Google announces uProxy

http://www.engadget.com/2013/10/21/google-ideas-uproxy/

by Anon84 • 13 years ago

211 152 13 years ago

engadget.com

guidopallemans• 13 years ago

why should I trust google for an application that would enhance my internet privacy?

binarymax• 13 years ago

Privacy is not mentioned at all in the article. This is about bypassing censorship.

gbrindisi2• 13 years ago

What if censorship happens in USA?

Tyrannosaurs• 13 years ago

Except the bit that does mention it?

"The service has yet to launch, but its creators -- the University of Washington and Brave New Software -- have opened a restricted beta for select, technically adept users to make it as "secure, private, and robust" as possible."

venomsnake4• 13 years ago

Bypassing censorship without privacy is just good way to invite someone knocking on the door if you are interesting for the authorities.

adventured2• 13 years ago

It's not a Google product.

mostafah• 13 years ago

It will be very interesting for us living in Iran. We have a lot of friends abroad.

venomsnake4• 13 years ago

Doubt that it will help a lot - metadata is valuable. Sometimes the fact that you are communicating with someone is as damning as the communication itself.

Unless the addon is really sneaky and confirmed by a lot of people chances are it will still be detectable by DPI. And you have the problem of the addon traversing the state firewall in the first place.

And you need secure OOB way to transport password anyway.

From what I see you need secure way to transport keys and don't minding to raise a few red flags with the authorities.

In that case just rent micro instance with any out of country cloud provider you have access to and ssh tunnel trough it.

nfm• 13 years ago

Official links:

http://googleblog.blogspot.com.au/2013/10/new-free-expressio...

http://uproxy.org/

andyjohnson03• 13 years ago

Much more useful than the engadget link. Thanks!

StavrosK6• 13 years ago

Why isn't there a link to this from the Engadget article? That is useless and shoddy. Do they not know how the internet works, or have a single shred of common sense?

amiramir• 13 years ago

Thanks. I like some of the other initiatives listed there. Digital Attack Map is interesting to peruse though the graphics could be a bit clearer.

gbrindisi2• 13 years ago

Sorry Google, I can't really trust you anymore.

simfoo• 13 years ago

Open source + p2p. Why wouldn't you trust it?

_wmd• 13 years ago

Automatic updates?

idlewan• 13 years ago

It's not open source until we can have the source.

The old repo (https://github.com/UWNetworksLab/uproxy-common) mentions the new repo, which is hidden / not available.

So, not yet open source. So, still closed source, for now.

tombrossman• 13 years ago

Fast forward a year, HN headline: "Google shutting down uProxy".

It looks interesting and I'm sure some number of people will find it useful while it lasts.

andyjohnson03• 13 years ago

How exactly could they shut it down? Its a client-side browser extension that uses peer-to-peer connections. It doesn't run on any of Google's infrastructure.

I'm getting a bit tired of seeing this comment every time Google release a new product. I understand that people think they're being insightful in saying this, but they're really not.

dpd126• 13 years ago

Furthermore, it's not even created by Google directly:

"uProxy has been developed at the University of Washington, with help from Brave New Software. The project was seeded by Google Ideas."

Shish2k• 13 years ago

Ok, to rephrase for the pedant: "Google pulls core developers off of uProxy; without leadership, multiple incompatible forks form and quickly die"

(Not saying that that will happen, just clarifying what I presume is the grandparent's point)

ma2rten• 13 years ago

I knew that this was going to be a comment before I even opened clicked on the link or looked at the comments. Yes, Google shouldn't have shut down Reader and now get over it.

shazow• 13 years ago

While we're speculating about trust and such, the video mentions that it's a browser extension which connects to a trusted peer and uses the peer as a proxy. This leads me to believe that,

1. Since it's a normal browser extension, the source will be readable and verifiable.

2. It probably uses WebRTC.

It seems Google merely plays an incubator role here for the authors. Either way, I don't see much trust issues that other comments are complaining about.

Looking forward to trying this out when it's released.

toyg3• 13 years ago

the source will be readable and verifiable.

that's all well and good, but if it's executed by an unverifiable binary build of Chrome (i.e. the one distributed by Google), it's not worth much. For what you know, Chrome might just detect the extension is installed and silently eavesdrop on all its calls.

If this extension will work as-is on third-party Chromium builds compiled from public sources, then yeah, it can be trusted on those builds.

lwf3• 13 years ago

You say that like it probably won't. They state in the FAQ that it will work on FF and Chrome; there's no reason to think it won't work on Chromium as well.

ye• 13 years ago

We actually don't know with 100% certainty that Chrome runs the code that we see.

Considering Google is forced to comply with NSA's shit (and other agencies in their respective countries), I wouldn't trust my life to this extension.

sampk• 13 years ago

http://uproxy.org/

Can I look at the source code?

The source code will be released by the University of Washington under the Apache 2 license after the trusted tester phase is completed. If you would like to get involved sooner go to http://uproxy.org/#join

bjeanes2• 13 years ago

And your "friend" on the other end would also need to be running it on Chromium from trusted source.

draugadrotten2• 13 years ago

"If someone from a country with limited internet access installs uProxy, they can get a friend from the US to authorize them to surf the open web using their connection. "

In effect, they would also be sending all their sensitive, potentially illegal traffic to be read and copied by the american NSA agency. http://en.wikipedia.org/wiki/PRISM_%28surveillance_program%2...

People proxying illegal traffic through the USA would immediately be "on file" in the US registered as dissidents, criminals, and potential spies vulnerable to blackmail from US agencies.

I can see CIA looking at how their propaganda are affecting foreign nations by seeing who reads it from where. Foreign nations could even see proxying subversive traffic through the USA as being a worse crime than the subversive traffic itself.

Think twice about using this.

Grue3• 13 years ago

Why would somebody who lives outside of USA care about US agencies? All I want is to bypass my own country's censorship.

nyrina• 13 years ago

I don't think you care a lot, but I bet your friend, that is allowing you to use his network, loves your bomb search results on his IP.

anon1385• 13 years ago

Because non-Americans still have to worry about being abducted off the street and tortured by American agents: https://en.wikipedia.org/wiki/Khaled_El-Masri

draugadrotten2• 13 years ago

You may want to care about US agencies because: - you or your family members may want to travel to the USA or one of its allies. - the USA may trade your information with other states, including your own country - you may want to protect your own country from USA's spying

z92• 13 years ago

Because they are now vulnerable to blackmail from US agencies which can force them to work as their spies.

"Hello, This is NSA. Will you please provide us name of all your team members, your sponsors, and do a few work for us? Otherwise we have a log file that your government will love to see."

nwh4• 13 years ago

Don't know about you, but I'm in Australia - which is under the USA's "five eyes" program. I think it's very much my concern.

qwerta• 13 years ago

Because those agencies may eventually leak out that information. If their never delete stuff, everything they have will eventually be published in zeta-byte level leak.

frank_boyd2• 13 years ago

Ever heard of drones? I remember numbers that indicated for a country that there was 1 strike every 3rd day, on average. It was either Pakistan or Afghanistan.

toyg3• 13 years ago

Should one live in New Zealand, Australia, Canada, UK, France, Sweden, Italy, Germany or in one of many other countries with a recent record of bowing to pressure from US agencies (often in spite of local laws and/or over trivial matters like copyright), then one should care indeed.

znowi• 13 years ago

I can see CIA looking at how their propaganda are affecting foreign nations by seeing who reads it from where

Interestingly, this is the second Google project on HN today that caters to people in oppressive countries. uProxy and recently announced Project Shield [1]. The major targets are Syria and Iran. Incidentally, they're also targets for the US military :) Intel from the enemy territory will certainly be of interest.

Good PR that Google is getting from it is in no way helping with mass surveillance at home, which they're themselves a big part of.

[1] http://projectshield.withgoogle.com/

simias2• 13 years ago

If it's PR that actually helps build viable tools used to circumvent censorship and improve privacy on the web in general then I'm all for it. Rather that than some silly TV ad campaign, don't you think?

chaz2• 13 years ago

There's a third project, the Digital Attack Map. All three were announced together yesterday: http://googleblog.blogspot.com/2013/10/new-free-expression-t...

lallysingh5• 13 years ago

The launches are coming from the Google Ideas summit, linked in the article.

frank_boyd2• 13 years ago

Or, the shorter version:

Don't use any products that are offered by or have some kind of link to one of the known NSA partner companies (as seen in Snowden's slides).

simias2• 13 years ago

While technically true "the US" here is only used as an example, I don't believe the endpoints have to be in the US (if I understand correctly any user of this extension can choose to become a proxy).

An other point in the video (at around 0:50) mentions that you can select your route through trusted friends. If that's true it means that you can decide where your traffic transits.

Now obviously if you use the binary chrome builds made by Google they might put a backdoor in there but that's always true.

I don't think it's fair to dismiss this because it comes from Google, if it's open source and an open standard everybody will be free to audit it and decide for themselves.

If you don't want to use any crypto-product which might be even remotely related to the NSA then I have bad news for you...

sentenza2• 13 years ago

An important point that should be checked would certainly be if and when the plugin on its own tries to contact servers in the US, be they servers of Google or of the other parties involved.

If it doesn't, it deserves the attention of a more thorrough check.

I really like the idea of this, but somehow have a longing for the world we lived in one year ago, when news of such a project would not have been "tainted" by attaching the name of Google to it.

Sigh.

lallysingh5• 13 years ago

If you don't trust Google, run it in Firefox.

trvd1707• 13 years ago

Sad times when we have to choose between being censored or lacking privacy. Where did that talk of the global village take us?

panarky• 13 years ago

If I'm trying to avoid the Syrian secret services, then maybe NSA surveillance is the least of my concerns.

This is a peer-to-peer proxy so you don't have to proxy with a friend in the USA.

uProxy should be equally useful in avoiding US secret services (though Google's site doesn't highlight this use case).

nine_k• 13 years ago

But can you choose which peer to route through?

Also important: can you choose what to allow to pass through your connection? Can I rule out the case of someone accessing a child porn site through my connection?

If I were to run such a proxy, I'd only allow HTTPS or ssh traffic that I cannot possibly decrypt even if I wanted to, so I can't be held accountable for what I proxy.

Same is probably true for the other end: if I were to rely on someone unknown out there proxying my connection, I'd strongly prefer my entire connection to be encrypted, and my identity hard to trace. Else my proxying peers might happen to be exactly the people I'm trying to hide from.

res0nat0r2• 13 years ago

Can we stop every new thread on HN with NSA spy stories? The NSA can/has/is spying on you for a long time and it has nothing to do with any US company. Much of the traffic around the world (bound for the US or not) is routed through the USA due to us being such a central player, and these core routers have been tapped for a long time.

It doesn't matter if you are dealing with "US company" or not.

oceanplexian• 13 years ago

P2P is definitely a viable solution that makes their job significantly more difficult.

It's not nearly that clear what the NSA is doing. I've worked in the NOC and as a datacenter tech at a Regional ISP and we definitely did not have spying gear in our facilities. We had other, regional BGP peers so it's entirely likely your traffic never crossed the Internet to get to its destination. I'm still not convinced they've tapped a significant fraction of anything.

The Internet is a complex decentralized network and the NSA most certainly doesn't have the physical resources to tap more than a small fraction of it.

phaus• 13 years ago

With most threads, your request would be perfectly reasonable, but this is a technology designed specifically to keep your communications private. There aren't many threads where bringing up the NSA would be more relevant than it is here.

gibwell4• 13 years ago

Google is a long-time NSA collaborator. The risks of what they could share with them should always be scrutinized.

gohwell• 13 years ago

What about corporate firewalls?

nakedrobot2• 13 years ago

Nice! So I can use uProxy to access the Google Play store to buy a Nexus phone? ("Sorry, not available in your country")

Thanks Google :-)

ygra2• 13 years ago

And people in Germany can finally watch Youtube music videos ;-)

sentenza2• 13 years ago

I wonder how many of my compatriots actually live with those restrictions and how many find ways to circumvent them.

By blocking so many Youtube videos, GEMA has done a huge service to internet literacy in Germany. It still surprises me that, every now and then, I overhear complete laypeople discuss among themselves the setting up of proxy servers.

svantana• 13 years ago

Remains only to figure out how to route the physical delivery via a US address... anyone know of such a service? I'd find that pretty useful actually. A lot of stuff on e.g. Amazon is only available for delivery to the US.

chaz2• 13 years ago

Lots of them are available. I haven't used any of these, but you may want to give one of them a shot: http://www.hongkiat.com/blog/mail-parcel-forwarding-services...

roninresearcher• 13 years ago

I personally use Aramex shop and ship account http://www.shopandship.com for US only products from Amazon. Buying from Google play is more difficult as they added a security procedure that the credit card has to be from US and the shipping address from should match for circumventing this, earlier one could use a US proxy and order it.

knob• 13 years ago

I wouldn't trust Google with this.

Fuck no.

Why don't they help develop the Tor plugin?

Why don't the open up a whole bunch of Tor nodes?

Wait... scratch that last one.

This is just bad.

esteth2• 13 years ago

Because it appears to be open source and peer to peer, so you don't need to trust Google at all?

nwh4• 13 years ago

Open source does not mean secure. Half the time nobody even reads the source, let alone compares the binaries to the repository.

tensafefrogs• 13 years ago

You don't need to trust Google. They seeded the project and now it is open source ("uProxy has been developed at the University of Washington, with help from Brave New Software. The project was seeded by Google Ideas.")

uProxy is better than Tor (as long as you have a friend you can trust that has access to the content you are interested in). The problem with Tor and other proxies is that you don't know who controls the proxy or exit node, so can't trust it. Is your government running Tor nodes and logging everything and tracing it back to you? Maybe. You can't know.

uProxy is good.

saljam2• 13 years ago

This sounds good. But how is it better than just installing Tor?

fiatjaf• 13 years ago

"just"? Man, normal people can't install Tor. It is not that it is difficult for them, it is impossible.

Also, this solves a problem slighlty different from what Tor solves, in my opinion.

saljam2• 13 years ago

Fair point. They make an effort with the Browser Bundle but I just tried it and it broke on the second run...

Now I want to write a Tor compatible client that 'just works'. Just one static binary that implements the proxy. It embeds a static firefox binary and a prepared profile, which gets extracted into a visible location so the user can delete it if desired.

Basically minimize its dependence on the environment as much as possible.

iSnow• 13 years ago

Slackers rejoice! No way to block you from surfing porn at work anymore :)

venomsnake4• 13 years ago

Because the slackers that surf porn at work have no idea how to bring a tablet to work loaded with porn.

wil421• 13 years ago

So is this kinda of like Tor but without the anonymity and only one peer to connect to?

parfe• 13 years ago

I see uProxy as giving a friend my wireless network password. I'd compare a Tor exit node to printing the network password on my mailbox or posting it to craigslist.

I regularly share my wireless network access with friends without thinking, while running a tor exit node/publishing my network password gives me serious liability concerns.

r0h1n5• 13 years ago

Another "free" Google service that blinds lay people from objectively considering the cost vs. benefits of online privacy/anonymity (since "free" tends to make us act irrationally). Instead, consider paying the equivalent of a cup or two of coffee and buy yourself a real VPN subscription. Even if you must get yourself a free VPN, consider someone other than Google, a company that already has so much data on your digital lives.

StavrosK6• 13 years ago

Did you read the article? It's not a Google service. Why buy a "real" VPN subscription instead of running things through a friend, which is way more decentralized and harder to surveil en masse?

r0h1n5• 13 years ago

I did. I also went to the uProxy site which mentions it was seeded by Google Ideas. Also,

> One of the ways uProxy connects you through your friends, is by connecting to existing chat networks, such as Facebook or Google Hangouts. uProxy can use a chat network to discover new friends and setup peer-to-peer proxying from your friends. If a user does so, then the chat network can see that the user has uProxy installed. A user's chat contacts may also see this.

So Google funded uProxy; it will be able to see who your VPN "host" is via Google Hangouts; and lastly it controls one of the two browsers on which this plugin runs, Chrome.

That's too much Google for me, personally.

Lewisham2• 13 years ago

This is a key point: VPNs provide an obvious point of failure, and are easily shut down and/or monitored by repressive regimes. The big concern is not that the VPN is shut down, but that those who connect to it are being monitored, and will get a visit from the secret police.

It's P2P so that you have clear endpoints, so repressive regimes can't ascertain whether it's a VPN or not. It's also helpful in that you might well trust a friend in another country over a VPN company.

cromwellian2• 13 years ago

Speaking of lay people who don't objectively evaluate things, you posted this before you even learned the details of what uProxy was. You saw the word "Google" and hit reply.

lispm• 13 years ago

So US government employees could install it to read Snowden's documents?

Then the NSA gets a list of those who do?

venomsnake4• 13 years ago

I have a better idea - bring the cost of project loon balloons really low (order of magnitude below the price of the rockets needed to shoot them) and just flood the censoring country sky with them.

The country will either have to bankrupt itself or open its internet.

StavrosK6• 13 years ago

From a cursory reading, 70% of the comments in here are people who came straight to this page to say "I don't trust Google/why wouldn't they do <something else>/Google will just shut this down".

Can we stop with the kneejerk reactions? This is a p2p browser extension, doesn't run through Google, wasn't developed by Google, the only involvement Google had was maybe fund it.

Are we going to be getting these comments any time Google is mentioned from now on?

jstalin• 13 years ago

...and how many of these people's own government are doing the same thing as the NSA? I abhor what the NSA is going, but goodness, I bet 90% of the nation's governments do the same thing.

ScottWhigham2• 13 years ago

Are we going to be getting these comments any time Google is mentioned from now on?

Yes, and I think rightly so. What evidence do you have that this will not happen? None - which is the less evidence that the people saying it will happen have. Google has earned that rep and, until 1-3 years have gone in which they've not done something like that, people will continue to bring it up.

StavrosK6• 13 years ago

What evidence do you have that this will not happen?

"This" being "shut it down"? My evidence is that this is a third-party extension, developed by a third party and doesn't touch Google's infrastructure at all. They couldn't shut it down if they wanted to. The most they could do would be to cut its funding, but it's still open source.

gibwell4• 13 years ago

The point is that Google was once held in high esteem because it acted in an unusually trustworthy way for a large corporation.

Almost everything they were fundamentally trusted on has turned out to be a betrayal. It is right and natural to question and distrust them until they have reestablished trust, which is likely to be a long process.

You will notice that as well as the appropriate distrust, there are also comments from people including yourself who have examined the proxy and determined that Google's trustworthiness is irrelevant to the trustworthiness of the proxy.

This is exactly how it should work. People are right to distrust Google, so the question should be asked. But we are also a technical community who can then analyze and understand the situation to determine whether concern is warranted.

The last thing we need is for people to silence their distrust and for scrutiny to stop.

StavrosK6• 13 years ago

This is a straw man. Nobody says you should implicitly trust Google, the second line in my comment talks about stopping knee-jerk reactions. People here started ranting about Google without even seeing what the actual product is, which is pretty much the definition of knee-jerk.

I wouldn't mind people criticizing it if it's valid criticism, but this is just talking for the sake of talking.

runn1ng• 13 years ago

Can I look at the source code ?

The source code will be released by the University of Washington under the Apache 2 license after the trusted tester phase is completed .

This is the important part.

lotsofcows• 13 years ago

Good timing as nyud.net seems to have stopped working.

xr09• 13 years ago

So Google helps building a proxy for by passing their own censorship, Bravo Google, Bravo. (I'm being ironic of course)

This is what I get any time I try to download anything from Google Code or Android sdk or even read something hosted on GAE.

http://s24.postimg.org/gr0lto1l1/work107.png

I'm in Cuba but the same should be for Iran and others "bad boys".

lwf3• 13 years ago

By "their own", you mean "as required by US export restrictions that all US companies have to abide by", right?

hrjet2• 13 years ago

The irony here is that they are announcing a tool to subvert restrictions in other countries, but they are following their own countries restrictions to the letter.

Dylan168072• 13 years ago

They could serve the files in a way that doesn't export them from the US.

Or frankly they have a good legal team, why not fight the ridiculous idea that math is a weapon.

And yes Google do own their own actions, even the legally required ones.

pekk• 13 years ago

Because Google determines US policy and also the policy of the Castro dynasty.

jsilence2• 13 years ago

Why don't they simply run Tor end nodes in each of their server farms all over the world. That would actually help. But that would not make any mainstream news, would it?

Bleh.

Lewisham2• 13 years ago

The problem with Tor is that it's not clear who is running which nodes and where you'll come out. uProxy is designed for people who know that their endpoint is friendly, such as a friend who no longer lives in the country, or a journalist that you are working with.

jjoe• 13 years ago

This is going to be a nightmare if you verify and process transactions online. How do you now know whether someone who purchased a product is really really on Comcast from SoCal and not someone who's exploited a hole in uProxy?

fbeans• 13 years ago

How is this new? I can create a proxy server now, and I can share it with a friend and they can use my internet connection. They can do the same.

This is new because, It's likely easier to use, and it's all done in the browser.

The technology is certainly not new though...

Apache with mod_proxy, nginx, squid, ssh,

just to name a few of the many ways to do this...

Further to this, one doesn't need a browser plugin to do this, firefox for example already has configurable options to connect to proxy servers.

X4• 13 years ago

If a dissident hacks into a government site or does something else like speaking out his opinion, will I get arrested for them, when I live in a neighbour country? Or even get arrested for their actions on hacking stuff? I mean the US and Europe both ban hacking and penalize it with more jail time than rape and in some cases even murder.

lallysingh5• 13 years ago

UProxy is a point-to-point proxy, where both sides know each other (by being buddies on the chat network) and choose to participate with one another. Don't proxy for your hacker friends.

ScottWhigham2• 13 years ago

I'm interested to see if their AdWords/AdSense algos will detect uProxy and choose not to serve ads to its users. Right now, the US/UK/Canada are huge markets for Google AdWords/AdSense but most US-based companies do not have their ads shown in Latvia/Iran/Russia (just to randomly pick some faraway countries). There's a good reason - if I own a restaurant in Dallas, for example, I want people searching for "best dallas steak restaurant" to see my ad. If that starts getting shown worldwide, the CTR will plummet which would not be good for Google.

awakeasleep• 13 years ago

Wow. If they added an option to be an intermediate proxy for traffic you were unconnected with, could they turn this thing into a global tor with authorized exit nodes?

benologist• 13 years ago

Original url: http://www.reuters.com/article/2013/10/22/google-tools-idUSL...

cromwellian2• 13 years ago

The article has reached a new low in bullshit, knee-jerk, commentary. No one bothers to read the FAQ, or the technical information on how it works. Oh no, just hit "Reply", put on the tin-foil hat, and get going. Yeah, vote this down. I'm frustrated at the quality of HN posters recently.

tete• 13 years ago

Okay, sorry I didn't read the source code yet, but don't pretty much all the standard block-censorschip-circumvention approaches work here? They don't mention anything that makes it a tool for actively circumventing censorship like... well, all the tools that exist today and have been analyzed throughly.

caiob• 13 years ago

Hulu, Pandora and other US-only internet services now available. Brought to you by Google.

vsviridov• 13 years ago

So now you also expose your confidants? So if you are targeted they automatically get on the list? Why inconvenience the secret service with doing tedious network analysis to flush out your peers - uProxy might (they are not very specific about the security of peers) disclose that automatically...

Google announces uProxy

Related Stories