Chapter 16 - Proxies
TLS improves security by providing personal privacy, but in the corporate world companies improve security through monitoring, which is the opposite of privacy and becomes impossible with the added privacy of TLS (unless the company tampers with the individual computers themselves). This monitoring is where proxies come in to play:
When you request a website, you send your request pretty much directly from your computer to the web server, and then the web server replies directly back to your computer. A proxy shakes this up a bit: when using a proxy, the proxy server sits in the middle, recording and sometimes tampering with the request or response data.
In a company this is done for a few reasons:
First, it gives management a chance to apply request filtering. If your PC asks the proxy to request a web page, but that request is for a site that the workplace does not allow like a known gambling or adult content site, the proxy can reject the request.
Second, it allows for response filtering. If your PC asks the proxy to request a web page which would normally be allowed, but that response raises a flag with an antivirus scanner, the response can be rejected. This kind of response scanning improves network security by keeping known malware out.
Third (though not as common especially at small companies) the proxy can scan uploaded content for matches against a database of company secrets. This is to prevent data exfiltration for the purpose of corporate espionage. I image our federal government as well does this to prevent exfiltration of national secrets in the case of actual international espionage.
Fourth, caching proxies may keep a local copy of requested data so that if the data is requested multiple times, it only has to utilize the company's external bandwidth once. These used to be common to, for example, cache Windows update files.
Here is a proxy, proxying time requests rather than web requests.
Companies often used what are called "transparent proxies", which is a proxy server that works alongside a firewall. The firewall intercepts traffic passing through it, hands that traffic to the proxy, lets the proxy apply any monitoring and filtering it likes, and then the firewall forwards on the request or response after the proxy has scanned or modified the data.
A firewall that does this is often referred to as a "deep packet inspection" firewall, because while a regular firewall only looks at the source and destination parts of an IP packet, a DPI firewall looks deeper into the data portion of the IP packet.
This is speculation on my part, but the widespread support for Internet proxy settings at the OS and Browser level seems to have originated from the fact that DPI firewalls are more expensive than regular firewalls. For a company with multiple external network links, they might not want to pay more for fancier firewalls for every link. Instead, they configure the computers to talk to a central proxy that handles all the traffic in one place, making the process cheaper and easier to manage.
With the introduction of TLS as an extra layer for common traffic types, these firewall based proxies tended to have an issue. The privacy that TLS gives people from spying by Internet Cafes and ISPs also generally prevents spying by DPI firewalls. This is where having dedicated standalone proxies instead of DPI firewalls found its real strength.
DPI firewalls apply filtering by intercepting requests, but standalone proxies work by making requests on your behalf. That gave proxy manufacturers an opportunity to create a new kind of proxy, the SSL Terminating Proxy. These proxies handle all of the SSL/TLS encryption themselves, so that they can inspect the unencrypted data before it leaves or enters the corporate network.
With an SSL Terminating Proxy, my computer will use an unencrypted request to the proxy, to ask the proxy to make a request to somewhere like yandex.ru. The proxy will then make an encrypted HTTPS request to Yandex on my behalf. Then it decrypts the response and forwards the decrypted version back to me.
Optionally, these SSL Terminating Proxies will apply their own encryption when talking to your PC, so that you're still protected from snoops on the wifi.
Free Proxies
As for why you'd use a proxy as someone who is not a corporation, mostly people use them because of how they make requests "on your behalf". By using a proxy server in Norway, requests you make through the proxy look like they originated in Norway. This helps people bypass firewalls and content geo-blocking.
"Free" proxies tend to work in one of two ways:
- They're offered for free because they are SSL/TLS Terminating Proxies and their goal is to inspect or tamper with your data, to steal your banking session data, crypto wallet, discord token, etc
- They work by having users themselves act as proxy servers in the network. So if you sign in from Russia and want to use a US proxy to access US Netflix, your data will pass through the computer belonging to someone in the US who might be using the same proxy service to (for example) access German Netflix via a German user's computer.
The first option here is problematic because you don't want your data stolen. The second option is problematic because, in general, you don't want people to be able to make requests "as you".
Imagine someone uses the second kind of free proxy to access content that is illegal in your country. The blame for that request is going to fall on you, generally.
There is a third type of free proxy service that are powered by a mix of curiosity and altruism, which is the category that proxy networks like Tor fall into. Tor ("the onion router") works by generating a randomized sequence of proxy servers for your request to go through, with each server applying or removing one later of encryption. Like layers of an onion 🧅 .
So with Tor, you might send an encrypted HTTP request (HTTPS) into the first proxy server, then that proxy server applies a second layer of encryption and send the request to a second proxy server. The second proxy server applies a third layer of encryption, then send the request to a third proxy server. The third server decrypts a layer, and forwards it to a fourth proxy server. The fourth server decrypts a layer to get back to the original HTTPS request, and sends that to the actual destination web server. In theory, the only way to trace the request from the original requesting person to the destination server (or from the server back to the requesting person) is to own all of the proxies that were used.
Tor servers are usually hosted by research universities, security companies, nonprofit organizations focusing on expanding global free speech, and government spy networks. These groups typically either want to have a proxy so they can do research on the metadata of traffic that passes through them, or in the case of governments they want to own as many of the proxies as possible to maximize the chances that they own the entire chain and can break the privacy. That way they can see who made requests to what servers and when.
Oooooh I forgot about the 4th kind of free proxy service, which is the botnet proxy 🙂 they offer you free proxy services, but in return your PC becomes part of a botnet that they will eventually use to do something else nefarious. This often overlaps with the 2nd type of proxy. Botnet proxies can either use the botnet as a way to attack other organizations, or they can just drain your own PC's resources with a bitcoin miner or something like that.