1

Sorry for my lack of terminology in the field, that's something I've little (or none any) practical knowledge about.

I've browsed similar questions on the security risks of using (web) proxies, but both the questions and the answers generally focus on the risks involved with the potentially malicious proxy operators (which are considered to be the free ones), and trustworthiness of using them, etc...

Now, I'm not, at the moment, concerned about how secure or trustworthy a free proxy server is for making online banking etc., rather I'm concerned about the following :

If someone uses a web-proxy service, to bypass an ISP DNS filtering, but if the web-proxy uses HTTP instead of HTTPS, and thus it's not completely encrypting the transferred data (voice, video, image, text etc.), so how safe s/he is from the ISP listening to what s/he is sending to or receiving from somewhere unknown to ISP..?

All I know is that, the proxy helps bypass ISP DNS filters, so that one can reach otherwise blocked web pages from such as youtube, facebook, tweeter. But what about the data? Can the ISP still detect that banned (such as politically banned newsfeeds) youtube videos, or similarly blacklisted facebook pages, or tweeter accounts, are transferring their data (posts, texts, images, videos) that the ISP (with the government help) is tracking?

For example, can the ISP still detect which kind of youtube video (banned or safe) is being transferred, despite no connection to youtube seems?

3
  • Most sites would enforce HTTPS only and I'm sure that's true for youtube, facebook, twitter, etc... maybe all you really want here is secure DNS? If your guv'ment or ISP does not have the capability to MITM your secure traffic then you can't be spied on. Jan 5, 2021 at 22:00
  • @pcalkins thanks, good reminder on https-enforcing, but lets just assume they won't enforce an https connection and it's possible to connect them via http.
    – Fat32
    Jan 5, 2021 at 22:03
  • DNS filtering is simply allowing/blocking domain queries. It does not care about the content, only the DNS lookups.
    – svin83
    Jan 6, 2021 at 17:19

1 Answer 1

2

The common configuration of a HTTP proxy is to have a plain TCP connection to the proxy. This means HTTP only traffic will not be additionally encrypted, while HTTPS traffic stays encrypted (but not additionally encrypted). This provides a similar visibility to the ISP as without proxy, provided that the ISP uses deep traffic inspection (DPI) to analyze HTTP traffic. Given that the server name in most TLS handshakes (SNI extension) is not encrypted (i.e. no ESNI) this also means that the original target hosts can be seen from both HTTP and most HTTPS traffic, no matter if a HTTP proxy is used. Note that DPI is more expensive to employ than simple DNS based analysis and blocking though. This means that the ISP might not use DPI or might restrict DPI to some clients only, like to the client with suspiciously few DNS requests.

Some HTTP proxies though offer access by HTTPS instead of HTTP and this is supported by modern browsers. In this case all traffic between client and proxy will be encrypted, i.e. plain HTTP traffic and also HTTPS traffic (resulting in double encryption). Since this will also encrypt the original plain HTTP requests and original TLS handshakes, it will hide the original target host from deep packet inspection.

3
  • Thanks for your time. I have a little doubt on what you mean by ISP might not use DPI or might restrict DPI to some clients only, like to the client with suspiciously few DNS requests... First, why is it suspicious to make few DNS requests, then is the client being the internet user itself?
    – Fat32
    Jan 5, 2021 at 22:16
  • @Fat32: Few DNS requests in comparison to the amount of traffic mean atypical behavior which might be considered suspicious and worth deeper inspection. Note that it is unknown from your question which laws apply here and especially if bypassing blocking might be considered a felony. And yes, the client is the internet user, i.e. the customer of the ISP or others using the same internet account as this customer. Jan 5, 2021 at 22:20
  • Thanks, as I guessed so. I'm just a little ultra skeptical about internet operators, including web pages too!, so shielding oneself from youtube is also another part of the concern, and I never heard / thought that using a proxy could be a felony... Thanks again. So the summary : use https, at least.
    – Fat32
    Jan 5, 2021 at 22:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .