has four. RSA can be much more expensive, but that's besides the point – the author was claiming that AES-NI makes a meaningful difference here, which I'd really doubt even in the ca…
Which only matters for multiple concurrent connections... a single download would still be a sequential task on a single core at 300Mb/s, which I would find to be an unacceptable bottleneck on my gigabit connection.
In reality, it would probably only be 300Mb/s for up to 2 connections, since it needs to both decrypt and reencrypt, which could be parallelized onto 2 cores, otherwise 150Mbps for 4 connections if each connection was handled only on a single core.
Either way, it would not be possible to MitM 1Gbps of traffic on a Raspberry Pi 4, with the numbers you provided, only 600Mbps total, and only across multiple connections. It would be an extremely noticeable bottleneck.
This reminds me of a now-dockerized Privaxy, which is a UBlock-origin blocklist compatible MITM proxy. It’s crazy to see how many ads and tracking scripts are on smart products, especially my TV where so far in my testing it’s over 40% unnecessary traffic. Its been pretty fun to try and strip out ads on my smart-tv apps. https://github.com/deetungsten/webui-privaxy is the dockerized fork of https://github.com/Barre/p…
Earlier quoted context omitted.
If you continue to give Google money you'll continue to get things like AMP, Manifest V3, Web "Integrity", and whatever else they think up to track you across the web. They're an ad company. They pay the creators per impression even if you block the ads. Blocking ads harms Google, not the content producers.
I'm giving them money to view fewer ads. Isn't this an inherently "anti-ad" consumer standpoint? I am telling YT/Google that I as a consumer am willing to pay money to not see ads. Am I not telling them with my wallet to develop other ad-free solutions that I will pay them and the content creators money for? > They pay the creators per impression even if you block the ads. Blocking ads harms Google, not the content p…
No
Earlier quoted context omitted.
which is what https://github.com/lwthiker/curl-impersonate does: it's a special build of curl that can impersonate Chrome & Firefox
Can this be used as a proxy to your real browser? Can you paint the whole picture/setup for a noob?
Earlier quoted context omitted.
720p or less.
I used to stream all my videos 144p less than 5 years ago because streaming any higher resulted in a stuttering buffering mess. Youtube was the only streaming service I could watch because most other sites didn't bother with resolutions/bitrates so low. Maybe that's why youtube won out. Much like how whatsapp made it their mission to run on every phone they could get their hands on. Now we have proper internet I don'…
Cool hack overall, but some of the statements about protobuf strike me as odd. > Exploit a Protobuf Flaw to Easily Remove All Ads by Changing One Byte He's intentionally corrupting the tag on one field of the protobuf. The "flaw" is apparently that Protobuf ignores tag numbers it doesn't recognize. But that's not a flaw, it's a core design feature of Protobuf, designed to allow extensibility. > Notice how the Protobu…
> without the C++ source proto files Shameless plug: I wrote a project to generate source proto files from binaries called protodump [1] - it regenerates all the message/field definitions (including the original names). It would just require pulling the binary off the AppleTV box [1]: https://github.com/arkadiyt/protodump
As for this specific context, presumably at least the bulk of the fields are shared between YouTube clients across architectures and platforms - it might be easier to just run the dump against binaries extracted from the YouTube apk than getting the specific Apple TV YouTube app binary. (For iPhone, you can just make a full iTunes backup but for Apple TV I imagine you’re going to need to do some forensic binary spelunking.)
Earlier quoted context omitted.
No, Google will keep fucking you over and destroying the Internet, whether you pay or not. Not to mention the fact that what they pay out to creators is absolutely pathetic. Go find their Patreon, their Ko-fi, hell their paypal, anything but giving Google 13 bucks. Adblocking Google is morally right.
Stop using Google if you want to promote alternatives. Otherwise you're just rationalising freeloader behaviour.
> We’re going to use WireGuard – we have the Intel AES-NI crypto instruction set WireGuard doesn’t actually use AES, as far as I know. In general, it seems like the author somewhat overestimates the CPU requirements for TLS encryption (or equivalently underestimates modern single-board computers): > The CPU requirements to decrypt and re-encrypt HTTPS traffic greatly exceed those available to Raspberry Pis. I'd be re…
I think you're underestimating the CPU requirements. If a weak Android phone is only able to decode 50Mb/s of TLS traffic, that's not a big problem in practice. It's a slow phone, usually connected to slow networks. On the other hand, if you have a gigabit internet connection at home and it is being bottlenecked to 50Mb/s by that weak device sitting between all of your computers and the internet, then that is a big p…
Earlier quoted context omitted.
MITM is kind of a silly term for what the computer owner is doing when using a forward proxy. If the computer owner binds the proxy to a localhost address, the unencrypted requests need only go over the loopback. There need be no unencrypted requests travelling over the LAN. The computer owner, the "MITM", is on their own computer sitting in between an application and the network interface. That is exactly where they…
For any gamers out there, Reshade's installer is another example where TLS istn't implemented properly. It fails to download effect/shader packages for basic setup on up-to-date Windows machines because it requires that you disable TLS 1.3 globally on Windows so it can use 1.1 or 1.2. [1] https://reshade.me/forum/troubleshooting/8746-reshade-v-5-8-...