Hacker News Reader

Anyone in the know: what would it take to implement a "container over tor"? I am not currently a tor user, but absolutely would if I could integrate it with my current workflow (using the temporary containers addon).

tor provides a socks proxy, which you can assign to a container easy enough w/ the container proxy addon.

Thank you, I'll look in to this!

Be careful doing this though, there's a reason Tor Browser exists and it is because it's very hard to do anonimity over Tor right on a default browser.

Granted, Tor tries to upstream as much as it reasonably can to FF, but there's still large differences in defaults that could give away (some bits of) your identity.

See this comment first, not mine but might as well be https://news.ycombinator.com/item?id=24853678

It's all baby steps. I don't expect to be fully anonymous this way, just like I know my current setup does not foil more sophisticated tracking.

Does FF send DNS requests via the proxy? Depending on the personal threat model and the ISP, that might matter.

FF defaults to DNS-over-HTTPS now, so I would imagine it does, although I can't find solid confirmation.

Only in the US.

There are checkboxes to control this in the Firefox proxy settings. "Proxy DNS when using SOCKS v5" and "Enable DNS over HTTPS".

In the proxy options, there's a box to tick for sending DNS through the proxy or not.

Though you won't get stream isolation this way https://www.whonix.org/wiki/Stream_Isolation

"Anyone in the know: what would it take to implement a "container over tor"? I am not currently a tor user, but absolutely would if I could integrate it with my current workflow (using the temporary containers addon)."

This is my every-six-months wish/rant on this subject ...

What we need is the ability to 'jail' a GUI browser process.

It is too resource intensive to spin up an actual virtual machine to run a browser window/tab. However, a facility like 'jail' (or zones or, perhaps even Docker) that simply chroots a new process with its own network interface, etc., does not have any of that expense.

It really is just a fancy chroot and the expense is limited to the overhead of just the process you're running.

If you could 'jail' a GUI application, you could have a browser window that was not merely its own cookie domain or history domain, but that was on an entirely different network and it's own chroot.

I use the same setup (mullvad + container proxy) and can't praise it enough. I just keep a mullvad connection open on my router and only route the proxy IPs through it.

Great for all kinds of silly GeoIP restrictions, too - in my part of the world, homedepot.com just spits out "access denied", a foodnetwork.com recipe you find in search results just redirects you to the tudiscovery.com homepage, etc.

>"I just keep a mullvad connection open on my router and only route the proxy IPs through it.'

I'm interested in your setup. Do you configure your router to have a point to point tunnel with Mullvad then? I didn't know this was a thing. Do you then just have a separate container proxy for each GeoIP region you want to access?

This'll help you: https://mullvad.net/en/help/dd-wrt-routers-and-mullvad-vpn/

For Geo-IP, unfortunately unless you have some sort of automation to reconfigure the OpenVPN settings on your router - this will only work with 1 configuration. They may be alluding to using the VPN to connect to another country where they're not getting weird as fuck redirects and shit content.

Although just as I wrote that, I'm expecting a dd-wrt/browser addon will probably support this somewhere - or at least as a script on Linux.

I have a Unifi USG, which has a third party wireguard addon, though of course OpenWRT could work just fine. You setup a wireguard tunnel normally, but disable the default routing (on a Unifi, set route-allowed-ip false), and then explicitly add a route for 10.124.0.0/16 through the wireguard interface. The mullvad servers page[1] has socks 5 proxy addresses for all of their servers - assign one to a firefox container and you're all set. No reason you couldn't have a container for each geographic region you want.

1. https://mullvad.net/en/servers/

On a USG the config looks like this:

    wireguard wg0 {
        address ***/32
        mtu 1420
        peer *** {
            allowed-ips 0.0.0.0/0
            endpoint ***:51820
        }
        private-key ***
        route-allowed-ips false
        up-command "ip route add 10.64.0.1/32 dev wg0 && ip route add 10.124.0.0/16 dev wg0"
    }

I'm curious to learn more why you have gone this route compared with the default settings of a standard router?

I'm uncertain of the benefit for everyday people.

Container proxy plus a putty socks tunnel over SSH through a pinhole firewall rules to my work linux system is my preferred poor man's work VPN. One main benefit being that allowing the non-VPN traffic to handle the video meeting works way better.

I'd even debate if it's really a "poor man's" VPN, I think it's actually a better solution

Traditional VPN solutions seem overengineered and complicated. Wireguard is better though

I just discovered Mullvad (just a VPN provider) and for some reason, they don't have "English" in the list of languages available for their site.

So they redirected me to the Dutch version because I'm in a nominally Dutch-speaking region, and I had no option to get it in English. I had to go with half-translated French until I noticed that I could replace the "fr" in the URL with "en", and actually get to an English-language website.

The region-based redirection was annoying enough, and the half-assed translation job was expected, but not even providing an easy way to get back to English is really idiotic.

I still wish I had some kind of system that would automatically use a connection in the right country for geoblocked content. For now I just use SSH proxies to (my own) strategically located servers combined with Firefox Containers and Container Proxies, but it's all manual.

Just checked it, and English is 4th option in the language switcher on the bottom of the page.

Also, it seems to be using browser's preferred locale, not the IP region. So, it looks like that changed, too.

Google, on the other hand, is just as bad as you described. Geo-based localisation, lots of clicks to change the language (or ?hl=en, once you learn about it).

Looks like you're right, but unfortunately the select is cut for me[0] because my screen is not big enough.

Since the list is not alphabetically ordered (it actually is, but with the English names, not the displayed names) and it shows no scrollbar, it wasn't obvious there would be other countries up there.

As for language, maybe Google itself chose to send me to the Dutch version. Despite all my attempts, I still cannot consistently get Google to use the language I want (apart from manually choosing it by directly visiting Google with the right hl= first, indeed). Right now Google.fr seems to be in English and offering me the three languages of Belgium, for some reason.

[0]https://i.imgur.com/nuAPsxD.png

Could you provide some more information about the local bridge proxy? I'm trying to implement something similar but don't know where to start.

Mozilla needs to work harder on the permission system for addons.

One of the permissions you have to grant to the container proxy add on is:

“Access your data for all websites”

That’s not acceptable.

How would you propose fixing it? Firefox has an active bug tracker to discuss these kinds of things.