[tor-talk] You Can Now Watch YouTube Videos with Onion Hidden Services

[bo0od]

This is another front end to YouTube:

Clearnet:

https://invidio.us

Onion V2 Mirror:

http://kgg2m7yk5aybusll.onion/

Onion V3 Mirror:

http://axqzx4s6s54s32yentfqojs3x5i7faxza6xo3ehd4bzzsg2ii4fv2iid.onion


Special Thanks to Omar Roth for making this happen.


Source Code:

https://github.com/omarroth/invidious

[Seth David Schoen]

Hi bo0od,

Thanks for the links.

This seems to be in a category of "third-party onion proxy for clearnet
service" which is distinct from the situation where a site operator
provides its own official onion service (like Facebook's facebookcorewwwi,
which the company has repeatedly noted it runs itself on its own
infrastructure).

Could you explain how this kind of design improves users' privacy or
security compared to using a Tor exit node to access the public version
of YouTube? In this case the proxy will need to act as one side of
users' TLS sessions with YouTube, so it's in a position to directly
record what (anonymous) people are watching, uploading, or writing --
unlike an ordinary exit node which can at most try to infer these
things from traffic analysis. Meanwhile, it doesn't prevent YouTube
from gathering that same information about the anonymous users, meaning
that this information about users' activity on YouTube can potentially
tbe gathered by wo entities rather than just one.

The proxy could also block or falsely claim the nonexistence of selected
videos, which a regular exit node couldn't do, and if its operator knew
a vulnerability in some clients' video codecs, it could also serve a
maliciously modified video to attack them -- which YouTube could do, but
a regular exit node couldn't.

Are there tradeoffs that make these risks worth it for some set of
users? Maybe teaching people more about how onion services work, or
showing YouTube that there's a significant level of demand for an
official onion service?

[Seth David Schoen]

if its operator knew a vulnerability in some clients' video codecs,

(or in some other part of Tor Browser, since the proxy can also serve
arbitrary HTTP headers, HTML, CSS, Javascript, JSON, and media files of
various types)

it could also serve a maliciously modified video to attack them

[Damon (TheDcoder)]

I agree with Seth, this particular YouTube frontend/proxy seems to be
more focused on offering an alternative viewing experience rather than
privacy.

One interesting thing I have noted which may improve privacy (but still
does not outweigh the risk involved) is that this site provides video
playback without requiring JavaScript, so it maybe suitable for general
purpose use for users who do not wish to have JavaScript enabled.

Post by Seth David Schoen

if its operator knew a vulnerability in some clients' video codecs,

(or in some other part of Tor Browser, since the proxy can also serve
arbitrary HTTP headers, HTML, CSS, Javascript, JSON, and media files of
various types)

it could also serve a maliciously modified video to attack them

[bo0od]

Im not the operator of the service but here are the advantages:

- Youtube is made by a dick company to humanity called Google, which is
funding their services by stealing/collecting users data. So the JS
which is closed source in case of YB prevent you from watching the
videos unless you allow the JS. in case of invidous the JS used already
licensed and the source code you can find it here:

https://invidio.us/licenses

Plus you can watch the videos without the need to allow any JS.

- Connecting to Youtube directly , then you are putting your security on
the SSL/TLS encryption. Whereas using in invidous hidden services your
security is through the Onion hidden services design more you can watch
Roger Dingledine speech at defcon:


http://kgg2m7yk5aybusll.onion/watch?v=Di7qAVidy1Y

or just normal youtube link if you like

- Its free software and the code is available for install/checkup. You
are referring to FB which is completely the opposite of anything
mentioned here.


Hope that clarify the differences.

Post by Seth David Schoen
Hi bo0od,
Thanks for the links.
This seems to be in a category of "third-party onion proxy for clearnet
service" which is distinct from the situation where a site operator
provides its own official onion service (like Facebook's facebookcorewwwi,
which the company has repeatedly noted it runs itself on its own
infrastructure).
Could you explain how this kind of design improves users' privacy or
security compared to using a Tor exit node to access the public version
of YouTube? In this case the proxy will need to act as one side of
users' TLS sessions with YouTube, so it's in a position to directly
record what (anonymous) people are watching, uploading, or writing --
unlike an ordinary exit node which can at most try to infer these
things from traffic analysis. Meanwhile, it doesn't prevent YouTube
from gathering that same information about the anonymous users, meaning
that this information about users' activity on YouTube can potentially
tbe gathered by wo entities rather than just one.
The proxy could also block or falsely claim the nonexistence of selected
videos, which a regular exit node couldn't do, and if its operator knew
a vulnerability in some clients' video codecs, it could also serve a
maliciously modified video to attack them -- which YouTube could do, but
a regular exit node couldn't.
Are there tradeoffs that make these risks worth it for some set of
users? Maybe teaching people more about how onion services work, or
showing YouTube that there's a significant level of demand for an
official onion service?

[Ben Tasker]

Post by bo0od
- Connecting to Youtube directly , then you are putting your security on
the SSL/TLS encryption. Whereas using in invidous hidden services your
security is through the Onion hidden services design

One of the points made earlier though, is that this isn't entirely accurate.

If you're talking about security, there's still a SSL/TLS link between
invidious and Youtube over which your content must pass. The user has to
assume (and I *hope* it's true) that Invidious will properly verify the
cert that Youtube presents to ensure that there isn't a MiTM.

But, added to this, what you as the user are doing is inserting a third
party into the mix who's acting as a deliberate MiTM. Invidious could
(probably isn't, but has the ability) be injecting something nasty at any
point. That's no reflection on the intentions of the Invidious' operator,
they may simply get compromised by someone who sees them as a juicy target
- After all it seems unlikely that they've got the resources to put into
security that Google has.

So, whilst your initial connection has potentially gained some security (by
going over Tor), your security posture is weakened because you've inserted
a new potential attack vector, and just moved the point of origin for the
original one (the SSL/TLS connection) as well as also outsourcing the task
of verifying that TLS connection to a third party (who may very well be
ignoring invalid/expired certs for all you know at time of connection).

What you _have_ gained is some level of privacy. Youtube cannot see your
source IP, and neither can Invidious. But that's not the same thing as
increasing security - that's obviously ignoring any profiling that Youtube
still manage to do on you, though.

TL:DR - Security is weakened, Privacy is (potentially) strengthened