Will Strafach

building great things. breaking others. | founder @guardianiosapp (acq @dnsfilter) | @[email protected]

[Will Strafach @chronic]

very exciting news y’all!

[TechCrunch @TechCrunch]

DNSFilter acquires iOS firewall app Guardian to expand its web-based threat detection tech https://t.co/DTz57DVER8 by @carlypage_

[Will Strafach @chronic]

interested in working with very unique and high volume network data to discover emerging threats? come work with me at DNSF!

https://t.co/nRt3B7PiUC

[Will Strafach @chronic]

@JHDN @BrendanEich @powerpig @brave @guardianiosapp @mullvadnet just as a data point - we don’t retain data related to connectivity attribution either, and do not have the ability for any party, raid/subpoena/hackers/scammers/otherwise, to do so. we are a neutral carrier of network traffic and it is not our business who is doing what.

[Will Strafach @chronic]

@BrendanEich @powerpig @brave it’s an interesting feature idea for sure, since we intentionally use vanilla WireGuard and IKEv2, the credentials can technically be used manually on a router like GL iNet models, though officially we focus support on endpoints.

[Will Strafach @chronic]

@mert @usedjpgtrader @BrendanEich @zooko @guardianiosapp @DNSFilter correct! it uses native system (iOS, macOS, Windows, Android) APIs to switch on system-wide.

[Will Strafach @chronic]

@BrendanEich @Lin1985N @richardkoo @DJRawDeal_MD @brave @lukemulks I would love to know as well. we’re always trying to get better, and dealing with GFW is a big one.

[Will Strafach @chronic]

@richardkoo @BrendanEich @DJRawDeal_MD @brave @lukemulks further, GFW sometimes allows things only to later disrupt/devgrade the connection.

[Will Strafach @chronic]

@richardkoo @BrendanEich @DJRawDeal_MD @brave @lukemulks China is tricky. I have anecdotally heard that our WireGuard support works, but not IKEv2, but allegedly it also may depend on the region and network (I guess hotel networks may be more relaxed). honestly we haven’t done a comprehensive study.

[Will Strafach @chronic]

@DefuseSec please be careful if anyone reaches out. there is no publicly available method to get a “true” forensics image of the device. it may be wise to do a backup in Apple Configurator ASAP though to preserve any traces of whatever the border people did

[Will Strafach @chronic]

@matthew_d_green @cryptoishard it was some wild west shit. per my recollection, I am fairly confident that they did not even constrain it to only the analytics FQDNs.

I went back-and-forth with senator Blumenthal’s office to try to help craft something that’d elicit more details from FB, but FB blew it off.

[Will Strafach @chronic]

from an instructional video for Project Atlas users. this is how they guide the user through trusting the Facebook Researxh Root Certificate. does this sound like a “rigorous consent flow” to anyone?

[Will Strafach @chronic]

@malwrhunterteam 👀 interesting catch

[Will Strafach @chronic]

@drunknbass @lorenzofb yup

[Will Strafach @chronic]

@HowitzJame12303 @brave @BrendanEich @brianbondy happy to try to help out here! a few questions:

1. by Desktop, would that be Windows or macOS?

2. are you using an In-App Purchase, or do you have a Brave account?

3. have you used “Contact Technical Support” in the app to send us device information and debug data?

[Will Strafach @chronic]

@justinschuh @KimZetter how would the technique apply to an iPhone 5c, though?

[Will Strafach @chronic]

@EnglishManDanB @BrendanEich if you’d be willing to indulge on testing to see if using the Brave VPN helps resolve your Brave Search problem, it’d be very interesting to find out (we’d especially want to know if the same issue occurs, as that should never happen). there should be a free 7-day trial, btw.

[Will Strafach @chronic]

@EnglishManDanB @BrendanEich this is a hard problem to solve, but one idea I have is to consider looking through the Proton server list and finding a server in your area with the lowest amount of congestion; it may or may not help, but my thinking is that lesser-used servers might not be classified that way.

[Will Strafach @chronic]

@EnglishManDanB @BrendanEich ah, that output actually helps explain it - it looks like they’ve got their IPs classified as a Network Sharing Device on one or more anti-abuse lists. this can happen when many users are exiting traffic through one single IPv4 address.

(1/2)

[Will Strafach @chronic]

https://t.co/CVnCFE8JjJ