How does μ₀ work?

μ₀ is a cutting-edge service designed to enhance your online experience. Whether you're concerned about privacy, security, or accessing limited content, μ₀ has you covered. Let's dive into how our service works and why it's the ultimate web browsing companion.

μ₀ acts as an intermediary gateway between your device and the websites you visit. When you request a resource, μ₀ fetches it on your behalf, shielding your identity and location. By routing your traffic through μ₀ servers, your IP remains hidden. Websites see μ₀'s IP instead, preserving your privacy and meaning it is harder for restrictions placed by both the remote website and your local network provider to be enforced. It's like wearing an invisibility cloak online — your digital footsteps would be harder to track when you use μ₀ and it would be difficult to actually deduce where you are going (and thus restrict any out-of-bounds areas). The actual technical details are split into three parts - the authentication, the connection and the tunneling.

Connection phase

At the start of every request, your μ₀ client (on your local machine) must obviously find a way to communicate to our services securely. When a connection request is received, a load balancer automatically finds the instance the server (the replica) that will give optimal connection speeds for you, giving you optimal speeds. After this match is found a TLS handshake is performed to ensure that all subsequent data sent on this connection will be encrypted. First of all, your client sends us data (which is not stored) data, called a ClientHello, about encryption methods that it supports. Then, our server will return a ServerHello confirming these parameters, which is signed by a CA certificate to prove that the message truly came from us, and not a nefarious middleman. You client will then send a randomly generated PreMasterSecret, encrypted using our certificate (so no-one can see), which we then use to generate the encryption password for our exchange. Then, after confirming that both sides have the correct password the encrypted communication begins. The exact way this encryption is performed depends on the parameters you sent us originally but usually is military-grade in the sense that it complies with AES-128 or AES-256.

Can't hackers just copy your CA certificate and pretend to be you?

No. The certificate contains two sides, a public and a private key, and we send the public key. For something to be decryptable using the public key the original message must have been encrypted with the private key, and vice verca. This means only we could have generated the information we send you and only we can read the data you send us. In a similar fashion, signing some data using a certificate requires knowledge of the private key (which only we have).

Authentication

After you are connected to our servers, we perform an authentication check, requiring proof of authentication details to protect our services from abuse and spam. During your first login to μ₀, the μ₀ client will store details of authentication without storing your passwords, usernames or sensitive authentication data; instead, these details are processed using a one-way mathematical function known as a hash (meaning no-one can decrypt it) and instead it is this value that is stored. If a client is able to provide a correct hash it is most likely that they actually held the value - thus supplying the hash suffices as proof of authentication. This hash is known as an authentication hash and must be provided to every request to our services.

What happens if hackers managed to steal my authentication hash?

On top of this authentication hash, our endpoints need verification of a hash (your device fingerprint) of additional hardware aspects of your machine such as model, CPU info, etc. This is provided to our servers on your intial login to our services (but remember, as the data is hashed not even we can decrypt it) and must be replicated exactly on every subsequent access to our APIs. Obviously, this is not stored anywhere on your computer but the value you obtain every time is still the same, as the hardware aspects of your computer will not change. This way, hackers must also need to replicate your device fingerprint which is only possible by replicating the parameters of your machine exactly, which is highly unlikely.

Tunnelling

After you have established a secure tunnel and proven your authentication, communication may begin on the connection. We impersonate you and make a request to your targeted location, and then forward you any data the server sends; if the server itself uses the same TLS protocol as we do (which is explained above and is largely standard in the modern Web) we will, without reading or modifying the messages as we are physically unable to because we do not have their private key, forward it to you as-is, facilitiating operation of TLS.