It not an exit. But by default someone has to knowingly run the Snowflake applet but webmasters could modify the code to automatically essentially start a Tor guard in someones browser. Though, that would be very evil to abuse someones resources like that.

That example has the users consent before starting.

I looked into their community posts [0].

> If you run a snowflake proxy (like the browser extension) people will use your internet connection to connect to Tor, but not to exit to internet. So it doesn’t matter if sites are blocked, anyway they will exit to internet from an exit node in another place. [1]

From the landing page graphics, it looks like the thing is about connecting to a Tor bridge via proxying the traffic through user IP. But it is an iframe embed. From what I know hacking it to get to automatic consent on load isn't very difficult.

I am still a bit spooked. I took a look at couple of adblocking extensions and they are not blocking this service.

[0] https://forum.torproject.org/search?q=snowflake

[1] https://forum.torproject.org/t/should-i-run-a-snowflake-prox...

That's already how many shady VPN software work. Remember if a VPN is "free", you are the product. Web scraping companies pay $$$$ for residential and mobile IPs.

Friendly reminder that it's not just free VPNs that sell your data; many of the paid VPNs do also.

Yeah, those proprietary VPN apps.

"If you don't control the routing, you're being routed."

To be fair, ProtonVPN allows you to export their config. It seems to be an exception to your rule.

Yes, but running a Snowflake doesn't expose your IP to the website being visited, and therefore you're safe from abuse complaints/prosecution, unlike the people who run the exit nodes.

What a strange thing not to require browser consent for.

It asks for the user's consent.

Not in safari, but maybe it wasn’t actually working.

You can disable WebRTC in most decent browsers if you're afraid this will be abused. WebRTC can be used for worse things (like port scanning your internal network) and for great things (video calling with millisecond latency, Peertube).

However, it should be noted that this mechanism doesn't just allow remote sockets to be created through Javascript. It can only communicate with other servers that either use some version of WebRTC/WebSockets or plaintext services that ignore the extra protocol overhead as garbage and happily parse the rest (some IRC servers and WebSockets are a nice example).

As you can see in the technical overview, people use peer to peer technology to connect to your browser, which then uses WebSockets to communicate with a WebSocket server for a normal Tor entry point.