ยังไม่มีหน้านี้ในภาษาของคุณ คุณกำลังอ่านข้อความภาษาอังกฤษ
Glossary
SOCKS5
SOCKS5 is a proxy protocol that forwards whole connections and can be asked to resolve the site name at the far end.
What the handshake carries
Three short exchanges happen before a single byte of your traffic moves, and each of them can fail on its own.
The shape of them is public and old, which is why every seller and every tool agrees on what a SOCKS5 proxy is.
- 1
The greeting
The client lists the login methods it can manage and the proxy names the one it wants to use.
- 2
The login when asked for
A name and a password cross in an exchange of their own, with no protection of their own.
- 3
The connect request
The destination goes up either as a number or as a name, and which of the two matters more than it looks.
The name travels rather than the number
Turning a site name into a number at home puts the visit into your own resolver's log while the traffic leaves somewhere else entirely.
When the app speaks to the proxy on the browser's behalf, the destination goes up as a name, so the far side is the one that resolves it.
This holds where the app does the talking
A login needs help beside the browser
A password written into the launch line does not work. Measured on the shipping build: the plain form made requests through the proxy and the form carrying a password made none and loaded nothing.
So a small proxy runs on loopback instead. It answers the browser without a password and speaks to the real proxy with one.
The launch line then carries a loopback address and nothing more. On our own engine that local step also asks the browser for a one-time pass, so another program on the machine cannot use the paid channel.
What the app accepts
A pasted line may say socks, socks5 or socks5h, and all three mean the same transport once the line has been stored. The label you were given does not have to be rewritten.
A scheme nobody recognises is refused rather than quietly turned into plain http. A quiet downgrade would leave you believing you are on SOCKS5 while going out in the open.
Often confused with
HTTP proxy
Speaks the web's own language and understands what it is asked for. SOCKS5 understands connections and leaves the contents alone.
A VPN
Moves the whole machine and every program on it. A SOCKS5 entry belongs to one profile and nothing else.
Your own server as the exit
An ordinary ssh account with dynamic forwarding becomes a real SOCKS5 on loopback, and the browser cannot tell the difference.
What this does not do
- It does not encrypt anything of its own. Whatever secrecy you have comes from the TLS inside the connection, and a SOCKS5 login crosses the wire unprotected.
- It does not settle where names are resolved for every setup. On an entry with no login that choice belongs to the browser rather than to the app.
- It does not ask a proxy for anything but a plain connection. Nothing here asks a proxy to listen on your behalf or to carry datagrams.
- It is not a better exit than any other protocol. The address is the seller's either way, and a datacentre address is recognised for what it is whatever carries it.
Check it
Each claim above is one place in the code and one stand.
- The greeting, the login and the hostname run against a real SOCKS5
- apps/desktop/test/proxy-auth-bridge.js
- One address covers every scheme, proved by running the rule rather than reading it
- apps/desktop/test/proxy-covers-https.js
- A check runs against a SOCKS5 that demands a login
- apps/desktop/test/proxy-check-uses-bridge.js
- One parser reads a pasted line for the app and for the account alike
- packages/shared/src/proxy-line.js
Questions
- Is SOCKS5 safer than an HTTP proxy?
- Neither hides the contents by itself. The difference is what they forward and, in daily use, who turns the site name into a number.
- What does the h in socks5h mean?
- It marks the habit of resolving names at the far end. A pasted line carrying it is stored as an ordinary SOCKS5 entry.
- Does a SOCKS5 proxy need a login?
- Most paid ones do. The password stays out of the launch line, where every other program running as you could read it.
- Can I use my own server instead of buying one?
- Yes. An ssh account with dynamic forwarding is raised beside the profile and the browser is handed a plain loopback address to use.
- Does SOCKS5 stop a WebRTC leak?
- No. That is a separate way out of the browser and it has to be closed separately.
Put one profile behind SOCKS5
The free plan gives two profiles, with no time limit and no card.