Sakura-sx

6 ms·

1.
by Sakura-sx 9mo ago
I am not detecting that, I am just detecting L4 proxies for now sob
2.
by Sakura-sx 9mo ago
I think for stealth TCP proxies are more common since you can use your own TLS fingerprints and all of that, with something like an HTTP proxy you'd need to set up your requests to match with the TLS fingerprint that the proxy is using
3.
by Sakura-sx 9mo ago
The issue is that if HTTP is an extra 50ms than TCP for example, if you increase TCP by 50ms now HTTP is 100ms more. Basically it is always more no matter how much you increase it.
4.
by Sakura-sx 9mo ago
Thank you! Will check it out!
5.
by Sakura-sx 9mo ago
Yes, it's important to keep this in mind, thanks for your comment!
6.
by Sakura-sx 9mo ago
Oh I haven't seen that before, it's really cool, thank you for showing me that! I want to clarify that the approaches are a bit different, they use IP intelligence too and this approach doesn't use any kind of websockets, whi
7.
by Sakura-sx 9mo ago
First of all, thanks! I imagine any big CDN implementing something like this could keep a database of all of this, combined with the old kind of IP intelligence and collecting not only RTT on other protocols like TLS, HTTP, IP (aka ping, an
8.
by Sakura-sx 9mo ago
Are you using a proxy? If you aren't that would be concerning, since false positives are way worse than false negatives. If you are then it means the score is sometimes a bit lower and sometimes a bit higher than 0.1, which is the thre
9.
by Sakura-sx 9mo ago
About the straightline path I did think of that but apparently I forgot to address it when writing the README :p The point I was trying to make is that if the RTT is low enough you can know the connection is being made from close, it's
10.
by Sakura-sx 9mo ago
I guess for this to work best you'd build your own CDN and have as many servers as possible. I have always dreamed of an Open Source CDN managed by a nonprofit and dedicated to offering CDN services for free or for a reasonable cost. I
11.
by Sakura-sx 9mo ago
I think you could also compare with TLS handshake timings, delay for client hello among other things. And you could also compare it with HTTP RTT, not to mention that you can do TCP fingerprinting and compare it with the TLS and HTTP finger
12.
by Sakura-sx 9mo ago
Thank you! There are other ways of detecting L3 VPNs, but I wanted to start with proxies since they do most of the damage.
13.
by Sakura-sx 9mo ago
It's done by checking the difference between the initial TCP RTT and the subsequent TCP RTTs, both of which can be retrieved from the Linux Kernel easily without the need for PCAPing. There is more info about how it is done on the READ
14.
by Sakura-sx 9mo ago
That's strange, could you try with " https://aroma.global.ssl.fastly.net/score "?
15.
by Sakura-sx 9mo ago
Also, something I haven't included on the README is that apart from testing with Tor, WARP and some other proxies. I did some testing with the free one-week trial of Brightdata's residential proxies, and it does detect them too!!!
16.
Show HN: Aroma: Every TCP Proxy Is Detectable with RTT Fingerprinting(github.com)
86 points by Sakura-sx 9mo ago|54 comments
17.
by Sakura-sx 1y ago
Thanks!
18.
by Sakura-sx 1y ago
I advice either monkeytype or keybr, both have a setting for code
19.
by Sakura-sx 1y ago
Thanks!!!
20.
by Sakura-sx 1y ago
Thanks for the idea, added to roadmap!
21.
by Sakura-sx 1y ago
keybr's algorithm is flawed, getting 1 extra WPM on "q" does way less progress than getting 1 extra WPM on "e", it's better than most of the things but also I wouldn't have made typr if it was perfect.
22.
Project Satyr – A Cloudflare competitor using novel techniques to trace attacks(voxga.es)
1 points by Sakura-sx 1y ago|0 comments
23.
by Sakura-sx 1y ago
You are right, I didn't know what it was when posting.
24.
by Sakura-sx 1y ago
Thank you for the stars, just went from 1 to 27 stars! :3
25.
by Sakura-sx 1y ago
Thank you!
26.
by Sakura-sx 1y ago
More characters soon, thanks for the suggestion!
27.
by Sakura-sx 1y ago
Not really, most DDoS attacks are made from servers, taking down those servers makes the attacker need to get new ones. And from the logs I can assure you that 90% of the time it is a server, and the rest it is either residential IPs or VPN
28.
Typr – TUI typing test with a word selection algorithm inspired by keybr(github.com)
106 points by Sakura-sx 1y ago|40 comments
29.
by Sakura-sx 1y ago
I have been a user of keybr.com for a long time, and I didn't really like things like for example only practicing one word at a time or the algorithm trying to force you to type each character at the same speed, that's why I made
30.
by Sakura-sx 1y ago
No, it is there to make money, if their free plan included perfect DDoS protection no one would get the more pricier ones.

More ›