Security and logging

There is no access log. The web server that answers your connection keeps no record of the requests it passes on, and the relay behind it keeps none of the requests it handles. A request that works leaves nothing behind on our side once it is served.

The only lines that are written are about failures. When a request cannot be completed, because the site did not answer or because the relay was restarting, each of the two writes one line naming what was asked for and what went wrong. What was asked for is recorded at the level of the site, never the page: the address of what you opened is carried inside the request path, and the line is cut to the part that names the site before it is written, which also removes the address you typed into the console. Neither line holds your IP address, not even a shortened form of it, nor your browser, nor any cookie. They go to the system journal, which is where a fault is found.

There is no rate limit counted against your address either. Some proxies keep a per-address counter to hold off automated abuse; Floppyblock keeps none, and the application never learns your address in the first place, because the web server in front of it does not pass it on.

One consequence is worth saying plainly. Because nothing is kept, we cannot say afterwards who opened what through Floppyblock, not to a site that asks and not to ourselves. That is the design, not a policy we apply case by case.

There is no server-side session record. Your session is a signed token that the relay checks by its signature alone: it carries an identifier and the moment it started, signed with a key only the server has, so the start time cannot be edited and there is no table of sessions to keep. It runs for 60 minutes. After that comes a 15 minute cool-down, and then a fresh session starts on its own, so one browser cannot hold the relay open all day.

The token is carried in a cookie the pages you open cannot read, and the cookie is set to expire at the end of the cool-down, so your browser discards it the moment it stops meaning anything. Nothing renews it. When the session expires the tab returns you to the console. You cannot cancel a session early, and closing the tab does not end it sooner. Clearing the cookie does not end it either, but it does start a new one on the next request, which is a deliberate trade: the alternative is a limit tied to your address, and the people this relay is for tend to share one address with a whole building, where one person’s hour would end everyone’s.

What is held while it lasts

Two pieces of short-lived state sit on the server, both keyed to your session and to nothing else, both in memory only, so a restart of the service loses them.

The first is the cookies the sites you open have set, in a store kept in memory only. Each cookie is kept under the host that set it and handed back only to that host, the way a browser would. The store is dropped the moment the relay refuses a request because your time is up; it is dropped when nobody has touched it for as long as a session lasts, which is what happens to the tab you closed at minute five; and you can drop it yourself at any time from Clear stored cookies in the footer.

The second is how we count how many people are using Floppyblock right now, which is the one number we keep about use of the service. When your browser asks a relay for something, it notes that a session was seen, and the count of sessions seen in the last few minutes is what our own dashboard shows. It holds no address, no site and no page, and what it stores for you is not your session token but a scrambled form of it, under a key drawn fresh each time the service starts, so the same visitor is a different entry after a restart and on every other server. It forgets you a few minutes after your last request.

One number is written to disk, and it is a number: how many sessions opened a site in each hour, kept for a month, so our dashboard can say how many people used Floppyblock today and last week. Each hour is a single count with nothing inside it. To count a session once rather than every time it opens another site, the same scrambled form of your token is kept in memory for as long as the token itself could still be shown, which is the length of a session and its cool-down, and then dropped. Nothing else about the session exists anywhere.

The relay captures the cookies the sites you open set, keeps them in that server-side store, and attaches them again each time it fetches on your behalf. Before the response reaches your browser, the site’s instruction to set a cookie is removed, so the cookie itself never lands in your browser under Floppyblock’s address.

One exception keeps pages working. Many sites need their own scripts to read a cookie back after writing it, so a cookie a page writes itself stays in your browser, scoped to that site’s own path on Floppyblock. The browser then shows it to that site’s pages and not to the next site’s. The same is done for the two storage areas a page can write to. Clearing your browsing data removes those; Floppyblock does not remove them for you when a session ends.

The connection between your browser and Floppyblock is encrypted, both on this site and on the address a session runs on. Floppyblock then makes its own separate connection onward to the site, and the encryption between you and Floppyblock does not reach that one. Those are 2 separate connections that meet at Floppyblock. The relay receives each page, rewrites the addresses inside it so the rest of the page loads through Floppyblock too, and sends it on, which means it handles the content of the pages you open in readable form.

Wherever Floppyblock has to carry the address of the site you opened, it carries the site’s origin encoded rather than spelled out. Your browser loads the page and everything on it through Floppyblock’s own address rather than from the site directly, so your own network performs no lookup for the site and sees no name for it in the handshake. What your network can see is that you connected to Floppyblock. The encoding is not a secret, though: it is an encoding and not encryption, and anyone who can read the address bar over your shoulder, or who gets hold of a link you copied out of the tab, can turn it back into the site’s name.

The site, for its part, is reached by Floppyblock and not by you. The headers that would carry your address to it are removed on the way out, so it sees the relay’s address instead of yours.

The questions on the home page cover what works through the relay and what does not, which is the other half of deciding whether this is the right tool. The blog goes further into where a web proxy is the wrong one and a VPN is the right one.

To clear what is held for you right now, use Clear stored cookies. It drops the server-side store for your session at once. The copies your browser holds go with your browsing data, which only you can clear.