is it safe to filter https sites with proxo?

Momnewbie · Trooper Joined: May 27, 2002 Posts: 19 Location: Uk

Hi,
I don't often surf "safe" sites, but when I do, I still filter them with proxo using the SSLEAY/openssl files.
I'm considering doing my banking online and just wanted to check that if I still use proxo on the https sites that I'm not making it easier for someone to steal password info., etc.
Last time I was on a https site, I checked the proxo log window and saw an unusual IP address. When I later looked it up, I discovered it was registered to an anonymous proxy - always.hiding-out.com or something similar - and I worried that someone was trying to hack the site or unencrypt or something equally sinister.
My aim is safe and relatively private surfing, avoiding webbugs, tracking cookies and the like, but I'd just like to know whether I'm risking more than a lack of privacy by using proxo in this way. Confused

Thanks for any help and suggestions.

ProxFox · Sergeant Joined: Nov 11, 2003 Posts: 110 Location: USA

I use Proxo to filter SSL all the time...
I filter online banking, credit cards, 401k's, and brokerage accounts...

And would not have it any other way - never once had one bit of a problem...
And refuse to NOT filter sites of any kind, be they "secure" or not...
If it's on my computer, it passes through Proxo...

In regards to your log IP issue - you wouldn't by chance be using JakxPack, would you?

Mele20 · Posted: Sun May 30, 2004 8:23 pm Post subject:

I don't use the filter and I use Proxo on my banking sites from the day I got Proxo about two years ago after leaving Ad/Subtract because there was no longer a free version. Why would I bypass Proxo when banking? I have no more interest in seeing ads on banking sites than I do on other sites! Plus, I can't stand the animation on my banking sites if I don't use Proxo.

It has never occured to me that this was unsafe. I use Firefox and I see the indication that it is a secure site so why should I be concerned that I am not using SSLEAY filter? I have banked online for almost 5 years now long before I had Proxo. What makes Proxo unsafe on banking sites?

ProxFox · Sergeant Joined: Nov 11, 2003 Posts: 110 Location: USA

Nothing makes Proxo unsafe on banking sites...

The topic was started by someone with an unwarranted paranoia...

Proxomitron in SSL mode does NOT effect the "connection" between your computer and the online bank's server - NOTHING is different on that end...

The ONLY thing that is different is a LOCALHOST server, a small program BETWEEN your OWN computer's web browser and your OWN computer's internet connection port...

Proxo does NOT "connect" DIRECTLY to the 'outside world'...

There is NOTHING "new" about the manner in which your computer connects to your bank's computer when you filter "secure" pages...

And as it has been mentioned, by filtering those "secure" pages AFTER they are brought in on an UNCHANGED connection TO your computer and filtered BEFORE "rendering" ON your computer, you now gain the ability to block annoying flashing or scrolling texts, stupid scrollbar or mouse modifications, obtrusive advertisements, and pesty pop-up surveys...

It IS safe to filter SSL...

ProxFox · Sergeant Joined: Nov 11, 2003 Posts: 110 Location: USA

As suspected - the topic starter IS using JakxPack...

$CON(27,116)$SET(1=always.hiding-out.com) in JakxPack version 1 Via.txt...

$CON(145,234)$SET(1=always.hiding-out.com) is a line directly from JakxPackII's Via.txt...

As noted - unwarranted paranoia...
And an indication that the person does not even know what their own Proxo config is doing...

The use of JakxPack is a method to "trick" server log readers...
All that they do is throw in FALSE information so that when some server admin does a quick read (not a thorough read, but a quick read) to see who has been visiting their site, they are mislead by the phony information and do not quickly see the "real" person visiting...

A "thorough" read will catch this because some line items will not "match"...

It is my understanding that the next JakxPack resolves this - and that the latest does for the first 130 entries or so...

In the case of the aforementioned paranoia, "always.hiding-out.com" is the information that YOUR Proxo config posted to the online bank's server so that IF an admin reads through those logs, THEY will see that someone from "always.hiding-out.com" visited THEM...

"always.hiding-out.com" did NOT "visit" you or "decrypt" your SSL stream...

Again, unwarranted paranoia...

And I cannot reiterate it more - filtering SSL is SAFE...

ps - my harsh tone is merely to present my case...

Momnewbie · Trooper Joined: May 27, 2002 Posts: 19 Location: Uk

Hi Proxfox,
Thanks for the reply - I think. Unwarranted paranoia sounds a bit strong! Perhaps my nickname MomNEWBIE should give you a clue that I may not be too knowledgeable about computers.

I did not intend to imply proxo *was* a security risk, I just remember Scott stating at some time that filtering secure sites was experimental in some way and I wanted to be sure I wasn't doing anything foolish because I don't know a lot about computers - so I posted my question to those who do - more like good sense than paranoia wouldn't you say?

It is true I don't understand fully what my proxo config is doing so I don't understand a lot of your reply - I've no idea what JaxPack is so may well be using it as you say.

All I wanted to be sure was that I was doing the safest thing and I *think* that your comments implied that I was. However, I may not be so keen to expose my ignorance on this board again if I get accused of being "paranoid" when I'm merely unsure!

ProxFox · Sergeant Joined: Nov 11, 2003 Posts: 110 Location: USA

My apologies...
I merely thought that you were a new mom, not a new computer user...

Momnewbie · Trooper Joined: May 27, 2002 Posts: 19 Location: Uk

Thankx Proxfox - apology accepted. Smile

I'm an old "Mom" in every sense of the word! Razz

Momnewbie


	Home ˇ Topics ˇ Submit News ˇ Top 10 This entire site, Cops Themes, and Computer Cops are Š 2002 - 2004 Computer Cops, LLC. All rights reserved. You can syndicate our news using the file RSS 0.91, ultramode.txt, or RSS 1.0. Acceptable Use Policy. Use signifies your agreement. Engine Copyright Š 2002 by PHP-Nuke, GNU/GPL Licensed. ICRA Member. Paul Laudanski, Member of Computer Cops, LLC Server Load: 748 pages served in previous 5 minutes. Page Rendered: 0.376 seconds.