Randomize the "/001/" in psiphon URLs

[root]

Was this meant to be randomized or customized by Hosts? One way or another, we should remove this blocking and enumeration vulnerability

[root (n-root-psiphon-ca)]

Random dictionary word, perhaps? Not sure.... We should also think about this in light of the possibility (probability?) that we will be using hostname-based psiphon URLs (as opposed to IP-based URLs) in the not-so-distant future. (In order to enable signed certs.)

                For Psiphon to be usable from 'net cafes (which is, after all, one of its main design principles) the hostname _and_ this "suffix" must be relatively easy to memorize.

[root (n-root-psiphon-ca)]

Oops. Accidentally removed assignment and changed component specification. Sorry. (I put it back...)

[root (n-root-psiphon-ca)]

Also...remind me why we have this suffix? Is it to make the page most likely to be actively scanned (document root, at the node's IP address) easier to camouflage? (In other words, attempts to "disguise" that page don't have to incorporate a login dialog into their fake design? Were/are there other reasons?

[root (n-root-psiphon-ca)]

Replying to [comment:5]:

                I'm not sure what purpose the /001 serves, but the purpose of a randomized or a custom /NNN suffix per user or per proxy is to prevent scanning attacks: attacker scans for hosts that serve a known, fixed "signature" URL. Again, /001 seems counter productive in this sense.

                One issue with random is users remembering the URL to browse to. We do have that issue now with /001 so it's partially addressed with the welcome email containing the full "https://<proxy IP>/001/" URL. Another suggestion was to allow users to specify their own, custom suffix if that's easier to remember.

                > Also...remind me why we have this suffix? Is it to make the page most likely to be actively scanned (document root, at the node's IP address) easier to camouflage? (In other words, attempts to "disguise" that page don't have to incorporate a login dialog into their fake design? Were/are there other reasons?

[root (n-root-psiphon-ca)]

May 09 Release.

[root (n-root-psiphon-ca)]

* The goal is to hide every static resource that can be scanned/fingerprinted by an unauthenticated client.
                * All pages, scripts, CSS, images, Javascript resources require authentication. Give standard looking 404 when unauth.
                * Generate a unique 128-bit (hex digit) prefix for each proxy and store in database. This prefix must be known/provided to access gateways into authentication.
                * When generating links (invites, guest browsing), this prefix is used in place of 001
                * Auth page gateway: Apache configured to check path for prefix.
                * Other exclusions: create_account (invite/capcha), guest browsing. Modify invite to *require* valid invite code param or 404; ensure guest browsing 404 on invalid token; capcha mode -- require proxy prefix as input param or else 404?