Tor Snowflake Proxy

https://snowflake.torproject.org/

by doomrobo • 5 years ago

197 84 5 years ago

snowflake.torproject.org

i67vw3• 5 years ago

Cool, I believe russia recently blocked tor project main website, to prevent users from downloading tor bowser from clearnet.

https://www.rt.com/russia/542552-russia-bans-tor-project/

londons_explore• 5 years ago

Even the linked domain is blocked in the UK (on some ISP's)

jevoten• 5 years ago

Which domain do you mean? https://snowflake.torproject.org/ ?

prisout64• 5 years ago

Anyone running a proxy? I definitely want to give back and it would not be a problem to run one, are there any security implications I need to consider? looking at their Faq it seems safe enough...

WelcomeShorty• 5 years ago

When you consider running an exit on your home IP: you will be blocked by Netflix.

angularbot773• 5 years ago

Snowflake is not an exit node though, just an intermediary

thejosh• 5 years ago

I ran a bridge for a while, had no problems with anything as I was just a bridge. Had a decent connection when I did.

samhw• 5 years ago

I'm running one. It seems totally fine, and I'd really strongly recommend doing it. Remember you have to leave a tab open for it to work. The website doesn't emphasise this enough, in my view. If you simply pin the tab, it'll be (a) very persistent and hard to accidentally close, and (b) totally inconspicuous, so I recommend doing that.

I'd also strongly recommend running a full Tor node. The best way we can support Tor is to flood the zone with proxies, so it's no longer possible for intelligence agencies to control quora of Tor entry and exit nodes, as they very likely do. If you live in the developed world and have a good internet connection, I think it's a civic duty to redistribute your bandwidth - to socialise the means of conduction.

Edit: 'Quora' was probably a poor choice of word, since a quorum implies consensus between nodes, as in a distributed system. It's really about intelligence agencies controlling _majorities_ of nodes - or even a large number - so as to make it more statistically likely that any given Tor circuit will begin and end with a node under one's control.

jerheinze4• 5 years ago

Remember you have to leave a tab open for it to work

Better yet just install the Snowflake addon (available for both Firefox and Chrome), so it becomes more of a set-and-forget thing.

makeworld• 5 years ago

I've been running one for years, after hearing a presentation on the system at the OurNetworks conference in Toronto. Haven't had any issues with it, and it's cool to see when I've helped a person or two in the last 24 hours.

gnfargbl• 5 years ago

How does this cope with the case where the NAT hole-punching fails and both WebRTC clients are unable to accept an incoming connection? A TURN relay seems like it would get blocked.

Edit: I should have just read the documentation [1]. It relies on the STUN/TURN servers being public and commonly used so that blocking them will break many other applications. Unfortunately, I don't know if the regimes where this is needed will care about that.

[1] https://gitlab.torproject.org/tpo/anti-censorship/pluggable-...

tootahe45• 5 years ago

Just a reminder if you're being censored in any serious way then don't use TOR, as the network is largely controlled by a few actors and the devs don't seem to care / or don't have the proper resources to deal with it.

https://nusenu.medium.com/is-kax17-performing-de-anonymizati...

alufers• 5 years ago

Is there any alternative, though?

bbqbbqbbq• 5 years ago

Outline (getoutline.org) is a super easy to use you run on a cloud server. No logging and it works everywhere there's censorship, and it's easy to share access to your server with as many or as few people as you like. The only cost is the cost of running the cloud server, a few dollars a month if you use LightSail or DigitalOcean. Disclaimer: I used to work on it.

throwaway77384• 5 years ago

What would one use when one is being censored in any serious way?

Santosh83• 5 years ago

Symmetric encryption with physical key exchange.

angularbot773• 5 years ago

Are there any implications for using native tor (non-exit) services?

orborde• 5 years ago

This uses domain fronting, which both Google and Amazon forced Signal to stop using in 2018: https://signal.org/blog/looking-back-on-the-front/

Did cloud providers get more permissive since then?

EDIT: Tor also got hit by some shutdowns in 2018 due to its use of domain fronting:

https://blog.torproject.org/domain-fronting-critical-open-we...

https://gitlab.torproject.org/tpo/applications/tor-launcher/...

From the second link, looks like the plan is that Snowflake will annoy cloud providers less by only using the domain-fronting channel to propagate routing info:

sending Tor traffic directly through domain fronting (rather than using it only to distribute bridges and snowflakes) enables these platforms to claim that this technique is used by malware and therefore harmful to users, justifying shutting it down.
Snowflake is a more sustainable way for us to use the expensive but high censorship-resistance features of domain fronting as a low bandwidth bootstrapping channel.

jerheinze4• 5 years ago

FWIW there's another method for bootstrapping Snowflake that uses Google's AMP cache: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-...

nirui• 5 years ago

If I'm allowed to guess, Tor Browser has Meek built in and it includes a few services hosted on Microsoft cloud. As far as I understand it, it can be quite expensive consider the total amount of traffic those Meek server must relay.

However, I wouldn't consider it "censorship-resistance".

From reading their Technical Overview document, I got the impression that they put a lot of faith on Domain Fronting which might not be a good thing

... the censor cannot block the broker without blocking all of Google, or all of Amazon, hence collateral freedom.

Yeah, true ... true ...

xvector8• 5 years ago

Devil's advocate - VPN might be better than Tor. Hear me out:

A VPN provider's business is keeping your connection private. They have no incentive to log because the leakage of such logs would be catastrophic. Thus, a reputable VPN provider is unlikely to be a front for a nation-state actor. There is a strong financial incentive for a VPN provider to do their job, as stated, no conspiracies, and do it well.

Tor, on the other hand, has frequently had bad actors comprise a significant portion of running nodes, to the point where being the victim of a correlation attack wouldn't be unlikely for a regular user. Intelligence agencies and bad actors alike have immense incentive to saturate the Tor network with bad nodes. Finally, Tor has been plagued with issues and vulnerabilities, that they seemingly do not have the manpower or technical ability to fix: https://www.hackerfactor.com/blog/index.php?/archives/906-To...

I suspect that the future of anonymous communication will be a mixnet resistant to correlation attacks (unlike Tor.) An example - https://nymtech.net/

elsjaako3• 5 years ago

The major VPNs log, this has been shown in court cases. If they say they don't they're either using a limited definition of log, straight up lying, or about to run into problems with the government.

My source isn't an open one, but here is one (that sites different cases than I saw): https://restoreprivacy.com/vpn-logs-lies/

xvector8• 5 years ago

The major VPNs log, this has been shown in court cases.

Some VPNs have proven no-log in courts, eg PIA.

The VPNs in your article are far from reputable.

waynesonfire• 5 years ago

Okay but to be clear that's not a requirement for the problem being addressed here, which is attempting to get through censorship. Anonymous browsing is a more general problem.

I don't think the OP made a good argument that VPN is a suitable solution, but certainly introducing unnesccessary requirements may be disqualifying a possible working solution.

Now, if the censor has the power to invoke great harm to those attempting to bypass then anonymous browsing is the requirement.

Heliosmaster2• 5 years ago

I'm not so sure about your argument: the usual argument against a VPN is that you are trusting effectively somebody else's computer. They can have all the business incentives in the world, but we know that some states go knocking on doors with gag orders. A 5$ wrench (or its threat) can get a long way.

The point is that we can't easily know who is compromised and who is not. There's always a certain level of trust required. The argument is that if you host your own VPS and use that as exit-node, at least what you're buying is more generic and the VPS provider most likely wouldn't care. But again, it's a matter of trust.

xvector8• 5 years ago

but we know that some states go knocking on doors with gag orders.

Hence the need to buy from a reputable VPN, based somewhere where gag orders are not legal.

Personally, I'd believe a carefully chosen VPN provider to be more trustworthy than a random selection of Tor nodes.

goodpoint2• 5 years ago

Any intelligence agency with the ability to monitor the majority of Tor traffic (AKA a global observer) would have no problem at all doing correlation attack against a VPN provider.

Intelligence agencies and bad actors alike have immense incentive to saturate the Tor network with bad nodes

Bad node owners largely not cooperate with each other, and this keeps Tor safe.

the future of anonymous communication will be a mixnet resistant to correlation attacks

I2P has been around for 18 years. Please do use HN to advertise cryptocurrencies.

xvector8• 5 years ago

AKA a global observer

Between a single malicious node and global observer is the simple act of running many Tor nodes, which is comparatively much cheaper and much easier.

Bad node owners largely not cooperate with each other, and this keeps Tor safe.

It does not. Nearly 10% of Tor nodes were run by a bad actor at a certain point this year. About 1 in 300 Tor users were completely deanonymized at that point in time. Much more if you use mobile Tor, which doesn't seem to pin a guard node.

"a 16% chance that a Tor user would connect to the Tor network through one of KAX17’s servers, a 35% chance they would pass through one of its middle relays, and up to 5% chance to exit through one." - https://therecord.media/a-mysterious-threat-actor-is-running...

I don't know about you, but a 0.3% chance of deanonymization on every route change is pretty unacceptable.

I2P has been around for 18 years.

I2P is not well maintained, it is not a mixnet, and it does not have the same security guarantees as the Nym mixnet.

https://blog.nymtech.net/vpns-tor-i2p-how-does-nym-compare-8...

Please do use HN to advertise cryptocurrencies.

Please do not accuse HNers of "advertising cryptocurrencies."

Merely mentioning the existence of a tokenized mixnet is not advertisement. We are allowed to talk about obviously relevant technologies, especially ones that improve on existing ones in novel ways.

_def• 5 years ago

Milking the market as long as it is possible sounds like another financial incentive to me. A lot of VPN providers make a dubious impression to me.

hodgesrm2• 5 years ago

Why is this comment being downvoted? I follow HN to get perspectives exactly like this one.

rank04• 5 years ago

Because most voters think it’s a shitty take. It’s a hell of a lot easier to identify a vpn user or compel a vpn provider than to perform timing/throughput/correlation attacks on the tor network. Correlation based attacks can take months of consistent observation assuming you control exit and entry nodes the victim is using. Even then you will only identify your victim within some probability.

In places where your government is this hostile and you’re doing something subversive you’re probably using an onion service or i2p which vpns cannot access.

schleck8• 5 years ago

Relevant: recently it was discovered that 10 % of tor nodes of any role have been run by a single actor, which most likely was a deanonymization effort

https://therecord.media/a-mysterious-threat-actor-is-running...

angularbot773• 5 years ago

How difficult would it be to make this extension android-for-firefox compatible? What about a standalone client?

jerheinze4• 5 years ago

A mobile browser addon would be less than ideal since you'd want the client to stay running in the background and since not everyone uses Firefox. The Guardian Project is working on implementing that standalone proxy server approach directly into Orbot: https://github.com/guardianproject/orbot/issues?q=is%3Aissue...

tapper• 5 years ago

I tryed out the Firefox pluggin, how do you know that it's working?

fsflover• 5 years ago

https://addons.mozilla.org/en-US/firefox/addon/torproject-sn...

marcodiego12• 5 years ago

What I really want: to be able to open a port on my computer behind a NAT and have a way for people outside it to connect without using special software.

Is there a solution yet?

wwn_se• 5 years ago

Just forward the port?

marcodiego12• 5 years ago

I think that is only possible if a have control of the NAT/router, right?

Namret• 5 years ago

ngrok (https://ngrok.com/) and localtunnel (https://localtunnel.me/) come to mind.

marcodiego12• 5 years ago

Localtunnels is close to what I want. Just would like it to be in form of a service run by volunteers, so I can have confidence it will not be corrupted by the possibility of profit in the future.

b112• 5 years ago

A http(s) proxy, like squid?

marcodiego12• 5 years ago

Like that, but in the form of a wide network of volunteers.

npteljes2• 5 years ago

I think you either do it with the router, or with a service that's outside of your network, there are no other ways.

This wiki article covers it all I think.

https://en.wikipedia.org/wiki/NAT_traversal

marcodiego12• 5 years ago

Hole punching and similar solutions need special software on both sides.

anderspitman2• 5 years ago

IMO tunneling is the best solution today. I see below that you're looking for something different, but this list might still be useful:

https://github.com/anderspitman/awesome-tunneling

KarlKemp• 5 years ago

Cloudflare used to have a service that would allow you to connect any local port to your cloudflare-managed domain. But I can’t find it just now.

erulabs• 5 years ago

Well, without using any special software is tricky, but I’m building a startup that offers this sort of tunneling for home-hosting purposes.

As for “special”-software-less, you might have to wait for IPV6 and a hosting-friendly ISP.

aaronsdevera• 5 years ago

Reminds me of the residential proxy services known for fraud and hacking...

Google cache of TrendMicro report https://webcache.googleusercontent.com/search?q=cache:RUzFCa...

Looks like Tor Project is operating with a similar model, using Snowflake proxy users as a sort of broker onto the network.

Clever, but will be interesting to watch how this gets used. My testing so far of the Snowflake broker seems to have attracted less than benign hosts https://twitter.com/aaronsdevera/status/1473354766965035013

Tor Snowflake Proxy

Related Stories