Hacker News new | ask | show | jobs
by mirimir 2446 days ago
This is not a new idea. Hola has been around for years.

Trying to protect users through access control is foolish. It's like running a Tor exit from home.

2 comments

I guess it's a bit different for two reasons:

1) Here users are using the bandwidth and it's not resold to companies like Hola does is with https://luminati.io. At least for now.

2) They whitelist domains, so they could only whitelist example.com and you know it's not like Tor where everything goes or Hola where someone is web scraping things through your IP.

True, nothing like Luminati, I gather.

But the very idea of sharing my uplink is anathema. Maybe if everyone curated their own whitelists. But once people rely on whitelists from "trusted" peers, all bets are off.

A safer alternative would have users sharing access to each others VPN service connections. That would at least insulate users somewhat from malicious/illegal traffic routed through them.

Indeed, I routinely route traffic through nested chains of 3-5 VPN services. A common criticism is the cost of multiple accounts. And I typically have even more accounts at any given time, for variety.

But if a bunch of people pooled access to their VPN services, or to VPNs that they ran privately on anonymously leased VPS, each one could have a much larger variety of VPN paths and exit IPs. And you could multiplex and split traffic through the VPN network, to increase anonymity. Or aggregate links, using MPTCP, to increase throughput. And you could even implement something like Tor's process of switching circuits every 10 minutes.

I bet that I could implement a simple version of that with routing tables and iptables rules. And some shell scripts. Perhaps with network namespaces, for a little more security. Even Docker, maybe.

But not just sharing ISP uplinks. That will end in tears.

> "They whitelist domains"

That's not a bad idea, actually. Who maintains those whitelists and how do they get updated? If you want to make the web somewhat usable for others, is it enough to whitelist "google.com"/"youtube.com" only (for example)?

Cant recommend not running a TOR exit node from home enough. When i was running mine for the ~6 months it was online, cox would shut my internet off for various reasons on a weekly basis.
My IP got blacklisted from various sites for simply running a non-exit relay. People say it's totally safe to run a relay/bridge; it is not.
Hosting a bridge from home is safe. They're not in the global relay list so nobody knows which IP to block. Middle relays should be safe to host from home but unfortunately some overzealous 3rd party lists of "evil IPs" include them.
Perhaps Tor should become an integral part of the TCP/IP stack. That way, exit nodes would simply be the destination nodes for every connection. (?)
I'm finding it difficult to understand what you're saying. You can already funnel all your traffic using a Tor SOCK proxy. So you don't need any changes to the TCP/IP stack to do what you seem to want. However, forwarding all your traffic increases the risk of fingerprinting, so you should give it careful consideration.
Let me clarify, because you are talking about something else. One of Tor's weaknesses is that you always need exit nodes, and running an exit node comes with certain risks. Now, what I'm saying is that if Tor was an integral part of the internet, then everybody would effectively be running exit nodes. The exit node and the destination node would be same thing. Government agencies wouldn't be able to take down exit nodes because that would mean they would have to take down the entire internet.
Maybe they used to. Tor Project does not recommend running even middle relays from home.
Which sites?
Not op, but it's my understanding that they can blacklist pretty much the same sites as for exit relays. So your email client may stop working, Also search sites, social media, etc.
Obviously, anyone can blacklist anyone for any reason on the Internet and relay nodes' IPs are public. But do they?

I run a relay node on my personal server and never had any issues. But 1) I rarely browse the Internet from that IP and 2) it's in OVH so if it were blacklisted, it could be because of that.

Banks, Amazon, etc. Ended up on a blacklist for serving a relay from my personal home IP.
EVERYTHING behind cloudflare will captcha you on every page load. Have a dynamic IP from your ISP, they'll know about the new one with 30 minutes.
Also, depending on the country, you can be hold responsible if someone use your exit node to do something illegal.

As far as I remember, in France, you can get the same status as an ISP (don't remember the name though) to be able to run an exit node without being held responsible. But you will have to respect certain rules.