Hacker News: fruitreunion1

New comment by fruitreunion1 in "Inactive Google Account Policy"

fruitreunion1 — Sat, 12 Aug 2023 12:28:39 +0000

How does this affect old YouTube videos (and possibly other historical public content)? (obviously, save everything you love while you still can in case things get removed or difficult to archive due to attestation/DRM)

New comment by fruitreunion1 in "Russia Starts Blocking VPN Protocols"

fruitreunion1 — Fri, 11 Aug 2023 09:00:36 +0000

The idea is you connect to the wireguard UDP port from one of the obfuscation tunnels.

laptop -> obfuscation tunnel (udp2raw/iodine/ssh/tor/wstunnel/etc.) -> wireguard UDP port. Though some protocols like ssh or tor only support TCP, so you have to run an additional tunnel in the machine to get to wireguard (udp-over-tcp).

New comment by fruitreunion1 in "Browsers barely care what HTTP status code your web pages are served with"

fruitreunion1 — Fri, 11 Aug 2023 08:47:27 +0000

Their point I think is that often (to varying degrees), 'power user' things are less convenient to do or behind configuration options or menus and so on nowadays.

New comment by fruitreunion1 in "Russia Starts Blocking VPN Protocols"

fruitreunion1 — Thu, 10 Aug 2023 12:39:52 +0000

I think this is a good thing. Apply obfuscation on top of WireGuard, that way you can have the functionality and security of the WireGuard tunnel and swap between different obfuscation techniques as needed.

New comment by fruitreunion1 in "Russia Starts Blocking VPN Protocols"

fruitreunion1 — Thu, 10 Aug 2023 12:37:54 +0000

No. https://www.wireguard.com/known-limitations/

>Deep Packet Inspection

>WireGuard does not focus on obfuscation. Obfuscation, rather, should happen at a layer above WireGuard, with WireGuard focused on providing solid crypto with a simple implementation. It is quite possible to plug in various forms of obfuscation, however.

>TCP Mode

>WireGuard explicitly does not support tunneling over TCP, due to the classically terrible network performance of tunneling TCP-over-TCP. Rather, transforming WireGuard's UDP packets into TCP is the job of an upper layer of obfuscation (see previous point), and can be accomplished by projects like udptunnel and udp2raw.

New comment by fruitreunion1 in "Russia Starts Blocking VPN Protocols"

fruitreunion1 — Thu, 10 Aug 2023 12:35:53 +0000

I disagree. I think it's good that implementing a secure network tunnel and obfuscation are separate. WireGuard can handle the secure tunnel functionality while I can apply any sort of obfuscation protocol on top of it without worrying about its security or having to reconfigure the network, like udp2raw, iodine, shadowsocks, websockets, etc.

New comment by fruitreunion1 in "Infrastructure audit completed by Radically Open Security"

fruitreunion1 — Wed, 09 Aug 2023 12:55:25 +0000

I don't want to revoke a key to test but I'm pretty sure that just sets the port in the Endpoint part of the WireGuard config file. (the port you use to connect, for if the regular one is blocked). Are you sure your service behind Mullvad is accepting incoming connections?

New comment by fruitreunion1 in "The year of Linux On Desktop^WMobile [video]"

fruitreunion1 — Wed, 09 Aug 2023 00:10:15 +0000

You forget that some people like general purpose computing. Android and other mobile operating systems (as well as Chrome OS) do have great security, but that comes at the expense of functionality (arbitrary code execution is discouraged, putting things inside apps and strict APIs make scripting and tinkering infeasible) and user control. One of the mentioned in the talk was being able to use the traditional Linux stack and being able to use your smartphone as a general purpose computer (2:22, 4:12). I hope one day there's a solution, but it seems trade offs have to be made to have one or the other.

New comment by fruitreunion1 in "The year of Linux On Desktop^WMobile [video]"

fruitreunion1 — Tue, 08 Aug 2023 23:47:56 +0000

Another term I've seen used is "traditional Linux distributions" as opposed to locked-down/less general purpose like Android and Chrome OS.

New comment by fruitreunion1 in "The year of Linux On Desktop^WMobile [video]"

fruitreunion1 — Tue, 08 Aug 2023 23:46:48 +0000

Well, Alpine wouldn't fit that definition but is still a user-controlled Linux.

New comment by fruitreunion1 in "Your computer should say what you tell it to say"

fruitreunion1 — Tue, 08 Aug 2023 23:39:34 +0000

>We should not destroy the entire internet to protect/increase adtech profits.

Yeah, ideally businesses wouldn't be built on this model (free service funded by ads at the expense of privacy and now user control). Then we might not have had to worry about widespread fingerprinting AND we can maintain user control too.

New comment by fruitreunion1 in "Your computer should say what you tell it to say"

fruitreunion1 — Tue, 08 Aug 2023 23:32:47 +0000

>To prevent ad fraud either you need to increase the fingerprintablity of users on the web, violating people's privacy, or implemented a form of remote attestation, which protects people's privacy.

>If EFF cares no much about privacy on the web they should be in favor of this proposal.

Privacy on the web by implementing remote attestation across the web will inevitably in practice reduce digital rights and user control/freedom. The EFF also cares a lot about this, so it makes sense that they would be against the proposal. Both of these goals could be achieved by websites providing the same behavior regardless of the client browser/software that is requesting pages. The reason we have to lie is because user-hostile businesses/sites don't want to adhere to this (advertising, DRM). (ignoring useful things like providing a mobile version of a site)

To note, fingerprinting is always going to be technically possible (especially given the larger and larger feature scope that businesses have wanted to impose upon the web since its inception), WEI is just an attempt to stop ad-driven sites from trying to do it.

New comment by fruitreunion1 in "mCaptcha: Open-source proof-of-work captcha for websites"

fruitreunion1 — Tue, 08 Aug 2023 22:34:26 +0000

When the alternative is sacrificing privacy or anonymity, I think it's at least useful, even if not ideal given the current energy situation.

New comment by fruitreunion1 in "The Right to Lie and Google’s “Web Environment Integrity”"

fruitreunion1 — Mon, 31 Jul 2023 13:48:04 +0000

I think in internal environments like within a company it's fine. Just not in the public, user-facing web.

New comment by fruitreunion1 in "The Right to Lie and Google’s “Web Environment Integrity”"

fruitreunion1 — Mon, 31 Jul 2023 13:21:20 +0000

>Can someone give a counter argument of how this might benefit the users themselves?

Remote attestation might reduce the amount of cheaters in games and fraud in banks if implemented properly. So, through potential indirect means.

I don't think any of this is worth the loss of user freedom and functionality, though. So I will vehemently oppose WEI and similar to be used outside of internal facilities.

New comment by fruitreunion1 in "The Right to Lie and Google’s “Web Environment Integrity”"

fruitreunion1 — Mon, 31 Jul 2023 13:12:51 +0000

Is there really much browsers can do to actually effectively restrict fingerprinting without going all out like Tor Browser? WEI may disincentivize websites to not use fingerprinting, but if they really wanted to, they could use it for de-anonymization purposes.

New comment by fruitreunion1 in "The Right to Lie and Google’s “Web Environment Integrity”"

fruitreunion1 — Mon, 31 Jul 2023 13:05:33 +0000

Tor Browser defaults to JS enabled.

New comment by fruitreunion1 in "IRC is the only viable chat protocol (2022)"

fruitreunion1 — Sat, 29 Jul 2023 12:01:39 +0000

Yeah, I think there's just a disconnect in culture. Making IRC more viable towards those who like Discord etc. would fundamentally change and ruin it for many who like IRC. And vice versa. So IRC will never resurrect and be used by the masses again.

New comment by fruitreunion1 in "IRC is the only viable chat protocol (2022)"

fruitreunion1 — Sat, 29 Jul 2023 11:57:54 +0000

>Go ahead and create 1 account per 1 server, nothing prevents you.

Doesn't having to give up a phone number for each account (and you can't use the same number on different accounts) make it difficult? (unless you haven't had to, maybe my browser is suspicious, but it's just regular old Chromium). Would like to do this so that I can separate IRL/weak pseudonym (from random people in servers, obviously you can't be truly anonymous on Discord)

New comment by fruitreunion1 in "Tor’s shadowy reputation will only end if we all use it"

fruitreunion1 — Sat, 29 Jul 2023 01:26:38 +0000

I use it for just about everything except for things tied to IRL identities. (short-lived usage like making a search request, to persistent identities like this)

Some services block Tor. Sometimes they can be bypassed by pressing "New Tor circuit for this site" a few times, sometimes they cannot. Some of the methods listed here [0] can help (though I wouldn't log into any accounts using this as TLS isn't being terminated at your machine).

Some features don't work in Tor Browser, off the top off my head, sites using AudioContext, Webauthn, Webassembly. (webassembly can be a pain due to some encrypted paste bin sites using it).

I run multiple instances of Tor Browser (separated with Linux namespaces, particularly netns because Tor Browser will fail to load if an existing Tor service is running at port 9150) so that I can multitask between for example posting this on HN and random browsing in another instance. That also helps with the webassembly thing as I run a script to spin up a temporary instance of Tor Browser, enable webassembly in about:config, and load the failing page.

For the sites that block Tor that I need to login to or that don't work with the ad-hoc methods listed above, I will fallback to using a VPN + an about:config-modified version of Tor Browser that has the Tor proxy disabled. Mullvad Browser can also be used as an alternative.

I also use it outside of TB for IRC among other things. You have to be careful as there is no uniform configuration for everyone like TB.

0: https://gitlab.torproject.org/legacy/trac/-/wikis/org/doc/Li...