Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.python > #82182 > unrolled thread

encrypt the http request url on the local machine

Back to article view | Back to comp.lang.python

Contents

  encrypt the http request url on the local machine iMath <redstone-cold@163.com> - 2014-12-08 22:58 -0800
    Re: encrypt the http request url on the local machine iMath <redstone-cold@163.com> - 2014-12-08 23:08 -0800
      Re: encrypt the http request url on the local machine Chris Angelico <rosuav@gmail.com> - 2014-12-09 18:15 +1100
    Re: encrypt the http request url on the local machine dieter <dieter@handshake.de> - 2014-12-09 08:19 +0100
    Re: encrypt the http request url on the local machine iMath <redstone-cold@163.com> - 2014-12-09 04:43 -0800
      Re: encrypt the http request url on the local machine Dave Angel <davea@davea.name> - 2014-12-09 10:31 -0500
      Re: encrypt the http request url on the local machine Chris Angelico <rosuav@gmail.com> - 2014-12-10 02:35 +1100
    Re: encrypt the http request url on the local machine Peter Pearson <pkpearson@nowhere.invalid> - 2014-12-09 17:08 +0000
    Re: encrypt the http request url on the local machine iMath <redstone-cold@163.com> - 2014-12-10 05:48 -0800
      Re: encrypt the http request url on the local machine Chris Angelico <rosuav@gmail.com> - 2014-12-11 02:55 +1100
    Re: encrypt the http request url on the local machine iMath <redstone-cold@163.com> - 2014-12-12 07:53 -0800
      Re: encrypt the http request url on the local machine Chris Angelico <rosuav@gmail.com> - 2014-12-13 03:07 +1100
      Re: encrypt the http request url on the local machine Michael Torrie <torriem@gmail.com> - 2014-12-12 14:44 -0700

#82182 — encrypt the http request url on the local machine

my software on the local machine needs to send http request to a specific web server , is there any way to protect the http request url from being found by Packet analyzer software like Wireshark and fiddler. The sever is not mine, so I can do nothing in the server .

It would be better to show some code, I am an absolutely newbie in encryption .

[toc] | [next] | [standalone]

#82183

在 2014年12月9日星期二UTC+8下午2时58分36秒，iMath写道：
> my software on the local machine needs to send http request to a specific web server , is there any way to protect the http request url from being found by Packet analyzer software like Wireshark and fiddler. The sever is not mine, so I can do nothing in the server .
> 
> It would be better to show some code, I am an absolutely newbie in encryption .

P.S the server doesn't support https protocol

[toc] | [prev] | [next] | [standalone]

#82186

On Tue, Dec 9, 2014 at 6:08 PM, iMath <redstone-cold@163.com> wrote:
> 在 2014年12月9日星期二UTC+8下午2时58分36秒，iMath写道：
>> my software on the local machine needs to send http request to a specific web server , is there any way to protect the http request url from being found by Packet analyzer software like Wireshark and fiddler. The sever is not mine, so I can do nothing in the server .
>>
>> It would be better to show some code, I am an absolutely newbie in encryption .
>
> P.S the server doesn't support https protocol

If the server doesn't support encrypted HTTP requests, you either need
some other form of encryption that the server _does_ support, or a
proxy that can decrypt the request and pass it on (in which case
packet sniffing at the proxy could reveal what's happening). Why are
you so worried about packet sniffing? Is it something you expect to
happen?

ChrisA

[toc] | [prev] | [next] | [standalone]

#82185

iMath <redstone-cold@163.com> writes:

> my software on the local machine needs to send http request to a specific web server , is there any way to protect the http request url from being found by Packet analyzer software like Wireshark and fiddler. The sever is not mine, so I can do nothing in the server .

Not sure about "fiddler" but "wireshark" is a logger at tcp level.
When you use "https" (rather than "http"), a tcp logger may still see
the host (it definitely sees the IP address) but will not see
the rest of the url (as this is transmitted in encrypted form).

The protection provided by "https" is sufficient for "normal" use.
I recently heared a scientific talk suggesting that "https" protection
can be preached with a lot of computing power. Thus, there is likely
no protection against secret service surveillance (and maybe law
enforcement agencies).

[toc] | [prev] | [next] | [standalone]

#82196

在 2014年12月9日星期二UTC+8下午2时58分36秒，iMath写道：
> my software on the local machine needs to send http request to a specific web server , is there any way to protect the http request url from being found by Packet analyzer software like Wireshark and fiddler. The sever is not mine, so I can do nothing in the server .
> 
> It would be better to show some code, I am an absolutely newbie in encryption .

I don't know any  form of encryption that the server _does_ support, the sever is not mine.
Here I just don't want to any other guys using packet analyzer software know which server my software is sending data to

[toc] | [prev] | [next] | [standalone]

#82201

On 12/09/2014 07:43 AM, iMath wrote:
> 在 2014年12月9日星期二UTC+8下午2时58分36秒，iMath写道：
>> my software on the local machine needs to send http request to a specific web server , is there any way to protect the http request url from being found by Packet analyzer software like Wireshark and fiddler. The sever is not mine, so I can do nothing in the server .
>>
>> It would be better to show some code, I am an absolutely newbie in encryption .
>
> I don't know any  form of encryption that the server _does_ support, the sever is not mine.
> Here I just don't want to any other guys using packet analyzer software know which server my software is sending data to
>

There's a lot you're leaving out about the network topology.

The answers to avoiding/confusing someone else's packet sniffer are either:

1) change the content so they can see where it's going, but have no idea why
3) use a route that doesn't go past their sniffing software
2) change the data traffic so they don't recognize where it's going

Encryption solves the 1st.  The problem is that the other end has to 
know the encryption scheme you're using, and cooperate in using it. 
 From what you're saying, that can't happen.

The best way to solve the 2nd is to move your laptop to some place your 
sniffers don't have visibility to.  And make sure the route from your 
laptop to the server does not go near the sniffers.  Maybe you could 
talk the receptionist of the building where the server is into letting 
you plug in there.  Or you could use a library or other public wifi, 
where you hope they're not nearby (in a network topology sense).

The third approach involves something like a proxy.  You send encrypted 
data to the proxy, which then decrypts it and resends it to the server. 
The server responds to the proxy, which encrypts the response and sends 
it to you.  There are many things similar to this, used by crackers all 
over the world, as well as for some legitimate purposes.  One legitimate 
proxy-like thing many of us have used is an ip-tunnel like a VPN.  I 
have telecommuted to jobs where my access into the corporate network is 
via VPN, and all a sniffer at my house would see is access to a single 
machine, not to the final machine within the company network.

It probably would be best if you explained the actual scenario.  Are you 
trying to get to black-listed sites from within a corporate environment, 
and afraid the company IT department will detect it and get you fired? 
Best answer is to do it at home instead, where they're unlikely to have 
access.

If you wind up needing a proxy, you have to open an account with them, 
and make the arrangements.  I've enabled a proxy for my machine when it 
was necessary, but have no idea how to program it;  it also may vary 
depending on the proxy server.


-- 
DaveA

[toc] | [prev] | [next] | [standalone]

#82202

On Wed, Dec 10, 2014 at 2:31 AM, Dave Angel <davea@davea.name> wrote:
> If you wind up needing a proxy, you have to open an account with them, and
> make the arrangements.  I've enabled a proxy for my machine when it was
> necessary, but have no idea how to program it;  it also may vary depending
> on the proxy server.

I know how to program one, and it's not difficult. However, I'm
sitting tight on this one until I hear some legit justification for
this, especially given that the traffic from the proxy to the
destination server won't be encrypted.

ChrisA

[toc] | [prev] | [next] | [standalone]

#82233

On Mon, 8 Dec 2014 22:58:20 -0800 (PST), iMath <redstone-cold@163.com> wrote:
> my software on the local machine needs to send http request to a
> specific web server , is there any way to protect the http request url
> from being found by Packet analyzer software like Wireshark and
> fiddler. The sever is not mine, so I can do nothing in the server .

This is what Tor (onion routing) is for.  Vaguely speaking ('cause I
don't know much about Tor), you encrypt your entire HTTP request and
send it to a Tor node.  It gets passed around among Tor nodes until an
"exit node" decrypts it and sends it to the destination server.  Be
aware, though, that if the destination server doesn't do HTTPS, the
conversation between it and the Tor exit node is readable by snoops.

-- 
To email me, substitute nowhere->runbox, invalid->com.

[toc] | [prev] | [next] | [standalone]

#82282

在 2014年12月9日星期二UTC+8下午2时58分36秒，iMath写道：
> my software on the local machine needs to send http request to a specific web server , is there any way to protect the http request url from being found by Packet analyzer software like Wireshark and fiddler. The sever is not mine, so I can do nothing in the server .
> 
> It would be better to show some code, I am an absolutely newbie in encryption .

thank you all, I have learnt a lot from your answers.

for my question here, I don't want to use a route or proxy or Tor, network access speed is also vital in my application, so perhaps there is no solution.

[toc] | [prev] | [next] | [standalone]

#82289

On Thu, Dec 11, 2014 at 12:48 AM, iMath <redstone-cold@163.com> wrote:
> 在 2014年12月9日星期二UTC+8下午2时58分36秒，iMath写道：
>> my software on the local machine needs to send http request to a specific web server , is there any way to protect the http request url from being found by Packet analyzer software like Wireshark and fiddler. The sever is not mine, so I can do nothing in the server .
>>
>> It would be better to show some code, I am an absolutely newbie in encryption .
>
> thank you all, I have learnt a lot from your answers.
>
> for my question here, I don't want to use a route or proxy or Tor, network access speed is also vital in my application, so perhaps there is no solution.

Then yes, there's basically no solution. In general, you need to
either negotiate with the server (HTTPS being the easiest way), or go
via some server that you _do_ control, which will delay matters.

ChrisA

[toc] | [prev] | [next] | [standalone]

#82453

在 2014年12月9日星期二UTC+8下午2时58分36秒，iMath写道：
> my software on the local machine needs to send http request to a specific web server , is there any way to protect the http request url from being found by Packet analyzer software like Wireshark and fiddler. The sever is not mine, so I can do nothing in the server .
> 
> It would be better to show some code, I am an absolutely newbie in encryption .

After some retinking on my question ,I found what I am really want is not let  any other guys using packet analyzer software know the server name (host name) my software is sending data to .

so I translate the host name to IP address format, it somewhat hides the host name.
Another question is : for common sites, is the IP address under the host name hardly  changing ?

[toc] | [prev] | [next] | [standalone]

#82456

On Sat, Dec 13, 2014 at 2:53 AM, iMath <redstone-cold@163.com> wrote:
> After some retinking on my question ,I found what I am really want is not let  any other guys using packet analyzer software know the server name (host name) my software is sending data to .
>
> so I translate the host name to IP address format, it somewhat hides the host name.
> Another question is : for common sites, is the IP address under the host name hardly  changing ?

It depends entirely on the site's admins. Usually, you don't want to
do this, in case the IP changes. Plus, you run into a catch-22: if you
use the IP without ever using the host name, you depend on the server
responding with what you want in the absence of a host header
(basically, you depend on the server running just one web site), but
if that's the case, then concealing the host name is almost completely
useless, because anyone else can talk to the same server without a
host name. In fact, for big web sites, chances are the reverse DNS for
that IP will at least point to a related domain, even if not to the
exact web site you're accessing (for instance, www.wikipedia.org ->
198.35.26.96 -> text-lb.ulsfo.wikimedia.org). Basically, this either
will stop you from accessing what you want, or won't conceal anything.

ChrisA

[toc] | [prev] | [next] | [standalone]

#82470

On 12/12/2014 08:53 AM, iMath wrote:
> After some retinking on my question ,I found what I am really want is
> not let  any other guys using packet analyzer software know the
> server name (host name) my software is sending data to .
> 
> so I translate the host name to IP address format, it somewhat hides
> the host name. Another question is : for common sites, is the IP
> address under the host name hardly  changing ?

I don't see what that will accomplish.  Of what value is the hostname vs
the IP address?  Many servers have proper reverse entries in DNS to map
IP addresses back to host names.

Furthermore a packet trace can show exactly what the HTTP request was,
and that doesn't matter whether you do IP address or hostname.

As for whether the IP address changes often, depends on the server.
Sometimes some web sites use a cluster of servers and each name lookup
will give you a different IP address (round robin lookup).

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.python

csiph-web