Abin da mai ba da VPN ɗinka zai iya gani da abin da ba zai iya ba
Ƙofar fita tana ganin adireshi, lokuta kuma, in ba a yi amfani da Encrypted Client Hello ba, sunan shafin a musafaha na TLS. Riƙewa wata tambaya ce daban.
Tunnel ɗinka yana ajiye cibiyar sadarwa ta gida a wajen zirga-zirgarka. Amma ba ya kawar da kamfanin da ke gefe guda, wanda ke sarrafa kowane fakiti kafin ya isa intanet buɗaɗɗiya. Wannan matsayi shi ne tsarin kasuwanci da tambayar sirri a lokaci ɗaya. Don haka tambaya mai amfani ba ita ce ko mai bayarwa zai iya ganinka ba, amma abin da yake gani, abin da zai iya ambatawa, da abin da yake riƙewa.
Inda amana ke ƙaura da gaske
Ƙirƙirar sirri tana gudana daga na'urarka zuwa uwar garken mai bayarwa, kuma wannan ɓangaren waje shi ne duk abin da cibiyar sadarwarka ta gida ke gani. Mai bayarwa yana riƙe da wancan gefen ɓangaren, don haka yana buɗe tunnel ɗin ya kuma tura fakiti ɗinka gaba. Babu laifi a ciki; ma'anar sabis ɗin da ka saya ke nan. Amana ta ƙaura daga mai gudanarwa na gida zuwa mai gudanarwa na ƙofar fita maimakon ta ɓace.
Daga wannan matsayi yana sanin adireshin tushenka, lokacin da ka haɗa, kusan nawa ka aika, da waɗanne wurare ka tuntuɓa. Babu ɗaya daga cikin waɗannan da ke buƙatar karanta saƙonninka, kuma wannan shi ne ma'anar raba nau'ikan. Bambance-bambance masu ban sha'awa tsakanin masu bayarwa sun shafi abin da ke faruwa da waɗannan lura bayan haka.
Abin da ƙofar fita ke sarrafawa dole
Ka tsara nau'ikan bisa yadda ƙofar fita za ta iya ganinsu da tabbaci. Babu wani layi da ke buƙatar karya ɓoyewa, kuma kowanne yana da amsa daban game da ko za a iya guje masa kwata-kwata.
| Category | Visible at the exit | Why |
|---|---|---|
| Your public address | Always | It is the address the tunnel arrives from |
| Connection times and volume | Always | Accounting data, not content |
| Destination IP addresses | Always | The exit has to route the packets |
| HTTPS hostname (SNI) | Normally, unless ECH is used | Sent in the clear in the TLS ClientHello |
| DNS names | Only if DNS is plaintext | DoH or DoT hides the query; plaintext is readable by the forwarder |
| Page paths and form contents | Not normally | Protected by the destination site's TLS session |
Layi na huɗu shi ne abin da yawancin tsarin tunani ke mantawa. Na'urar bincike ta zamani tana sanya sunan shafin a cikin ClientHello, saƙon farko na musafaha na TLS, kuma wannan fili ana iya karantawa a ƙofar fita ko da an ɓoye kowane tambayar DNS daga ƙarshe zuwa ƙarshe. In ba a yi yarjejeniyar Encrypted Client Hello ba, sunan yana tafiya a fili kusa da adireshin wurin da ake nufi. DNS ɗin da aka ɓoye yana canza wanda ke ganin tambayar, ba wanda ke ganin sunan ba.
Haka ma takardun shaida a tsoffin haɗi: TLS 1.3 yana ɓoye takardar shaidar uwar garke, yayin da musafaha na TLS 1.2 zai iya fallasa sunan ga mai lura da ke rikodin rafi. Dukansu gaskiyar jigila ne ba manufar mai bayarwa ba.
Abin da TLS ke rufewa da abin da ba ya rufewa
Lokacin da shafi ke ba da HTTPS, na'urar bincikena tana gina haɗin TLS zuwa ƙarshen wannan shafin, ba zuwa uwar garken VPN ba. Mai bayarwa yana tura rikodin ɓoyayye kuma yana sanin adireshin wurin da ake nufi, lokacin da kimanin girmansa. Sunan shafin yana tafiya a cikin ClientHello in ba ECH ba, kuma jikin shafin yana kasancewa a ɓoye a kowane yanayi. Takardar shaidar tushe da ba a zata ba tana canza wannan iyaka, don haka gargaɗin takardar shaida ya cancanci girmamawa.
HTTP na fili ba shi da irin wannan kariya bayan ƙofar fita. Tunnel ɗin yana kare ɓangaren zuwa mai bayarwa, sannan buƙatar tana tafiya daidai yadda za ta tafiya ba tare da VPN ba. ECH ba ya gyara wannan, domin yana kare suna ba abun ciki ba.
Riƙewa tambaya ce daban daga ganuwa
Mai gudanarwa zai iya sarrafa bayanan haɗi a cikin ƙwaƙwalwa kuma bai riƙe kome ba, ko ya riƙe wani ɓangare kuma ya kwatanta shi daidai a matsayin ba tarihin bincike ba. Ka karanta da'awar rashin log ɗin bisa nau'i ba bisa taken talla ba: rikodin haɗi, hatimin lokaci, jimillar girma, bayanan wuri, masu gano asusu, da saƙonnin tallafi duk ana lissafta su. Mai bayarwa zai iya kasancewa da gaskiya ba ya riƙe log ɗin bincike kuma a lokaci ɗaya yana riƙe da rikodin asusu da bayanan da ake buƙata don gudanar da sabis ɗin. Ganuwa ba ta gaya maka wanne daga cikin waɗannan nau'ikan ake adanawa ba.
Bincike shaida ne game da tsarin da lokacin da ya rufe, kuma lambar abokin ciniki na buɗaɗɗen tushe tana kwatanta abokin ciniki ba uwar garken ba. Dukansu suna da amfani, kuma babu wanda ke magana a madadin kowane tsarin ajiya da ke bayan ƙofar fita. Ka nemi iyakar bincike, ba lambar yabo tasa ba.
Tambayoyin da ke raba masu bayarwa
Ka tambaya abin da ake riƙewa, har yaushe, da wanda zai iya samo shi. Ka tambaya wanda ke gudanar da ƙofar fita, domin jerin sunaye, mai haɓaka manhaja, da wanda ke gudanar da wata uwar garke takamaiman na iya zama ɓangarori uku daban-daban. Ka tambaya yadda ake sarrafa DNS da ko ana tallafa wa ECH a hanyoyin da kake amfani da su, domin ClientHello a fili yana ambaton shafin ko da babu tambayar DNS. Ka tambaya abin da ke faruwa kan buƙatar doka, ka karanta amsar a matsayin bayanin iyawa ba niyya ba.
Jagorar EFF don zaɓar VPN jerin dubawa ne mai ma'ana ga waɗannan tambayoyin, kuma tsari ne ba hukunci kan kowane sabis ba. Shafin talla ba manufar riƙewa ba ce. Babu ɗaya daga cikin waɗannan da ke sa VPN rashin amfani; yana canza wanda ya kamata ka amince da shi, da kuma don me.