News for hackers. Stuff that matters.

A comment on Snowflake. Parent comment

Re:Snowflake by worldofmatthew on Saturday July 29, 2023 @10:03PM (#36927024)
It not an exit. But by default someone has to knowingly run the Snowflake applet but webmasters could modify the code to automatically essentially start a Tor guard in someones browser. Though, that would be very evil to abuse someones resources like that.

That example has the users consent before starting.

[ Parent | on HN ]
Re:Snowflake by anyfactor on Saturday July 29, 2023 @10:32PM (#36927224)
I looked into their community posts [0].

> If you run a snowflake proxy (like the browser extension) people will use your internet connection to connect to Tor, but not to exit to internet. So it doesn’t matter if sites are blocked, anyway they will exit to internet from an exit node in another place. [1]

From the landing page graphics, it looks like the thing is about connecting to a Tor bridge via proxying the traffic through user IP. But it is an iframe embed. From what I know hacking it to get to automatic consent on load isn't very difficult.

I am still a bit spooked. I took a look at couple of adblocking extensions and they are not blocking this service.

[0] https://forum.torproject.org/search?q=snowflake

[1] https://forum.torproject.org/t/should-i-run-a-snowflake-prox...

[ Parent | on HN ]
Re:Snowflake by KRAKRISMOTT on Saturday July 29, 2023 @10:21PM (#36927154)
That's already how many shady VPN software work. Remember if a VPN is "free", you are the product. Web scraping companies pay $$$$ for residential and mobile IPs.
[ Parent | on HN ]
Re:Snowflake by drusepth on Saturday July 29, 2023 @10:30PM (#36927210)
Friendly reminder that it's not just free VPNs that sell your data; many of the paid VPNs do also.
[ Parent | on HN ]
Re:Snowflake by Fnoord on Monday July 31, 2023 @10:45AM (#36943362)
Yeah, those proprietary VPN apps.

"If you don't control the routing, you're being routed."

To be fair, ProtonVPN allows you to export their config. It seems to be an exception to your rule.

[ Parent | on HN ]
Re:Snowflake by bebop404 on Monday July 31, 2023 @12:22PM (#36944979)
Yes, but running a Snowflake doesn't expose your IP to the website being visited, and therefore you're safe from abuse complaints/prosecution, unlike the people who run the exit nodes.
[ Parent | on HN ]