51–60 of 68 posts
Earlier quoted context omitted.
Unless I'm mistaken, the site could be made reachable if only TPB would enable SSL between Cloudflare and their origin. Currently, Airtel is blocking based on the Host header. If they can't see the Host header, they'd have to instead know TPB's origin IP, which they wouldn't.
TLS transmits the host in cleartext.
In the article,testing the host header with different IP is done over http and not https.so i so it does not prove that Airtel is sniffing https traffic,isn't it ? >curl -H "Host: thepiratebay.org" http://192.30.253.112/ May be I missed something. Technically it is possible block the traffic by looking at SNI[1] or simply block the ipaddress if it belongs to the blocked site.I always thought that every ISPs had to fo…
I wonder if there's any proposals/extensions for moving SNI into the encrypted part of the communication. The initial certificate would have to be keyed to the IP address of the server, or maybe something from DNS, and probably there are other complications too, but it'd at least reduce the amount of plaintext information transmitted with each connection.
Here is what is happening: Cloudflare Indian datacentres are hosted on Airtel's networks. Airtel by default blocks and replaces(with a notice) Piratebay traffic all across it's network due to multiple court orders. Cloudflare India servers call the piratebay origin servers and ask for a master copy and Airtel instead gives the substitute page on all the http traffic from piratebay to cloudflare servers. Cloudflare se…
Funny that this comes from a company that talks of "building a truly transparent network", and says "... And we have nothing to hide." https://www.airtel.in/opennetwork/
I've never understood CloudFlare's position on this issue/feature. They generally do a great job at improving, caring and fighting for internet security, yet continue to offer a product (Flexible SSL) that they know is insecure: This option is not recommended if you have any sensitive information on your website. It should only be used as a last resort if you are not able to setup SSL on your own web server, but it i…
Earlier quoted context omitted.
Completely beside the point. Airtel is obviously looking at the HTTP host header.
Parent suggested deploying TLS from origin to Cloudflare would resolve this. Simply pointing out that it will not.
Earlier quoted context omitted.
Parent suggested deploying TLS from origin to Cloudflare would resolve this. Simply pointing out that it will not.
The post said that Cloudfare communicates with TPB via its IP address, not its host name, and that Airtel must be sniffing the hostname out of the header. So if they went full TLS Airtel would have to block the relevant IPs, which can be a little harder to find out, instead of the host.
Earlier quoted context omitted.
Funny that this comes from a company that talks of "building a truly transparent network", and says "... And we have nothing to hide." https://www.airtel.in/opennetwork/
Well, they are being transparent. Courts ordered them to block Pirate Bay, so they complied and put up a notice saying so.
usually you can tell what's going on inside of an organization just by observing what they do.
conversely, if you can't observe it, how would you know they're not being transparent (despite their claims)?
Earlier quoted context omitted.
Funny that this comes from a company that talks of "building a truly transparent network", and says "... And we have nothing to hide." https://www.airtel.in/opennetwork/
Well, they are being transparent. Courts ordered them to block Pirate Bay, so they complied and put up a notice saying so.
Earlier quoted context omitted.
Well, they are being transparent. Courts ordered them to block Pirate Bay, so they complied and put up a notice saying so.
court usually asks to block URLs, not to sniff data between PirateBay and CloudFlare.