[HN Gopher] Snowflake
___________________________________________________________________
Snowflake
Author : bcg361
Score : 284 points
Date : 2023-07-30 00:59 UTC (22 hours ago)
(HTM) web link (snowflake.torproject.org)
(TXT) w3m dump (snowflake.torproject.org)
| anyfactor wrote:
| > If you switch on the Snowflake below and leave the browser tab
| open, a user can connect through your new proxy!
|
| I am not even sure, if I am getting this right. If I embed an
| iframe in my website, traffic from Tor users will get tunneled
| through my user visitor's IP? How does consent works with
| relay.love? Does my website vistor's IP show up as TOR exit node?
| worldofmatthew wrote:
| It not an exit. But by default someone has to knowingly run the
| Snowflake applet but webmasters could modify the code to
| automatically essentially start a Tor guard in someones
| browser. Though, that would be very evil to abuse someones
| resources like that.
|
| That example has the users consent before starting.
| KRAKRISMOTT wrote:
| That's already how many shady VPN software work. Remember if
| a VPN is "free", you are the product. Web scraping companies
| pay $$$$ for residential and mobile IPs.
| drusepth wrote:
| Friendly reminder that it's not just free VPNs that sell
| your data; many of the paid VPNs do also.
| [deleted]
| jeroenhd wrote:
| You can disable WebRTC in most decent browsers if you're afraid
| this will be abused. WebRTC can be used for worse things (like
| port scanning your internal network) and for great things
| (video calling with millisecond latency, Peertube).
|
| However, it should be noted that this mechanism doesn't just
| allow remote sockets to be created through Javascript. It can
| only communicate with other servers that either use some
| version of WebRTC/WebSockets or plaintext services that ignore
| the extra protocol overhead as garbage and happily parse the
| rest (some IRC servers and WebSockets are a nice example).
|
| As you can see in the technical overview, people use peer to
| peer technology to connect to your browser, which then uses
| WebSockets to communicate with a WebSocket server for a normal
| Tor entry point.
| ec109685 wrote:
| What a strange thing not to require browser consent for.
| notRobot wrote:
| It asks for the user's consent.
| PathfinderBot wrote:
| I'm surprised by how easy and literally one-click it was to use
| that. Bravo, Tor Project team.
| bauruine wrote:
| There is also a standalone (go) version [0] that can be deployed
| on a server. "one of the main advantages of standalone Snowflake
| proxies is that they can be installed on servers and offer a
| higher bandwidth and more reliable option for users behind
| restrictive NATs and firewalls."
|
| [0]
| https://community.torproject.org/relay/setup/snowflake/stand...
| batch12 wrote:
| If Tor is illegal in your country, it seems pretty risky to try
| to use it. Since anyone can run a snowflake proxy, it would be a
| trivial exercise to just log connecting IP addresses. Then it's a
| gamble with vanishing odds of staying safe each time you connect.
| tga_d wrote:
| In most places where Snowflake is useful, connecting to Tor is
| either legal or the laws against it aren't enforced. It's
| usually the creators/contributors of anti-censorship tools that
| face repercussions. That said, Tor Project pretty consistently
| emphasizes that all plugable transports are for AC purposes,
| not steganographic purposes, and while they're difficult to
| block, they will not stop the network operator from being able
| to tell you're connecting to Tor, and that it ultimately falls
| on the user to decide whether that's acceptable.
| throwaway290 wrote:
| "Just" don't connect from an IP that can be tied back to you,
| use black market sim in a separate phone, connect from places
| you don't go, turn it off when not in use... It gets expensive
| fast...
| petesergeant wrote:
| > use black market sim in a separate phone
|
| In most countries this takes you from "may have committed a
| crime" to "have actually committed a crime"
| throwaway290 wrote:
| We're talking about countries where using vpn is already a
| crime so no problem
| gary_0 wrote:
| They could block Snowflakes with IPs from networks in unsafe
| countries, but that is trivially bypassed by the attacker just
| buying VPSs (or botnet nodes) in a freer country.
|
| Skimming the Technical Overview[0], I don't see anything about
| mitigating the risks you mention.
|
| The purpose of Snowflake seems to be to circumvent blocking of
| Tor, not to prevent detection of using Tor. It takes advantage
| of "Domain Fronting" and WebRTC to accomplish this.
|
| [0] https://gitlab.torproject.org/tpo/anti-
| censorship/pluggable-...
| heresie-dabord wrote:
| > that is trivially bypassed by the attacker just buying VPSs
| (or botnet nodes) in a freer country
|
| A.K.A. "living off the economic land"
| Aachen wrote:
| This is a relay for Tor users to be able to access Tor (when
| normal guard relays (first hop in a Tor circuit) are blocked),
| using domain fronting and webrtc.
|
| The text is written quite confusingly, at least the German
| translation it served me by default. I was wondering how this
| could circumvent censorship, as the target needs to also support
| webrtc so there's no way to access any http(s) website via this
| in-browser proxy, this still requires another server to accept
| the webrtc connection and forward your traffic, but the point
| (which the article doesn't mention) is to be able to connect to
| this other server indirectly.
|
| It even goes so far as to claim that you don't need any software
| to visit censored websites:
|
| > Im Gegensatz zu VPNs musst du keine separate Anwendung
| installieren, um dich mit einem Snowflake-Proxy zu verbinden und
| die Zensur zu umgehen.
|
| Except you do. Without Tor client, this snowflake proxy is
| useless. Clicking through to the technical details (link marked
| with a warning "this content is in English"):
|
| > 1. User in the filtered region wishes to access the free and
| open internet. They open Tor Browser, selecting snowflake as the
| Pluggable Transport.
|
| The article said "contrary to VPNs, you don't need to install
| separate software to circumvent censorship" and the technical
| overview says the literal opposite: you need to install a Tor
| client to make use of a snowflake proxy.
| tga_d wrote:
| I can't speak to the German translation, but the point the
| English version is making is you don't install Snowflake, you
| install software that uses Snowflake (most typically, Tor
| Browser). It's presumably trying to clarify things for confused
| users trying to figure out how to install Snowflake as a proxy
| or VPN application, when that's not how it works.
|
| edit to add the direct quote (which seems pretty clear to me):
| "Unlike VPNs, you do not need to install a separate application
| to connect to a Snowflake proxy and bypass censorship. It is
| usually a circumvention feature embedded within existing apps."
| [deleted]
| mike_d wrote:
| Snowflake uses domain fronting[1] for rendezvous. It is the
| digital equivalent of a spy having their secret meetings inside
| an unsuspecting friends house, and it always eventually it goes
| bad for that friend.
|
| The technique is heavily used by bad actors and is being blocked
| by default[2] by some cloud providers. AWS went as far as sending
| a nastygram to Signal[3] when they tried to roll it out on a wide
| basis for fear that countries like Iran and China would just
| block all of AWS.
|
| 1. https://en.wikipedia.org/wiki/Domain_fronting 2.
| https://azure.microsoft.com/en-us/updates/generally-availabl...
| 3. https://signal.org/blog/looking-back-on-the-front/
| cubefox wrote:
| > The technique is heavily used by bad actors
|
| Evidence?
| broupannoiffuto wrote:
| It's in the OSEP course. :)
| homarp wrote:
| OffSec Experienced Pentester (OSEP)
| nannal wrote:
| Appeal to authority. Yellow card
| mike_d wrote:
| https://attack.mitre.org/techniques/T1090/004/
| jeroenhd wrote:
| I ran a Snowflake server at home for a while. I shut it off
| because it used too much CPU for my liking, but I haven't seen
| any kind of negative impact whatsoever.
|
| Domain fronting is not exactly a holy grail. Signal and Tor ran
| into issues when cloud providers blocked domain fronting (or
| rather, stopped supporting a feature that never was meant to
| work anyway) but I don't think that was intended to interrupt
| anything. "Load balancers are written to make sure they serve
| the correct certificates for their configured domains" isn't
| exactly a problematic feature on its own.
|
| Domain fronting is trivial, all you need is a call to openssl
| and an nginx server. It's also trivial to bust, all you need to
| do is actually validate the certificate. These certificates are
| either self signed or are part of a random CA chain that no
| real system would ever trust.
|
| It's not "a spy having their secret meetings inside an
| unsuspecting friend's house". It's someone putting a sign
| saying "white house, home of the American president, do not
| enter" in front of a random warehouse in Brazil.
|
| Software that falls for domain fronting either doesn't care
| about the certificates and their validity, or is buggy and
| should get patched. Some of that software will probably be
| security software, but if bad actors manage to trick your
| security software into trusting a few readable strings, domain
| fronting is probably the least of your worries. I can't imagine
| what kind of shitty security software would possibly fall for
| that.
| dmix wrote:
| Thanks for contributing to anti-cesnsorship, I respect anyone
| who puts that effort it.
| tialaramex wrote:
| When I last looked, the intent was that eventually ECH
| endpoints offer the same effective service that you got with
| Domain Fronting, but without messing with the backend in a way
| which is disruptive for the cloud providers so they support it.
|
| Encrypted Client Hello is the in-progress work to have even the
| client's initial contact to an HTTPS server be encrypted.
| https://datatracker.ietf.org/doc/draft-ietf-tls-esni/
|
| Why would ECH be fine when Domain Fronting isn't? The problem
| with Domain Fronting is that we get surprised too late with the
| actual request. We get what appears to be a legitimate request
| for this-thing.example, so we do all the work to respond to a
| this-thing.example request and then... swerve, sorry I changed
| my mind, my request is actually about hidden-service.example.
|
| With ECH we (but not an adversary snooping the connection) know
| immediately that the request is for hidden-service.example and
| so we don't waste our time setting up for the wrong work.
| whiatp wrote:
| I think the primary problem with domain fronting that ECH
| would solve is that ECH doesn't involve using a third party's
| domain name, potentially dragging a single third party into
| the censorship muck. My read of the support email signal
| shared is that AWS was unhappy that a domain they owned would
| likely become entangled. While ECH will still increase
| everyone else's risk that is sharing the same load balancer
| as a censorship target, it is at least a fully distributed
| risk, rather than requiring the client pick a specific domain
| or set of domains to pull into their fight.
| mike_d wrote:
| ECH is a good idea on paper but will never work in the real
| world.
|
| Oppressive regimes just drop any connection lacking a plain
| text SNI. The browser will either retry without ECH, or the
| user will retry with a browser that does not support ECH.
|
| I think people in the Western world don't exactly understand
| how internet censorship works. They don't give a shit about
| blocking large legitimate sites or breaking connectivity for
| large swaths of users if it helps them avoid losing power.
| VWWHFSfQ wrote:
| We block every Tor IP we can find because we don't have the time
| nor patience to deal with the 99% burpsuite spam originating from
| these servers. Very cheap and effective solution.
| bauruine wrote:
| How do you "find" them? You can just download the list with all
| exit node IPs.
|
| https://check.torproject.org/torbulkexitlist
| jdthedisciple wrote:
| What's my incentive to run a snowflake node?
| costco wrote:
| What's the incentive to donate to charity? There's no risk to
| you because it's not an exit node.
| jdthedisciple wrote:
| The difference being that a donation is one-off.
|
| Running a node is continuous.
| bauruine wrote:
| You can also do recurring donations. Running a Snowflake
| proxy is basically free if you don't pay for internet
| traffic so it's a very cheap and low work way to help
| censored people.
| orthecreedence wrote:
| What's the inentive?? Try the ALL NEW TORBUX!! A new ERC20
| token with only an 80% pre-mine used to incentivise the
| participation in the Tor network! Now instead of giving back to
| a community you derive benefit from, you can pervert the
| relationship with monetary rewards that benefit an elite class
| who are planning on disappearing to the Cayman Islands after
| extracting enough wealth from you and your peers!
| ChrisArchitect wrote:
| Anything new here from last year?
| batch12 wrote:
| So, I'm reminded of the old 'store your files on youtube'
| thing[0] and I wonder how much bandwidth one could get using the
| same concept on one of the widely used voice conferencing
| solutions (like zoom) to further blend in. Bonus if you can do
| some kind of video steganography to transfer the data and have a
| 'real' call.
|
| [0] https://github.com/DvorakDwarf/Infinite-Storage-Glitch
| darkclouds wrote:
| > Bonus if you can do some kind of video steganography to
| transfer the data and have a 'real' call.
|
| What you are suggesting would bring the proposed UK Online
| Safety Bill (OSB) into operation, and by virtue of the
| encoding/stenography means that GCHQ govt code crackers will be
| involved in what would be classed Police matters, not govt
| regulator aka OfCom matters, despite the UK govt suggesting its
| just a function of the regulator. The OSB also reads like it
| will extend beyond borders, simply on the grounds that it could
| be used in the UK.
| dpkonofa wrote:
| That would be amazing. If that worked regardless of network,
| though, I can see people setting up a node and accidentally
| taking it to work or some other public network by mistake. I'm
| not sure if that's better or worse than using it in a
| persistent connection.
| archo wrote:
| Snowflake (software) :
| https://en.wikipedia.org/wiki/Snowflake_(software)
|
| Tor (network) : https://en.wikipedia.org/wiki/Tor_(network)
|
| The Tor Project : https://en.wikipedia.org/wiki/The_Tor_Project
| rejectfinite wrote:
| I have it installed and like seeing the number go up. NUMBER
| BIGGER = DOPAMINE!!
|
| I'm lucky to be born in Scandinavia, so there is really 0
| internet censor, for now.
| Kjeldahl wrote:
| You're just lucky YOU aren't affected yet. Try telling that
| norwegian poker player who is unable to wire legal poker
| earnings from a tournament abroad to his bank home. Or to any
| of the people who made money on crypto who they want to use as
| security for an appartment loan. Or to someone trying to wire
| gains from legal online casinos abroad. Or to someone trying to
| access a web site that the norwegian authorities do not like
| who are DNS blocked (yes, easy to circumvent for tech people).
| Goverment and politicians abusing authority and limiting
| individual freedom is already here and growing. When it starts
| affecting "most people" it is usually a lot harder to reverse.
| The norwegian goverment already passed a law that allow mass
| electronic surveilance. And they want to limit the public's
| access to goverment records. It's a very slippery slope, left
| side "social democrazy" (spelled "beuracratic dictatorship")
| like most of EU. People need to open their eyes and fight
| goverment overreach now.
| rejectfinite wrote:
| My 2c on your scenarios.
|
| >Try telling that norwegian poker player who is unable to
| wire legal poker earnings from a tournament abroad to his
| bank home.
|
| Probably blocked due to terror laws. If you can't Western
| Union money, there is a REALLY good reason.
|
| Wait until you hear about how we are a cashless society and
| our bank app for money transfer. That you need mobile ID and
| bank account to use :) Max tracking. But its very handy.
|
| >Or to any of the people who made money on crypto who they
| want to use as security for an appartment loan.
|
| Good, I hate crypto shit and I want it to go away. It is all
| a scam. Get a real job and invest in a real bank. Crypto is
| all tax fraud scam shit.
|
| >Or to someone trying to wire gains from legal online casinos
| abroad.
|
| Good, I hate gambling and online casinos. If you have to
| gamble, do it in my country so the taxes benefit.
|
| >Or to someone trying to access a web site that the norwegian
| authorities do not like who are DNS blocked (yes, easy to
| circumvent for tech people).
|
| Yes THIS I agree with. I think ISP DNS blocks piratebay etc
| here now. Or some ISPs do. It's shit, but I already use a 3rd
| party DNS provider on my PC and phones.
|
| Your point btw? I am running the Snowflake when my browser is
| open.
| Kjeldahl wrote:
| My point was regarding the "no censorship in Scandinavia"
| comment that I replied to. The rest of your arguments are
| just ramblings about you not caring about individual
| freedom. You even justify their actions using your own made
| up arguments (which I'm not even bother going to sensibly
| refute). It is your exact attitude that gets us into
| trouble with power greedy politicians. You're an easy mark.
| mandmandam wrote:
| > If you can't Western Union money, there is a REALLY good
| reason.
|
| That isn't remotely true. Why on Earth would you ever give
| Western Union this kind of authority, lol.
|
| They've _proven_ they can 't be trusted many times over,
| most notably when they participated in the blockade of
| donations to Wikileaks.
|
| It's viscerally disgusting to me that just a few years
| after that, someone would put them on a pedestal as some
| kind of moral arbiter. What the _fuck_.
|
| > Good, I hate crypto shit and I want it to go away. It is
| all a scam.
|
| Yawn. What a tired and ignorant sentiment. The fact is,
| people saying things like this are making exactly the same
| destructive mistake as people saying 'all politicans are
| bad' - you're throwing out a very important baby with the
| bathwater.
|
| Fortunately, digital money doesn't give a flying fuck about
| your opinion.
|
| > Get a real job and invest in a real bank. Crypto is all
| tax fraud scam shit.
|
| Ugh. See above.
|
| > Good, I hate gambling and online casinos. If you have to
| gamble, do it in my country so the taxes benefit.
|
| You lack the minimum required table stakes of tax knowledge
| to be saying things like this.
| waithuh wrote:
| I love how your arguments against anything you dislike but
| should be legal because of personal freedom (gambling,
| crypto) is simply a teenager ranting.
| trompetenaccoun wrote:
| [flagged]
| huminte wrote:
| [flagged]
| aa1234556 wrote:
| [dead]
| Timon3 wrote:
| You are willfully misrepresenting the situation. The issue
| isn't that she wrote "men cannot be mothers", it's that she
| is telling a trans woman "you are a man". If people were
| running around and telling feminine-looking men "you are a
| woman" it would be the same situation and handled the same.
| huminte wrote:
| [flagged]
| Egrodo wrote:
| Not sure how new this is but very cool that users can host a node
| simply by toggling an iframe or installing a browser extension. I
| wonder if these methods have much lower bandwidth limitations
| than the CLI version
___________________________________________________________________
(page generated 2023-07-30 23:02 UTC)