Snowflake(snowflake.torproject.org)
snowflake.torproject.org
Snowflake
https://snowflake.torproject.org/
60 comments
I ran a Snowflake server at home for a while. I shut it off because it used too much CPU for my liking, but I haven't seen any kind of negative impact whatsoever.
Domain fronting is not exactly a holy grail. Signal and Tor ran into issues when cloud providers blocked domain fronting (or rather, stopped supporting a feature that never was meant to work anyway) but I don't think that was intended to interrupt anything. "Load balancers are written to make sure they serve the correct certificates for their configured domains" isn't exactly a problematic feature on its own.
Domain fronting is trivial, all you need is a call to openssl and an nginx server. It's also trivial to bust, all you need to do is actually validate the certificate. These certificates are either self signed or are part of a random CA chain that no real system would ever trust.
It's not "a spy having their secret meetings inside an unsuspecting friend's house". It's someone putting a sign saying "white house, home of the American president, do not enter" in front of a random warehouse in Brazil.
Software that falls for domain fronting either doesn't care about the certificates and their validity, or is buggy and should get patched. Some of that software will probably be security software, but if bad actors manage to trick your security software into trusting a few readable strings, domain fronting is probably the least of your worries. I can't imagine what kind of shitty security software would possibly fall for that.
Domain fronting is not exactly a holy grail. Signal and Tor ran into issues when cloud providers blocked domain fronting (or rather, stopped supporting a feature that never was meant to work anyway) but I don't think that was intended to interrupt anything. "Load balancers are written to make sure they serve the correct certificates for their configured domains" isn't exactly a problematic feature on its own.
Domain fronting is trivial, all you need is a call to openssl and an nginx server. It's also trivial to bust, all you need to do is actually validate the certificate. These certificates are either self signed or are part of a random CA chain that no real system would ever trust.
It's not "a spy having their secret meetings inside an unsuspecting friend's house". It's someone putting a sign saying "white house, home of the American president, do not enter" in front of a random warehouse in Brazil.
Software that falls for domain fronting either doesn't care about the certificates and their validity, or is buggy and should get patched. Some of that software will probably be security software, but if bad actors manage to trick your security software into trusting a few readable strings, domain fronting is probably the least of your worries. I can't imagine what kind of shitty security software would possibly fall for that.
Thanks for contributing to anti-cesnsorship, I respect anyone who puts that effort it.
When I last looked, the intent was that eventually ECH endpoints offer the same effective service that you got with Domain Fronting, but without messing with the backend in a way which is disruptive for the cloud providers so they support it.
Encrypted Client Hello is the in-progress work to have even the client's initial contact to an HTTPS server be encrypted. https://datatracker.ietf.org/doc/draft-ietf-tls-esni/
Why would ECH be fine when Domain Fronting isn't? The problem with Domain Fronting is that we get surprised too late with the actual request. We get what appears to be a legitimate request for this-thing.example, so we do all the work to respond to a this-thing.example request and then... swerve, sorry I changed my mind, my request is actually about hidden-service.example.
With ECH we (but not an adversary snooping the connection) know immediately that the request is for hidden-service.example and so we don't waste our time setting up for the wrong work.
Encrypted Client Hello is the in-progress work to have even the client's initial contact to an HTTPS server be encrypted. https://datatracker.ietf.org/doc/draft-ietf-tls-esni/
Why would ECH be fine when Domain Fronting isn't? The problem with Domain Fronting is that we get surprised too late with the actual request. We get what appears to be a legitimate request for this-thing.example, so we do all the work to respond to a this-thing.example request and then... swerve, sorry I changed my mind, my request is actually about hidden-service.example.
With ECH we (but not an adversary snooping the connection) know immediately that the request is for hidden-service.example and so we don't waste our time setting up for the wrong work.
ECH is a good idea on paper but will never work in the real world.
Oppressive regimes just drop any connection lacking a plain text SNI. The browser will either retry without ECH, or the user will retry with a browser that does not support ECH.
I think people in the Western world don't exactly understand how internet censorship works. They don't give a shit about blocking large legitimate sites or breaking connectivity for large swaths of users if it helps them avoid losing power.
Oppressive regimes just drop any connection lacking a plain text SNI. The browser will either retry without ECH, or the user will retry with a browser that does not support ECH.
I think people in the Western world don't exactly understand how internet censorship works. They don't give a shit about blocking large legitimate sites or breaking connectivity for large swaths of users if it helps them avoid losing power.
> ECH is a good idea on paper but will never work in the real world.
Uhuh.
> Oppressive regimes just drop any connection lacking a plain text SNI.
All of the connections will have a plain text SNI. Many of them will have ECH. In some of them, at least at first the ECH will just be GREASE, in others it's real. For the server it's apparent which is which, for a snoop it's impossible to know. Indeed that's sort of the point of GREASE.
> They don't give a shit about blocking large legitimate sites or breaking connectivity for large swaths of users if it helps them avoid losing power.
We heard basically the same thing for TLS 1.3. But of course we actually rolled out TLS 1.3 with no major problems, even the anti-downgrade provision which was the part I was most sceptical about delivering. Google's Chrome GREASEs a bunch of TLS 1.3 already.
Uhuh.
> Oppressive regimes just drop any connection lacking a plain text SNI.
All of the connections will have a plain text SNI. Many of them will have ECH. In some of them, at least at first the ECH will just be GREASE, in others it's real. For the server it's apparent which is which, for a snoop it's impossible to know. Indeed that's sort of the point of GREASE.
> They don't give a shit about blocking large legitimate sites or breaking connectivity for large swaths of users if it helps them avoid losing power.
We heard basically the same thing for TLS 1.3. But of course we actually rolled out TLS 1.3 with no major problems, even the anti-downgrade provision which was the part I was most sceptical about delivering. Google's Chrome GREASEs a bunch of TLS 1.3 already.
I think the primary problem with domain fronting that ECH would solve is that ECH doesn't involve using a third party's domain name, potentially dragging a single third party into the censorship muck. My read of the support email signal shared is that AWS was unhappy that a domain they owned would likely become entangled. While ECH will still increase everyone else's risk that is sharing the same load balancer as a censorship target, it is at least a fully distributed risk, rather than requiring the client pick a specific domain or set of domains to pull into their fight.
> when they tried to roll it out on a wide basis for fear that countries like Iran and China would just block all of AWS
That is the whole point: make it so they have to block vast swatches of the useful internet in order to defeat it. Ideally, we should be able to make it so they have to block the entire internet to censor anything.
There must be some kind of limit to the amount of tyranny they're able to muster, right? Eventually the collateral damage will be too great and they'll give up on trying to censor anything. Alternatively, they will become such tyrannical societies that people won't accept it.
That is the whole point: make it so they have to block vast swatches of the useful internet in order to defeat it. Ideally, we should be able to make it so they have to block the entire internet to censor anything.
There must be some kind of limit to the amount of tyranny they're able to muster, right? Eventually the collateral damage will be too great and they'll give up on trying to censor anything. Alternatively, they will become such tyrannical societies that people won't accept it.
> The technique is heavily used by bad actors
Evidence?
Evidence?
It's in the OSEP course. :)
This is a relay for Tor users to be able to access Tor (when normal guard relays (first hop in a Tor circuit) are blocked), using domain fronting and webrtc.
The text is written quite confusingly, at least the German translation it served me by default. I was wondering how this could circumvent censorship, as the target needs to also support webrtc so there's no way to access any http(s) website via this in-browser proxy, this still requires another server to accept the webrtc connection and forward your traffic, but the point (which the article doesn't mention) is to be able to connect to this other server indirectly.
It even goes so far as to claim that you don't need any software to visit censored websites:
> Im Gegensatz zu VPNs musst du keine separate Anwendung installieren, um dich mit einem Snowflake-Proxy zu verbinden und die Zensur zu umgehen.
Except you do. Without Tor client, this snowflake proxy is useless. Clicking through to the technical details (link marked with a warning "this content is in English"):
> 1. User in the filtered region wishes to access the free and open internet. They open Tor Browser, selecting snowflake as the Pluggable Transport.
The article said "contrary to VPNs, you don't need to install separate software to circumvent censorship" and the technical overview says the literal opposite: you need to install a Tor client to make use of a snowflake proxy.
The text is written quite confusingly, at least the German translation it served me by default. I was wondering how this could circumvent censorship, as the target needs to also support webrtc so there's no way to access any http(s) website via this in-browser proxy, this still requires another server to accept the webrtc connection and forward your traffic, but the point (which the article doesn't mention) is to be able to connect to this other server indirectly.
It even goes so far as to claim that you don't need any software to visit censored websites:
> Im Gegensatz zu VPNs musst du keine separate Anwendung installieren, um dich mit einem Snowflake-Proxy zu verbinden und die Zensur zu umgehen.
Except you do. Without Tor client, this snowflake proxy is useless. Clicking through to the technical details (link marked with a warning "this content is in English"):
> 1. User in the filtered region wishes to access the free and open internet. They open Tor Browser, selecting snowflake as the Pluggable Transport.
The article said "contrary to VPNs, you don't need to install separate software to circumvent censorship" and the technical overview says the literal opposite: you need to install a Tor client to make use of a snowflake proxy.
I can't speak to the German translation, but the point the English version is making is you don't install Snowflake, you install software that uses Snowflake (most typically, Tor Browser). It's presumably trying to clarify things for confused users trying to figure out how to install Snowflake as a proxy or VPN application, when that's not how it works.
edit to add the direct quote (which seems pretty clear to me): "Unlike VPNs, you do not need to install a separate application to connect to a Snowflake proxy and bypass censorship. It is usually a circumvention feature embedded within existing apps."
edit to add the direct quote (which seems pretty clear to me): "Unlike VPNs, you do not need to install a separate application to connect to a Snowflake proxy and bypass censorship. It is usually a circumvention feature embedded within existing apps."
If Tor is illegal in your country, it seems pretty risky to try to use it. Since anyone can run a snowflake proxy, it would be a trivial exercise to just log connecting IP addresses. Then it's a gamble with vanishing odds of staying safe each time you connect.
In most places where Snowflake is useful, connecting to Tor is either legal or the laws against it aren't enforced. It's usually the creators/contributors of anti-censorship tools that face repercussions. That said, Tor Project pretty consistently emphasizes that all plugable transports are for AC purposes, not steganographic purposes, and while they're difficult to block, they will not stop the network operator from being able to tell you're connecting to Tor, and that it ultimately falls on the user to decide whether that's acceptable.
They could block Snowflakes with IPs from networks in unsafe countries, but that is trivially bypassed by the attacker just buying VPSs (or botnet nodes) in a freer country.
Skimming the Technical Overview[0], I don't see anything about mitigating the risks you mention.
The purpose of Snowflake seems to be to circumvent blocking of Tor, not to prevent detection of using Tor. It takes advantage of "Domain Fronting" and WebRTC to accomplish this.
[0] https://gitlab.torproject.org/tpo/anti-censorship/pluggable-...
Skimming the Technical Overview[0], I don't see anything about mitigating the risks you mention.
The purpose of Snowflake seems to be to circumvent blocking of Tor, not to prevent detection of using Tor. It takes advantage of "Domain Fronting" and WebRTC to accomplish this.
[0] https://gitlab.torproject.org/tpo/anti-censorship/pluggable-...
> that is trivially bypassed by the attacker just buying VPSs (or botnet nodes) in a freer country
A.K.A. "living off the economic land"
A.K.A. "living off the economic land"
"Just" don't connect from an IP that can be tied back to you, use black market sim in a separate phone, connect from places you don't go, turn it off when not in use... It gets expensive fast...
> use black market sim in a separate phone
In most countries this takes you from “may have committed a crime” to “have actually committed a crime”
In most countries this takes you from “may have committed a crime” to “have actually committed a crime”
We're talking about countries where using vpn is already a crime so no problem
> If you switch on the Snowflake below and leave the browser tab open, a user can connect through your new proxy!
I am not even sure, if I am getting this right. If I embed an iframe in my website, traffic from Tor users will get tunneled through my user visitor's IP? How does consent works with relay.love? Does my website vistor's IP show up as TOR exit node?
I am not even sure, if I am getting this right. If I embed an iframe in my website, traffic from Tor users will get tunneled through my user visitor's IP? How does consent works with relay.love? Does my website vistor's IP show up as TOR exit node?
It not an exit. But by default someone has to knowingly run the Snowflake applet but webmasters could modify the code to automatically essentially start a Tor guard in someones browser. Though, that would be very evil to abuse someones resources like that.
That example has the users consent before starting.
That example has the users consent before starting.
That's already how many shady VPN software work. Remember if a VPN is "free", you are the product. Web scraping companies pay $$$$ for residential and mobile IPs.
Friendly reminder that it's not just free VPNs that sell your data; many of the paid VPNs do also.
Yes, but running a Snowflake doesn't expose your IP to the website being visited, and therefore you're safe from abuse complaints/prosecution, unlike the people who run the exit nodes.
Yeah, those proprietary VPN apps.
"If you don't control the routing, you're being routed."
To be fair, ProtonVPN allows you to export their config. It seems to be an exception to your rule.
"If you don't control the routing, you're being routed."
To be fair, ProtonVPN allows you to export their config. It seems to be an exception to your rule.
[deleted]
You can disable WebRTC in most decent browsers if you're afraid this will be abused. WebRTC can be used for worse things (like port scanning your internal network) and for great things (video calling with millisecond latency, Peertube).
However, it should be noted that this mechanism doesn't just allow remote sockets to be created through Javascript. It can only communicate with other servers that either use some version of WebRTC/WebSockets or plaintext services that ignore the extra protocol overhead as garbage and happily parse the rest (some IRC servers and WebSockets are a nice example).
As you can see in the technical overview, people use peer to peer technology to connect to your browser, which then uses WebSockets to communicate with a WebSocket server for a normal Tor entry point.
However, it should be noted that this mechanism doesn't just allow remote sockets to be created through Javascript. It can only communicate with other servers that either use some version of WebRTC/WebSockets or plaintext services that ignore the extra protocol overhead as garbage and happily parse the rest (some IRC servers and WebSockets are a nice example).
As you can see in the technical overview, people use peer to peer technology to connect to your browser, which then uses WebSockets to communicate with a WebSocket server for a normal Tor entry point.
So, I'm reminded of the old 'store your files on youtube' thing[0] and I wonder how much bandwidth one could get using the same concept on one of the widely used voice conferencing solutions (like zoom) to further blend in. Bonus if you can do some kind of video steganography to transfer the data and have a 'real' call.
[0] https://github.com/DvorakDwarf/Infinite-Storage-Glitch
[0] https://github.com/DvorakDwarf/Infinite-Storage-Glitch
> Bonus if you can do some kind of video steganography to transfer the data and have a 'real' call.
What you are suggesting would bring the proposed UK Online Safety Bill (OSB) into operation, and by virtue of the encoding/stenography means that GCHQ govt code crackers will be involved in what would be classed Police matters, not govt regulator aka OfCom matters, despite the UK govt suggesting its just a function of the regulator. The OSB also reads like it will extend beyond borders, simply on the grounds that it could be used in the UK.
What you are suggesting would bring the proposed UK Online Safety Bill (OSB) into operation, and by virtue of the encoding/stenography means that GCHQ govt code crackers will be involved in what would be classed Police matters, not govt regulator aka OfCom matters, despite the UK govt suggesting its just a function of the regulator. The OSB also reads like it will extend beyond borders, simply on the grounds that it could be used in the UK.
That would be amazing. If that worked regardless of network, though, I can see people setting up a node and accidentally taking it to work or some other public network by mistake. I’m not sure if that’s better or worse than using it in a persistent connection.
Not sure how new this is but very cool that users can host a node simply by toggling an iframe or installing a browser extension. I wonder if these methods have much lower bandwidth limitations than the CLI version
There is also a standalone (go) version [0] that can be deployed on a server.
"one of the main advantages of standalone Snowflake proxies is that they can be installed on servers and offer a higher bandwidth and more reliable option for users behind restrictive NATs and firewalls."
[0] https://community.torproject.org/relay/setup/snowflake/stand...
[0] https://community.torproject.org/relay/setup/snowflake/stand...
I have it installed and like seeing the number go up. NUMBER BIGGER = DOPAMINE!!
I'm lucky to be born in Scandinavia, so there is really 0 internet censor, for now.
I'm lucky to be born in Scandinavia, so there is really 0 internet censor, for now.
You're just lucky YOU aren't affected yet. Try telling that norwegian poker player who is unable to wire legal poker earnings from a tournament abroad to his bank home. Or to any of the people who made money on crypto who they want to use as security for an appartment loan. Or to someone trying to wire gains from legal online casinos abroad. Or to someone trying to access a web site that the norwegian authorities do not like who are DNS blocked (yes, easy to circumvent for tech people). Goverment and politicians abusing authority and limiting individual freedom is already here and growing. When it starts affecting "most people" it is usually a lot harder to reverse. The norwegian goverment already passed a law that allow mass electronic surveilance. And they want to limit the public's access to goverment records. It's a very slippery slope, left side "social democrazy" (spelled "beuracratic dictatorship") like most of EU. People need to open their eyes and fight goverment overreach now.
My 2c on your scenarios.
>Try telling that norwegian poker player who is unable to wire legal poker earnings from a tournament abroad to his bank home.
Probably blocked due to terror laws. If you can't Western Union money, there is a REALLY good reason.
Wait until you hear about how we are a cashless society and our bank app for money transfer. That you need mobile ID and bank account to use :) Max tracking. But its very handy.
>Or to any of the people who made money on crypto who they want to use as security for an appartment loan.
Good, I hate crypto shit and I want it to go away. It is all a scam. Get a real job and invest in a real bank. Crypto is all tax fraud scam shit.
>Or to someone trying to wire gains from legal online casinos abroad.
Good, I hate gambling and online casinos. If you have to gamble, do it in my country so the taxes benefit.
>Or to someone trying to access a web site that the norwegian authorities do not like who are DNS blocked (yes, easy to circumvent for tech people).
Yes THIS I agree with. I think ISP DNS blocks piratebay etc here now. Or some ISPs do. It's shit, but I already use a 3rd party DNS provider on my PC and phones.
Your point btw? I am running the Snowflake when my browser is open.
>Try telling that norwegian poker player who is unable to wire legal poker earnings from a tournament abroad to his bank home.
Probably blocked due to terror laws. If you can't Western Union money, there is a REALLY good reason.
Wait until you hear about how we are a cashless society and our bank app for money transfer. That you need mobile ID and bank account to use :) Max tracking. But its very handy.
>Or to any of the people who made money on crypto who they want to use as security for an appartment loan.
Good, I hate crypto shit and I want it to go away. It is all a scam. Get a real job and invest in a real bank. Crypto is all tax fraud scam shit.
>Or to someone trying to wire gains from legal online casinos abroad.
Good, I hate gambling and online casinos. If you have to gamble, do it in my country so the taxes benefit.
>Or to someone trying to access a web site that the norwegian authorities do not like who are DNS blocked (yes, easy to circumvent for tech people).
Yes THIS I agree with. I think ISP DNS blocks piratebay etc here now. Or some ISPs do. It's shit, but I already use a 3rd party DNS provider on my PC and phones.
Your point btw? I am running the Snowflake when my browser is open.
My point was regarding the "no censorship in Scandinavia" comment that I replied to. The rest of your arguments are just ramblings about you not caring about individual freedom. You even justify their actions using your own made up arguments (which I'm not even bother going to sensibly refute). It is your exact attitude that gets us into trouble with power greedy politicians. You're an easy mark.
I love how your arguments against anything you dislike but should be legal because of personal freedom (gambling, crypto) is simply a teenager ranting.
> If you can't Western Union money, there is a REALLY good reason.
That isn't remotely true. Why on Earth would you ever give Western Union this kind of authority, lol.
They've proven they can't be trusted many times over, most notably when they participated in the blockade of donations to Wikileaks.
It's viscerally disgusting to me that just a few years after that, someone would put them on a pedestal as some kind of moral arbiter. What the fuck.
> Good, I hate crypto shit and I want it to go away. It is all a scam.
Yawn. What a tired and ignorant sentiment. The fact is, people saying things like this are making exactly the same destructive mistake as people saying 'all politicans are bad' - you're throwing out a very important baby with the bathwater.
Fortunately, digital money doesn't give a flying fuck about your opinion.
> Get a real job and invest in a real bank. Crypto is all tax fraud scam shit.
Ugh. See above.
> Good, I hate gambling and online casinos. If you have to gamble, do it in my country so the taxes benefit.
You lack the minimum required table stakes of tax knowledge to be saying things like this.
That isn't remotely true. Why on Earth would you ever give Western Union this kind of authority, lol.
They've proven they can't be trusted many times over, most notably when they participated in the blockade of donations to Wikileaks.
It's viscerally disgusting to me that just a few years after that, someone would put them on a pedestal as some kind of moral arbiter. What the fuck.
> Good, I hate crypto shit and I want it to go away. It is all a scam.
Yawn. What a tired and ignorant sentiment. The fact is, people saying things like this are making exactly the same destructive mistake as people saying 'all politicans are bad' - you're throwing out a very important baby with the bathwater.
Fortunately, digital money doesn't give a flying fuck about your opinion.
> Get a real job and invest in a real bank. Crypto is all tax fraud scam shit.
Ugh. See above.
> Good, I hate gambling and online casinos. If you have to gamble, do it in my country so the taxes benefit.
You lack the minimum required table stakes of tax knowledge to be saying things like this.
I'm surprised by how easy and literally one-click it was to use that. Bravo, Tor Project team.
We block every Tor IP we can find because we don't have the time nor patience to deal with the 99% burpsuite spam originating from these servers. Very cheap and effective solution.
How do you "find" them? You can just download the list with all exit node IPs.
https://check.torproject.org/torbulkexitlist
https://check.torproject.org/torbulkexitlist
What's my incentive to run a snowflake node?
What's the inentive?? Try the ALL NEW TORBUX!! A new ERC20 token with only an 80% pre-mine used to incentivise the participation in the Tor network! Now instead of giving back to a community you derive benefit from, you can pervert the relationship with monetary rewards that benefit an elite class who are planning on disappearing to the Cayman Islands after extracting enough wealth from you and your peers!
What’s the incentive to donate to charity? There’s no risk to you because it’s not an exit node.
The difference being that a donation is one-off.
Running a node is continuous.
Running a node is continuous.
You can also do recurring donations. Running a Snowflake proxy is basically free if you don't pay for internet traffic so it's a very cheap and low work way to help censored people.
Snowflake (software) : https://en.wikipedia.org/wiki/Snowflake_(software)
Tor (network) : https://en.wikipedia.org/wiki/Tor_(network)
The Tor Project : https://en.wikipedia.org/wiki/The_Tor_Project
Tor (network) : https://en.wikipedia.org/wiki/Tor_(network)
The Tor Project : https://en.wikipedia.org/wiki/The_Tor_Project
[deleted]
Anything new here from last year?
The technique is heavily used by bad actors and is being blocked by default[2] by some cloud providers. AWS went as far as sending a nastygram to Signal[3] when they tried to roll it out on a wide basis for fear that countries like Iran and China would just block all of AWS.
1. https://en.wikipedia.org/wiki/Domain_fronting 2. https://azure.microsoft.com/en-us/updates/generally-availabl... 3. https://signal.org/blog/looking-back-on-the-front/