Safe approach to opening suspicious http websites

dlb

Hey to all
If someone could share with me how do you approach http websites.
Especially sites where I need to login to gain acces to something i need.
Is http even safe to visit
My assumption is to use sandbox browser if there is any existing.

Can tor browser conserve my privacy and security if the site is monitored , or VPN.. Or tor through VPN

Thanks in advance

Graphite

dlb

VPN or Tor visiting an HTTP site will preserve privacy from a few points along the path. Anyone on your Local wifi (coffee shop?) and your ISP. But that's pretty much it. The hosted website has their ISP, cloud provider, etc. which can see the unencrypted traffic. If they require a login over http, then consider those credentials to be compromised. Don't reuse the password, and if the username is your real email, expect spam at some point. Definitely don't put anything private into that site. Don't allow location either.

newbie24689

dlb Some initial thoughts:

I'd create a user dedicated to suspicious web pages.
The only app I'd install is protonvpn, which I'd set for multiple hops, to an exit node that checks for malware, tracking, and ads.
I'd use Vanadium (hardened; well written)
If possible, I'd set storage scopes on Vanadium and protonvpn.
I'd try to use https, even if the site is advertised as http.
After downloading, I'd upload the object to one of the malware check sites to get opinions.
I think I'd heed the advice given by Graphite

BTW:

Vanadium is indeed "sandboxed":
Http is "safe enough" for many purposes, but can be hacked, monitored, "altered", etc.
Tor browser/network can reasonably conserve your privacy
Tor network through a VPN is an option, but would likely be very slow.
If you're trying to avoid a determined TLA, then none of these tools make you bulletproof.

dlb

Graphite If they require a login over http, then consider those credentials to be compromised. Don't reuse the password, and if the username is your real email, expect spam at some point. Definitely don't put anything private into that site. Don't allow location either.

Yes I am aware of that. Login data is only used there on that one site, location is system wide disabled always.

newbie24689 I'd try to use https, even if the site is advertised as http.

It is impossible. Site refuses safe connection.
But before, maybe few months ago the site was https.

newbie24689 Tor network through a VPN is an option, but would likely be very slow.

That is how I acces the site currently, it is slow but I don't care.
I am curious to what can someone potentially do to my phone after i access this site or similar ones..
What are the dangers and how to prevent them

Graphite

dlb what can someone potentially do to my phone after i access this site or similar ones

Nothing that an https site couldn't do too.

User2288

Depends on what you mean by "safe". If the site is malicious and runs malicious code then it doesn't matter if it's http or https. It causes same damage. The way to visit malicious sites is to do it inside a Virtual machine, on a PC. This guarantees safety.

If by safe you mean "privacy" then, all your traffic to an http site including every text/image uploaded and downloaded and ip/username/password/email-address is visible to every network device the communication passes through. This includes your ISP and server's ISP and every relay device in between.

You have to be very careful and mindful.

dlb

User2288 So accessing through VPN or tor , or tor through VPN should hide my IP etc..?

User2288

dlb

Yes going through a VPN hides your IP address. The IP address seen is that of the VPN server.

However you should understand that this by itself is generally not enough. If its only your IP address you are worried about, then this should be enough. However other things can still compromise you.

For example:

if the device you are on is compromised in some way, then the VPN may not help you in anyway.
Depending on your activity, if the page you are visiting or app you are using uses webRTC, then that compromises your VPN setup. WebRTC bypasses the VPN and leaks your IP address.
Your browser fingerprint can also reveal who you are. So hiding your IP changes nothing.

There is a lot of factors here that mix together that can affect your outcome. It depends on what OS you are on, what browser you use, what app you use, what website you are on, whether that website has fingerprinted your browser using google scripts and whether that fingerprint is already associated with any of your your accounts or your real IP.

For example for torrenting, having a VPN is enough to hide "you" as IP address is the only data other users that connect to you can see. But if you are running spotify app on your desktop for example, spotify has already fully fingerprinted your device hardware, knows your IP (if it connects just once using your real IP address), can see through your network and detect your entire network structure, and can see anything it wants on your system including contents of your private files. It then also shares this info with facebook and google. Any app installed on a windows device can do this if it wants to.

Windows itself can likely bypass your VPN and log every web-address you visit and send it to its own server even though you are using a VPN. Afterall windows has deeper access than the VPN to network traffic. Using a VPN from within windows will not fool windows itself about your actual IP address and what addresses you are visiting, thought it will not know the "content" of the communication.

If you visit and log into an account even once on the websites of google, microsoft, facebook, (and many other major corporate websites) , they will get the fingerprint of your browser, and then if you visit any website at all on the internet (with the same browser) that runs their scripts (most websites use google scripts in the background) then they will recognize you as the "same fingerprint". Using a VPN on the browser will no longer make any difference as they have your fingerprint and its now associated with an account (which has a phone number already associated with it).

The way to deal with fingerprinting is to prevent those scripts from running (when possible) and being careful about which website you visit and managing which "fingerprints" you log into websites with.

So a LOT of factors involved. And an absolute nightmare.

Graphite

User2288

That's a very good summary of the limitations of relying on VPN for privacy.

For fingerprinting some privacy browsers maintain the a very generic set of conditions to prevent fingerprinting, including the resolution/aspect ratio. Tor Browser for instance. But always combine with script blocking, and should also block webrtc.

Whonix was built specifically to put the entire system (virtual machine) behind a Tor router running on another system.
Qubes is an excellent OS made for this.
If really stuck on Windows, I advise putting an Always on VPN onto the router (OpenWRT or PFSense). You'll learn the quirks of network firewall rules, but it's robust against leaks.