Question on proxy trustworthyness

[sodapop27]

I searched BHW and some answers I am already familiar with, not expert but understood.

I want to know how you know to trust a proxy service...couldn't they perform MITM attack on your traffic? Browsing is fine but with account creation and that it might be bad to use a proxy service that is unknown/shady?

 

[proxygo]

anything is possible with any product to bite you, question is why
would they, a business out to make money shouldn't be worried about

 

[turelink]

That's why brightdata and soax, those proxy provider need KYC

 

[GridPanel]

If you are concerned about MITM, HTTPS with certificate pinning (or chain/CA verification - i.e. check the origin server has a certificate issued by a specific authority that you trust). This is how mobile apps prevent people from MITM'ing their traffic by using something like Fiddler and a self-signed SSL certificate.

If you always know what certificate to expect when you connect, nobody can interfere with your traffic. Nobody can read HTTPS traffic that is being proxied unless you rewrite the traffic with a new SSL certificate, which is detectable via pinning.

 

[Pulsare]

Any proxy company gives you either HTTP (Connect = Secure) or HTTPs (SSL/TLS) based proxy connections, there's also SOCKS etc..., but generally speaking these protocols are safe by default, there's no way a provider can look at your POST request body (for example) without sharing a certificate that would not be trusted and rejected by your browser, apps, etc... either way.

 

[sodapop27]

If you are concerned about MITM, HTTPS with certificate pinning (or chain/CA verification - i.e. check the origin server has a certificate issued by a specific authority that you trust). This is how mobile apps prevent people from MITM'ing their traffic by using something like Fiddler and a self-signed SSL certificate.

If you always know what certificate to expect when you connect, nobody can interfere with your traffic. Nobody can read HTTPS traffic that is being proxied unless you rewrite the traffic with a new SSL certificate, which is detectable via pinning.

Thank you for the information. How would I ensure certificate pinning is present when browsing to sites?

 

[sodapop27]

Any proxy company gives you either HTTP (Connect = Secure) or HTTPs (SSL/TLS) based proxy connections, there's also SOCKS etc..., but generally speaking these protocols are safe by default, there's no way a provider can look at your POST request body (for example) without sharing a certificate that would not be trusted and rejected by your browser, apps, etc... either way.

Very interesting. So if I connect to gmail.com through a SOCKS proxy...and I make sure I am actually connect to https://accounts.google.com or whathaveyou - then if MITM were happening the warning would appear versus normal lock/green lock, and can check to make sure the cert is correct?

 

[Pulsare]

Very interesting. So if I connect to gmail.com through a SOCKS proxy...and I make sure I am actually connect to https://accounts.google.com or whathaveyou - then if MITM were happening the warning would appear versus normal lock/green lock, and can check to make sure the cert is correct?

There's two things that could happen:

1) Your proxy provider uses unsecure proxies (HTTP without CONNECT protocol) => The host would outright refuse the connection if it is hosted on HTTP(s)
2) Your proxy provider uses secure proxies (HTTP with CONNECT, HTTPs, etc...) => The host allows the connection, the connection is encrypted, data is safe.

Some things can be captured by the proxy provider, such as headers or accessed url, but credentials are almost always sent through a POST body so there's little to worry about.