fruitreunion1

How does this affect old YouTube videos (and possibly other historical public content)? (obviously, save everything you love while you still can in case things get removed or difficult to archive due to attestation/DRM)

The idea is you connect to the wireguard UDP port from one of the obfuscation tunnels.

laptop -> obfuscation tunnel (udp2raw/iodine/ssh/tor/wstunnel/etc.) -> wireguard UDP port. Though some protocols like ssh or tor only support TCP, so you have to run an additional tunnel in the machine to get to wireguard (udp-over-tcp).

Their point I think is that often (to varying degrees), 'power user' things are less convenient to do or behind configuration options or menus and so on nowadays.

I think this is a good thing. Apply obfuscation on top of WireGuard, that way you can have the functionality and security of the WireGuard tunnel and swap between different obfuscation techniques as needed.

No. https://www.wireguard.com/known-limitations/

>Deep Packet Inspection

>WireGuard does not focus on obfuscation. Obfuscation, rather, should happen at a layer above WireGuard, with WireGuard focused on providing solid crypto with a simple implementation. It is quite possible to plug in various forms of obfuscation, however.

>TCP Mode

>WireGuard explicitly does not support tunneling over TCP, due to the classically terrible network performance of tunneling TCP-over-TCP. Rather, transforming WireGuard's UDP packets into TCP is the job of an upper layer of obfuscation (see previous point), and can be accomplished by projects like udptunnel and udp2raw.

I disagree. I think it's good that implementing a secure network tunnel and obfuscation are separate. WireGuard can handle the secure tunnel functionality while I can apply any sort of obfuscation protocol on top of it without worrying about its security or having to reconfigure the network, like udp2raw, iodine, shadowsocks, websockets, etc.

I don't want to revoke a key to test but I'm pretty sure that just sets the port in the Endpoint part of the WireGuard config file. (the port you use to connect, for if the regular one is blocked). Are you sure your service behind Mullvad is accepting incoming connections?

You forget that some people like general purpose computing. Android and other mobile operating systems (as well as Chrome OS) do have great security, but that comes at the expense of functionality (arbitrary code execution is discouraged, putting things inside apps and strict APIs make scripting and tinkering infeasible) and user control. One of the mentioned in the talk was being able to use the traditional Linux stack and being able to use your smartphone as a general purpose computer (2:22, 4:12). I hope one day there's a solution, but it seems trade offs have to be made to have one or the other.

Another term I've seen used is "traditional Linux distributions" as opposed to locked-down/less general purpose like Android and Chrome OS.

Well, Alpine wouldn't fit that definition but is still a user-controlled Linux.

>We should not destroy the entire internet to protect/increase adtech profits.

Yeah, ideally businesses wouldn't be built on this model (free service funded by ads at the expense of privacy and now user control). Then we might not have had to worry about widespread fingerprinting AND we can maintain user control too.

>To prevent ad fraud either you need to increase the fingerprintablity of users on the web, violating people's privacy, or implemented a form of remote attestation, which protects people's privacy.

>If EFF cares no much about privacy on the web they should be in favor of this proposal.

Privacy on the web by implementing remote attestation across the web will inevitably in practice reduce digital rights and user control/freedom. The EFF also cares a lot about this, so it makes sense that they would be against the proposal. Both of these goals could be achieved by websites providing the same behavior regardless of the client browser/software that is requesting pages. The reason we have to lie is because user-hostile businesses/sites don't want to adhere to this (advertising, DRM). (ignoring useful things like providing a mobile version of a site)

To note, fingerprinting is always going to be technically possible (especially given the larger and larger feature scope that businesses have wanted to impose upon the web since its inception), WEI is just an attempt to stop ad-driven sites from trying to do it.

When the alternative is sacrificing privacy or anonymity, I think it's at least useful, even if not ideal given the current energy situation.

I think in internal environments like within a company it's fine. Just not in the public, user-facing web.

>Can someone give a counter argument of how this might benefit the users themselves?

Remote attestation might reduce the amount of cheaters in games and fraud in banks if implemented properly. So, through potential indirect means.

I don't think any of this is worth the loss of user freedom and functionality, though. So I will vehemently oppose WEI and similar to be used outside of internal facilities.

Is there really much browsers can do to actually effectively restrict fingerprinting without going all out like Tor Browser? WEI may disincentivize websites to not use fingerprinting, but if they really wanted to, they could use it for de-anonymization purposes.

Tor Browser defaults to JS enabled.

Yeah, I think there's just a disconnect in culture. Making IRC more viable towards those who like Discord etc. would fundamentally change and ruin it for many who like IRC. And vice versa. So IRC will never resurrect and be used by the masses again.

>Go ahead and create 1 account per 1 server, nothing prevents you.

Doesn't having to give up a phone number for each account (and you can't use the same number on different accounts) make it difficult? (unless you haven't had to, maybe my browser is suspicious, but it's just regular old Chromium). Would like to do this so that I can separate IRL/weak pseudonym (from random people in servers, obviously you can't be truly anonymous on Discord)

I use it for just about everything except for things tied to IRL identities. (short-lived usage like making a search request, to persistent identities like this)

Some services block Tor. Sometimes they can be bypassed by pressing "New Tor circuit for this site" a few times, sometimes they cannot. Some of the methods listed here [0] can help (though I wouldn't log into any accounts using this as TLS isn't being terminated at your machine).

Some features don't work in Tor Browser, off the top off my head, sites using AudioContext, Webauthn, Webassembly. (webassembly can be a pain due to some encrypted paste bin sites using it).

I run multiple instances of Tor Browser (separated with Linux namespaces, particularly netns because Tor Browser will fail to load if an existing Tor service is running at port 9150) so that I can multitask between for example posting this on HN and random browsing in another instance. That also helps with the webassembly thing as I run a script to spin up a temporary instance of Tor Browser, enable webassembly in about:config, and load the failing page.

For the sites that block Tor that I need to login to or that don't work with the ad-hoc methods listed above, I will fallback to using a VPN + an about:config-modified version of Tor Browser that has the Tor proxy disabled. Mullvad Browser can also be used as an alternative.

I also use it outside of TB for IRC among other things. You have to be careful as there is no uniform configuration for everyone like TB.

0: https://gitlab.torproject.org/legacy/trac/-/wikis/org/doc/Li...

i2p is an alternative with its main focus on hidden services rather than outproxying to the regular net, that seems to be somewhat used with torrents.

Yeah, I'm disappointed there's no permission toggle so that I could have javascript-based clipboard setting behind a prompt on most websites and have exceptions for others.

Bash also buffers pasted content.

>You can. It's just that no browser that supports HTTP/3 will accept it as a legit endpoint with a valid root. So they won't connect to the HTTP/3 endpoint at all and you won't be able to access the HTTP/3 self-signed website.

So long as there's a way to bypass verification or configure the trust store I'm okay with it. Is there official policy stating that this won't be possible or is this prediction?

As I understand it the primary reason for this push is that non-technical users too often skip security warnings, but I'm of the position there MUST at least be a way to bypass verification no matter what (through keyboard combos or a configurable trust store).

yeah, I liked being able to archive and scrape web content with yt-dlp, gallery-dl, and similar tools

The captcha and fingerprinting methods are higher effort compared to attestation, so I think there is an incentive for most sites to get rid of it in favor of attestation.

You can compartmentalize such activities to a dedicated device, much like one may need a Windows device for certain software or an Android device for features in banking apps that aren't available on the website.

It's so silly that some sites block addresses that weren't exit nodes.

I feel a bit similarly. I'm torn these having very cool and interesting security properties but this way of using computers, for a lack of a better description, is just not what I'm after.

De-googled as in not tied to a Google account and its web services. Look at something like ungoogled-chromium.