are public proxies really safe?

[yanksfan]

Hello,
As some of ou already know, I have a small home network and have web and mail services open to the internet. Now, since I didn't want that same IP (as my webserver was running) showing up in internet logs everywhere, I looked into free public proxies. I found a fast one, and also made sure it didn't show my IP by looking at a cgi script that spit out all env variables.

Anyway, my question is am I really ganing any security? I mean, after all it could be logging everwhere I go along with everything I see and enter (with a packet sniffer)....

Any suggestions/ideas? I always try to use SSL wherever its possible -- even before I started using this proxy, just because I'm paranoid ....but for places where its not availble...

-Mike

[Scorp666]

Proxies are great to hide your identity when browsing but I wouldn't use them for any crucial information though. Unless you pay for the service, chances are the admin of the proxy can see where you go and what you post if he desires to.

[yanksfan]

so you mean you wouldn't use them for day-to-day surfing?

[Spyder32]

Usually when you use free proxies, like mentioned, the admin tends to look at what you've been doing and sometimes that could prove bad. I personally wouldn't use one.

[Scorp666]

Yes I would use proxies for day to day surfing to remain anonymous. I wouldn't use proxies to buy products, access websites that require passwords or check my banking account...

If you are on Windows, there is a nice tool called Multiproxy that allows you to use a list of public proxies to surf. That way everytime your browser sends a request, it goes via a different proxy.

http://www.multiproxy.org/

I even pushed the enveloppe further by using Proxomitron chained to multiproxy.

http://proxomitron.cjb.net/

Nowadays I don't really care if websites get my IP. There is not much they can do with it anyway since I am on dialup...

[The Old Man]

Now, i would not want anyone thinking the old man is paranoid, suspicious, or whatever else it could be called, "But"... If i were the boss of the fibbies, or the nsa, or the cia, or if i were the boss of them all, i think i'd look into starting up my own popular stable of proxie services. Email services, chat rooms, internet access, internet browsing relay points,... in fact, i'd probably have enough bucks to just quietly buy out the existing ones if their present owners seemed compatible with keeping the sale quiet ... anyway, you all can fill in the rest of the blanks probably better than i could. Carnivore? we could keep arguing about it for decades if we already owned the services. I mean, who lately has read the 60 pages of fine print when they take on a service? And who says we have to tell them we're monitoring their traffic anyway? Besides, there are a lot of good agents looking for part time jobs who know how to scan exception lists about a page every three seconds... Hey, just joking here

[Unl3Ashed]

Originally posted here by Scorp666
[B]I wouldn't use proxies to buy products, access websites that require passwords or check my banking account...

Hey, I've always used proxies ( by proxomitron ) to access my webbased mail account and also AO. Am I doing a lame thing?
The reason is because I trust proxies more than our town ISPs ( Packet sniffing ).
So if I'm doing wrong, plz describe it for me. Thanks

Cheers

[nebulus200]

Unleashed, I hate to break it to you, but unless you are sending encrypted traffic (VPN, ssh, SSL) etc, going to a proxy will NOT stop your ISP from packet sniffing your traffic...The only thing a proxy 'could' buy you is anonymity to the rest of the world, assuming that the admin of the server isn't snooping through the URL's you access or packet sniffing your traffic as you use the service (this is why it is bad to access things requiring a logon or that have personal informaion via a proxy service). To the rest of the world, it will look like your traffic is originating from the proxy server (which is why it could gain you anonymity), but unless you are tunneling your traffic through an ecrypted channel to the proxy server, your ISP could still sit there and packet sniff the traffic returning from the proxy server and see everything they would if you just went there directly...

Whenever you are connected to the internet via any ISP, you should assume that they are watching and monitoring anything that you do and if you don't like that idea, you should send as much as you can encrypted, at least that way it is difficult (not impossible if you have a few supercomputers or a network of distributed computers around that can find your encryption keys). With that being said, at least around here, the ISP's do provide a terms of use policy and clearly state what they are doing and what if anything they would do with information gleaned from their logs or sniffing (most I have seen that monitor do nothing with information other than check it to make sure there is no hacking/security issues going on (of their stuff...not yours))...

Something to keep in mind...


nebulus

[The Old Man]

nebulus200, quite correct. One time a long time ago i wrote a little script to identify and post a visitor's IP on my webpage and called it 'sniffer'.... Within a couple days i got a phone call from my host wanting to know what i was trying to do. of course, he already knew, because of the text, but he told me to change the name anyway so his logs wouldn't pop up the exception for him to look at. i thougt that was kind of neat, and it did't bother me that he was monitoring his server activity to keep hackers off his customer list, i'd probably have been doing the same thing.

[Unl3Ashed]

Thnaks nebulus200.
Just one thing more, so as I realized, you mean that even I use a proxy server my ISP would be able to know which URLs I've visited, right? Ok, I have searched something about "URL encryption" which is a service that some proxy servers offer ( specially cgi proxies ). and is like this: guess you want to go to www.somewhere.com and by using that proxy ( eg. www.proxy.com ) the address will looks like :
http://www.proxy.com/ KLJ987Hkjh79kjjKJGAWEMXvfD437

My reason of using such a service is that , as you might noticed when you submit your yahoo id and password in yahoo's mail page and hitting enter, you can see your yahoo id and password ( encrypted ) in your browser address field , but I do not like my ISP logging/seeing it. So is this kind of encryption helpfull?
Thanks for help

Cheers