How secure are proxies?

[Abbret]

Hey everyone, nice to meet you.
I have some hesitation about the use of web proxies. Why do people think they are more secure. ok, they hide your IP and browser, OS or whatever but every proxy i see keeps logs of your intenet activity.so even if google yahoo or aol keep track of what search entries were entered by users, the proxy also keeps these logs so there are now 2 logs about the same thing! actually what security does it add if proxies log everything? Sounds to me more malicious than benign. And what about your passwords => if you are behind a proxy chain and enter your passwords for say hackerthreads your passwords are now loggen in every single proxy wtf! how does that improve security?

how long are these logs kept? I see in some privacy policy terms that some keep the logs for 7 days. That would be cool, but according to the data retention act (EU) such data should be kept (at least by ISPs) for something in the order of 2 years!

and some proxies don't even have privacy policy or terms of service. Should i stay away from those? Can you share some good ones? I only see as good the "anonymouse", because of many reasons (hides all info, free, 7 days data retention, plus terms of service and privacy policy)

[IceDane]

That's why you use anonymous proxies when you can find them, obviously.

[raptorjesus]

If you are using an anonymous proxy your personal information could still be sniffed out (unless its over an encrypted connection), so I just recommend that you don't pass any important/personal info over any proxy that you don't trust.

[Abbret]

That's why you use anonymous proxies when you can find them, obviously.

please explain yourself. Anonymous proxies you mean proxies that do not store user information at all? Like no ip, no type of request, time/date etc.? I don't think there exist any proxies like that,because if a criminal used their service they would be in serious trouble!

I use anonymouse, do you know this? It has a "privacy policy and " terms of service" that are somewhat "too good" and i don't know if they are "true". Have you used this?

there are also those proxies that have no terms or privacy policy at all! does anybody have any experience with this?

[IceDane]

That's why you use anonymous proxies when you can find them, obviously.

please explain yourself. Anonymous proxies you mean proxies that do not store user information at all? Like no ip, no type of request, time/date etc.? I don't think there exist any proxies like that,because if a criminal used their service they would be in serious trouble!

I use anonymouse, do you know this? It has a "privacy policy and " terms of service" that are somewhat "too good" and i don't know if they are "true". Have you used this?

there are also those proxies that have no terms or privacy policy at all! does anybody have any experience with this?

Yes, anonymous proxies are proxies that do not store any information. To be honest, what you are talking about is that there is no guarantee that anyone is doing anything they say. That problem is not so much compsec-related as it philosphical, to be honest, as it way too broad for just compsec.

The ideal proxies would be proxies in those countries that aren't too friendly with the rest of the world. Russia. belarus and all those countries, but that pretty much means you will have to suffer with crappy speeds.

[Abbret]

I am not able to find any anonymous proxies the way you refer to them. If there existed such a service, wouldn't it get instantly abused for criminal behaviors and whatnot? Can you show me an anonymous web (or other) proxy?

That problem is not so much compsec-related as it philosphical, to be honest, as it way too broad for just compsec.

Is there any formal legislation regarding how proxies operate? For example, if they state in their terms that info is not stored longer than 7 days would it be possible that they store it for more, or even that you can charge them money for doing it? Or if they state that they store no info, but in fact they do? Actually anonymouse states that it doesnt keep any logs, and than logs will only be created during technical problems (I don't know exactly what they mean here).

All in all, what i'm saying is that completely anonymous proxies sound too good to be true. Why whould they do it, where do they make their profit out of this? Are there legal pitfalls that i am missing?

[clueless]

Even in the best possible circumstances you are never sure about the security of a proxy server. If you own a botnet and designate several drones to host anonymous proxy servers you are fairly sure they are 'safe' and not keeping logs. But nothing guarantees that one of them isn't a honeypot that is being watched.
Its impossible to erase your tracks completely, you can only obfuscate so much.

[narada]

All in all, what i'm saying is that completely anonymous proxies sound too good to be true. Why whould they do it, where do they make their profit out of this? Are there legal pitfalls that i am missing?

I run a Squid proxy for people in Iran. I don't make any profits. I do it because I think people should be able to have access to uncensored information. I do it because I hope it inspires others to take action. It's similar to my mentality regarding torrents: Seed when you can because it's the right thing to do. Sometimes you have to lead by example and put personal gain on the sidelines.

[Abbret]

narada, that's very good of you, but what if somebody abuses your service? Then you would be in serious trouble. So, since there are a lot of not-so-benevolent people looking for anonymity on the web, wouldn't ANY public proxy server be abused in a matter of days?

[foldingstock]

narada, that's very good of you, but what if somebody abuses your service? Then you would be in serious trouble. So, since there are a lot of not-so-benevolent people looking for anonymity on the web, wouldn't ANY public proxy server be abused in a matter of days?

Since libraries are used by people that are too cheap to buy books and support struggling authors, wouldn't ANY library be vandalized and robbed in a matter of days?

[narada]

narada, that's very good of you, but what if somebody abuses your service? Then you would be in serious trouble. So, since there are a lot of not-so-benevolent people looking for anonymity on the web, wouldn't ANY public proxy server be abused in a matter of days?

I don't care what they use it for and it only works with Iranian IP blocks (excluding government). The point is that they have anonymous access to uncensored information.

[SLaX]

What you want to use is what's called a transparent proxy. Anyone looking can't even see you're using a proxy. Then you can use one of various programs to chain several proxies that are located all across the world so anyone looking for you will have a real fun time trying to track you down.

[Abbret]

sorry for the late reply

Since libraries are used by people that are too cheap to buy books and support struggling authors, wouldn't ANY library be vandalized and robbed in a matter of days?

no, because libraries are looked after by the people who own them. Besides, i don't think this example captures the situation involved in proxies, because:
There are presumably a hell lot of illegal persons roaming on the internet and in need of anonymity. the same does not apply in your example.
Because of all those people, you could get in very serious trouble for their own illegal deeds. The same does not apply in your example.

Having said that, let's just forget about it, because it is not the point

I don't care what they use it for and it only works with Iranian IP blocks (excluding government).

My opinion is that you DO care about what they use it for, because it is actually your computer involved in their actions. But let's just move on to the point.

the point is that, what you are telling me is that, whenever you use a so called "anonymous" proxy, you are depositing your trust, and/or sensitive data that you choose to transmit through that proxy to a person on the other side of the globe, you haven't even met, who may or may not abide by his own terms of usage, (IF there are any)? I could go on and on about this.
And you really choose to do that?

Icedane, above said that it's just a matter of who abides by any rules they set, but there are even lists of proxies that don't give any info on who owns it, etc. Don't you share my worries about how fishy this sounds?