Adeyemi Adeleye yemster

Are your Ruby HTTPS API calls secure?

Let's check:

2.0.0-p481 :001 > OpenSSL::SSL::SSLContext::DEFAULT_PARAMS
 => {:ssl_version=>"SSLv23", :verify_mode=>1, :ciphers=>"ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW", :options=>-2147482625}
2.0.0-p481 :002 > rating = JSON.parse(RestClient::Resource.new("https://www.howsmyssl.com/a/check" ).get)['rating']
 => "Bad"

When setting up (that's immediately when user enables it in settings) Opera VPN sends few API requests to https://api.surfeasy.com to obtain credentials and proxy IPs, see below, also see The Oprah Proxy.

The browser then talks to a proxy de0.opera-proxy.net (when VPN location is set to Germany), it's IP address can only be resolved from within Opera when VPN is on, it's 185.108.219.42 (or similar, see below). It's an HTTP/S proxy which requires auth.

When loading a page with Opera VPN enabled, the browser sends a lot of requests to de0.opera-proxy.net with Proxy-Authorization request header.

The Proxy-Authorization header decoded: CC68FE24C34B5B2414FB1DC116342EADA7D5C46B:9B9BE3FAE674A33D1820315F4CC94372926C8210B6AEC0B662EC7CAD611D86A3 (that's sha1(device_id):device_password, where device_id and device_password come from the POST /v2/register_device API call, please note that this decoded header is from another Opera installation and thus contains

	# Fork of MessageVerifier from Rails 3.2.3
	# https://raw.github.com/rails/rails/f3e1b21ca91afbd97f33d1e51808dd320d82b4de/activesupport/lib/active_support/message_verifier.rb
	# Author: Jeff Yip (jeffyip)
	# This should work with Rails 3.0 - Rails 3.2

	require 'active_support/base64'
	require 'active_support/deprecation'
	require 'active_support/core_ext/object/blank'

	module ActiveSupport

	# Fork of MessageVerifier from Rails 3.2.3
	# https://raw.github.com/rails/rails/f3e1b21ca91afbd97f33d1e51808dd320d82b4de/activesupport/lib/active_support/message_verifier.rb
	# Author: Jeff Yip (jeffyip)
	# This should work with Rails 3.0 - Rails 3.2

	require 'active_support/base64'
	require 'active_support/deprecation'
	require 'active_support/core_ext/object/blank'

	module ActiveSupport

	# Hack to change the Rails cookie serializer from Marshal to JSON and therefore allow the session
	# to be shared between different languages but also avoid that someone knowing the
	# cookie secret key could execute arbitrary code on the server by unmarshalling
	# modified Ruby code added to the session/permanent cookie.
	#
	# Note that all users will beed to login again since both the remember me cookie and the session cookies
	# won't be valid. Note also that the remember me cookie is tested multiple times per request even when it fails.
	# for performance reasons you might want to delete it if these extra cycles are too costly for you.
	#
	# Rails 4 (not tested on Rails 3).

	<title>Up to 70 Characters of Keyword-relevant text here</title>
	<meta name=”description” content=”155 characters of message matching text with a call to action goes here”>
	<meta name="author" content="" />
	<meta name="copyright" content="©" />
	<link rel=”author” href=”https://plus.google.com/[YOUR PERSONAL G+ PROFILE HERE]“/>
	<meta property=”og:title” content=”iAcquire’s awesome blog”/>
	<meta property=”og:type” content=”article”/>
	<meta property=”og:image” content=”http://www.iacquire.com/some-thumbnail.jpg”/>
	<meta property=”og:url” content=”http://blog.iacquire.com”/>
	<meta property=”fb:admins” content=”USER_ID”/>

	import File.expand_path(File.dirname(__FILE__) + '/schema_format.rb')

	namespace :db do
	# Define PG environment utility methods
	task :pg_env => :environment do
	def pg_get_config
	ActiveRecord::Base.configurations.fetch(Rails.env).tap do \|config\|
	ENV['PGHOST'] = config['host'].to_s if config.key?('host')
	ENV['PGPORT'] = config['port'].to_s if config.key?('port')
	ENV['PGPASSWORD'] = config['password'].to_s if config.key?('password')

	// Use Gists to store code you would like to remember later on
	console.log(window); // log the "window" object to the console

	{% if template contains 'product' %}
	<meta property="og:type" content="product">
	<meta property="og:title" content="{{ product.title \| strip_html \| escape }}">
	<meta property="og:category" content="{{ product.type }}" />
	{% for image in product.images limit:3 %}
	<meta property="og:image" content="http:{{ image.src \| product_img_url: 'master' }}">
	<meta property="og:image:secure_url" content="https:{{ image.src \| product_img_url: 'master' }}">
	{% endfor %}
	<meta property="og:price:amount" content="{{ product.price \| money_without_currency \| stip_html \| escape \| remove: ',' }}">
	<meta property="og:price:currency" content="{{ shop.currency }}">

	<!DOCTYPE html>
	<html>
	<head>
	<style>
	/* How to select a range of children
	* (Here, 3rd-7th children, inclusive):
	*/
	ul li:nth-child(n+3):nth-child(-n+7) {
	outline: 1px solid #0f0;
	}