Google has started implementing an IP Protection feature in the Chrome browser, designed to hide the user's IP address from website owners. This new capability can be used as a built-in anonymizer primarily aimed at preventing tracking of user movements, but it is also suitable for bypassing blocks imposed both by websites and by internet service providers.
Technically, the proposed feature is realized by sending traffic not directly, but through a proxy server that forwards requests to the target server, which sees only the proxy's IP address as the incoming address, similar to using a VPN. To anonymize the request, it will be possible to sequentially pass the request through multiple proxies. In this case, the client’s IP information will be known only to the first proxy, while the second proxy in the chain will see only the address of the first proxy.
Google plans to test the protection mode (the key to connect to is specified, and iroh finds the associated host and establishes an encrypted connection using the QUIC protocol). Direct P2P connections are established whenever possible, but if not, it falls back to using relays, which are also employed for host discovery by keys. You can run your own relay or connect to public relays supported by the community. on a small percentage of users in one of the future releases of Chrome (from 119 to 125). In the initial phase, only one proxy server, owned by Google, will be used in the testing, and the concealment will apply only to Google's domains and advertising networks. This phase will be offered to systems with IP addresses from the US and will cover no more than 33% of users of experimental Chrome releases.
In the second phase of testing, a two-tier proxy configuration is planned to be introduced: initially, the connection will be directed from the browser through an encrypted tunnel to a proxy owned by Google, and then directed to a second proxy owned by a company unrelated to Google. The traffic tunneling will be organized so that the first proxy, which sees the user's IP address, will not see the request parameters and will not be able to determine the target host the user is addressing. The second proxy will be able to identify data about the target host but will not see the user's IP address. That is, the proxies will either see information about the user's address or about the target site, preventing the proxy from linking the user to the requested site.
Traffic will be directed to a proxy using CONNECT and CONNECT-UDP methods while creating a tunnel based on the TLS protocol, ensuring end-to-end encryption. To prevent abuse, access to the first proxy controlled by Google will be granted using a cryptographic token generated by Google’s authentication server when Chrome connects to the user's Google account (without authentication in Chrome, access to the proxy will be closed). Traffic restrictions will also be tied to the token, making it difficult to tunnel traffic through proxy servers for malicious purposes.
The default mode will be disabled and can be activated at the user's discretion. Address hiding is planned not for all websites, but only for a specifically curated list of domains known for tracking user movements. Binding to the list will help avoid unwanted modifications that disrupt website behavior, leading to issues with location determination, user segregation, and traffic accounting (for instance, blocking an offender on a website might be applied to all users redirected through the proxy).
To address location binding issues, which may be used on sites to comply with local laws and choose localization options, it is proposed to use second-level proxies in the same country or even city as the user (ultimately, a broad network of second-level proxies is planned to be deployed, built in collaboration with various providers and content delivery networks).servers second-level proxies, built in collaboration with various providers and content delivery networks).
WebKit engine developers are enhancing a similar functionality in the Safari browser called Intelligent Tracking Protection, which is currently limited to experiments with a single proxy but will eventually transition to a model using two independent levels of proxy servers.
Source: opennet.ru
