Privacy Pass: Bypassing Internet Challenges Anonymously

Abstract

The growth of content delivery networks (CDNs) has engendered centralized control over the serving of internet content. An unwanted by-product of this growth is that CDNs are fast becoming global arbiters for which content requests are allowed and which are blocked in an attempt to stanch malicious traffic. In particular, in some cases honest users-especially those behind shared IP addresses, including users of privacy tools such as Tor, VPNs, and I2P - can be unfairly targeted by attempted ‘catch-all solutions’ that assume these users are acting maliciously. In this work, we provide a solution to prevent users from being exposed to a disproportionate amount of internet challenges such as CAPTCHAs. These challenges are at the very least annoying and at their worst - when coupled with bad implementations - can completely block access from web resources. We detail a 1-RTT cryptographic protocol (based on an implementation of an oblivious pseudorandom function) that allows users to receive a significant amount of anonymous tokens for each challenge solution that they provide. These tokens can be exchanged in the future for access without having to interact with a challenge. We have implemented our initial solution in a browser extension named “Privacy Pass”, and have worked with the Cloudflare CDN to deploy compatible server-side components in their infrastructure. However, we envisage that our solution could be used more generally for many applications where anonymous and honest access can be granted (e.g., anonymous wiki editing). The anonymity guarantee of our solution makes it immediately appropriate for use by users of Tor/VPNs/ I2P. We also publish figures from Cloudflare indicating the potential impact from the global release of Privacy Pass.

Oblivious DNS over HTTPS (ODoH): A Practical Privacy Enhancement to DNS

“…Public Key Linkability ODoH targets may give each client a unique HPKE key for query encryption in an attempt to deanonymize them. This is a common problem with protocols of this form, including Privacy Pass [26]. Multiple mitigations exist against this type of attack.…”

An Integrated Vulnerability Assessment of Electronic Commerce Websites

“…Many web applications do not properly protect sensitive data, such as credit cards, tax IDs, and authentication credentials. Attackers may steal or modify such weakly protected data to conduct credit card fraud, identity theft, or other crimes [30]. They believe sensitive data deserves extra protection such as encryption at rest or in transit, as well as special precautions when exchanged with the browser.…”

"Should I Worry?" A Cross-Cultural Examination of Account Security Incident Response

“…Thus, multiple notifications are a signal to users that the system may be generating false positive reports. Some participants may indeed see the incident notifications frequently due to false positives -e.g., caused by use of privacy enhancing technologies (VPN, private browsing) [39] or frequent travel or multiple device use, for example, VN12 explains, "Because I have like two accounts. I have never encountered such problem with one account, but with the other account, I always encounter that problem.…”