Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

If you just need secure browsing and you have a shell somewhere (like a VPS, EC2 instance, a Linode, etc.) just use ssh.

ssh -D <port> user@host

Then configure your browser (I use a plugin called FoxyProxy) to use localhost:<port> as SOCKS5 proxy.

This is also very cool: https://github.com/apenwarr/sshuttle

Edit: I should add that I do not think your DNS requests will go over the proxy. You might be able to configure your browser to do that. Caveat emptor.



Chromium allows you to specify the proxy on the command line:

  chromium-browser --proxy-server="socks5://localhost:<port>"
FoxyProxy is good too; but... yet-another-third-party.


FoxyProxy is useful to have for other reasons, e.g. geolocation blocking / ISP censorship. I rent a cheap virtual server (3 USD/month or so) and keep a constant SSH proxy connection to it, and redirect blocked websites (e.g. TPB in UK) via the proxy using FoxyProxy's URL patterns.


> I should add that I do not think your DNS requests will go over the proxy.

In Firefox, visit "about:config" and ensure that "network.proxy.socks_remote_dns" is set to "True".

Chrome apparently sends DNS queries via the proxy by default but in some cases (prefetching is mentioned specifically) it may not [0].

[0]: https://sites.google.com/a/chromium.org/dev/developers/desig...


Am I correct in thinking that browser plugins like flash, java and silverlight will not use the browser proxy and will leak data?


Flash will honor browser proxies for HTTP connections initiated within an app (e.g. via getURL()), but Flash apps can also open arbitrary sockets, which go directly. For Flash video, recent versions will first try a direct RTMP connection, but will fall back to RTMPT (RTMP tunneled over HTTP) if that fails, so they'll successfully go via the browser proxy if you block other outgoing connections at your firewall.

But yes, if you allow plugins that have the ability to initiate arbitrary connections, there's no way to guarantee they aren't making un-proxied connections, unless you either use firewall rules to block outgoing un-proxied connections, or you transparently proxy everything (VPN). Same as with running arbitrary non-browser apps that might open socket connections.


I'm also curious about this. Anyone?


DNS does go over the proxy. See my comment above about how I used this trick to subvert horrible DNS servers when I was in the Army.


FoxyProxy directs your DNS requests over the proxy.

I use it to access machines on my home network when I'm abroad.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: