Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

motherboard.vice.com

Post reply on HN
Print view View original

31–40 of 126 posts

Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

#31

Post by [deleted] »

enzolovesbacon wrote: post #27
samcheng wrote: post #21

Earlier quoted context omitted.

If a censor can't tell which specific parts of wikipedia someone is trying to access, then they will be more likely to simply block the entire site. HTTPS encrypts the URL and the content, but does not mask the DNS lookup nor the server being connected to.

Yes, I understand that. I mean, why don't these censors block the whole wikipedia.org access then? If they don't want their population to access a Wikipedia topic/article and can't block/determine if someone is accessing it, the easiest thing to do would be just block it right away. So why they won't do it? (PS: I'm in no way in favor of censorship, I'm just trying to understand such mindset)

[deleted]

Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

#32

Post by ars »

matt123 wrote: post #20
Edmond wrote: post #16

Earlier quoted context omitted.

For committed governments like China, TLS may just be an extra hurdle but they can get around it if they want. Basically China could simply implement a massive proxy that terminates TLS. If your internet traffic is going to flow through infrastructure that a curious government owns, then you'll know that they're monitoring the traffic but there is no way to keep them from seeing what you're doing.

No, TLS is not vulnerable to a MITM unless a) your client trusts the certificates issued by the attacker, or b) the attacker successfully forges the certificate of the website you are trying to visit. That is, assuming you don't click away your browser's security warning. https://security.stackexchange.com/questions/8145/does-https...

> TLS is not vulnerable to a MITM unless a) your client trusts the certificates issued by the attacker,

Or in other words it is vulnerable.

China can (and probably does) issue a certificate that all Chinese browsers must install, they can then do MITM https using their certificate to sign the new versions.

Companies do this routinely BTW. Since it's their equipment, it's considered just fine. (But be aware of it if you are using a company computer.)

Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

#33

Post by awinter-py »

Can an expert comment on side-channel attacks on HTTPS and whether they're less viable on HTTP/2?

My assumption is that because wikipedia has a known plaintext and a known link graph it's plausible to identify pages with some accuracy and either block them or monitor who's reading what.

I also assume that the traffic profile of editing looks different from viewing.

Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

#34

Post by beefsack »

zeta0134 wrote: post #15
Amulet- wrote: post #11

Earlier quoted context omitted.

The article says Although countries like China, Thailand and Uzbekistan were still censoring part or all of Wikipedia by the time the researchers wrapped up their study The top comment might be asking about the "were still censoring part" of the article.

Oh, huh! I missed that entirely, now I'm curious too. HTTPS should make that difficult, but China has been known to employ all sorts of weird shenanigans-- perhaps they're running a "trusted' MitM as part of the great firewall? I know that certain companies (like Google and Microsoft) will actively censor themselves to continue to operate within China, but I figured Wikipedia would be against that practice on princip…

Nitpick: Google opted to pull out of mainland China instead of self-censoring. They moved Chinese operations to Hong Kong, but operate uncensored there.

Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

#35

Post by dTal »

enzolovesbacon wrote: post #19

Critics of this plan argued that this move would just result in more total censorship of Wikipedia and that access to some information was better than no information at all I'm no critic of this plan but I still don't understand why this wouldn't result in more total censorship. Someone explain please?

Because Wikipedia is too useful. Note that it required a certain self-confidence that this was the case for Wikipedia to implement this strategy. And it's self-fulfilling - if Wikipedia allowed itself to be censored, then it would have fewer contributors and its usefulness would suffer.

There's a rather interesting analogy to be made with the GPL here. Critics argue that companies shy away from it because they cannot control it. Yet its entire goal is to not be controlled, and it draws its strength from the conviction that the body of GPL software is too useful to ignore. And again, that's self-fulfilling.

It takes courage, but it's important to know when you have the power to say "all of me, or none of me".

Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

#36

Post by mirimir »

foota wrote: post #29
enzolovesbacon wrote: post #27

Earlier quoted context omitted.

Yes, I understand that. I mean, why don't these censors block the whole wikipedia.org access then? If they don't want their population to access a Wikipedia topic/article and can't block/determine if someone is accessing it, the easiest thing to do would be just block it right away. So why they won't do it? (PS: I'm in no way in favor of censorship, I'm just trying to understand such mindset)

Probably because they recognize the utility of Wikipedia.

As with GitHub.

Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

#37

Post by dragonwriter »

dTal wrote: post #35
enzolovesbacon wrote: post #19

Critics of this plan argued that this move would just result in more total censorship of Wikipedia and that access to some information was better than no information at all I'm no critic of this plan but I still don't understand why this wouldn't result in more total censorship. Someone explain please?

Because Wikipedia is too useful. Note that it required a certain self-confidence that this was the case for Wikipedia to implement this strategy. And it's self-fulfilling - if Wikipedia allowed itself to be censored, then it would have fewer contributors and its usefulness would suffer. There's a rather interesting analogy to be made with the GPL here. Critics argue that companies shy away from it because they cannot…

> Critics argue that companies shy away from it because they cannot control it.

No, they don't. Critics point out that companies avoid it, and non-critics ascribe this avoidance to "can't control it", which is false, because nothing under a third-party copyright under any non-exclusive license can be controlled by the licensee, but businesses avoiding the GPL don't generally avoid all non-exclusive licenses.

Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

#39

Post by matt4711 »

zeta0134 wrote: post #15
Amulet- wrote: post #11

Earlier quoted context omitted.

The article says Although countries like China, Thailand and Uzbekistan were still censoring part or all of Wikipedia by the time the researchers wrapped up their study The top comment might be asking about the "were still censoring part" of the article.

Oh, huh! I missed that entirely, now I'm curious too. HTTPS should make that difficult, but China has been known to employ all sorts of weird shenanigans-- perhaps they're running a "trusted' MitM as part of the great firewall? I know that certain companies (like Google and Microsoft) will actively censor themselves to continue to operate within China, but I figured Wikipedia would be against that practice on princip…

I think china blocks zh.wikipedia.org but all other languages are not blocked.

Re: Wikipedia’s Switch to HTTPS Has Successfully Fought Government Censorship

#40

Post by cyphar »

dragonwriter wrote: post #37
dTal wrote: post #35

Earlier quoted context omitted.

Because Wikipedia is too useful. Note that it required a certain self-confidence that this was the case for Wikipedia to implement this strategy. And it's self-fulfilling - if Wikipedia allowed itself to be censored, then it would have fewer contributors and its usefulness would suffer. There's a rather interesting analogy to be made with the GPL here. Critics argue that companies shy away from it because they cannot…

> Critics argue that companies shy away from it because they cannot control it. No, they don't. Critics point out that companies avoid it, and non-critics ascribe this avoidance to "can't control it", which is false, because nothing under a third-party copyright under any non-exclusive license can be controlled by the licensee, but businesses avoiding the GPL don't generally avoid all non-exclusive licenses.

I think "can't control" refers to sublicensing in this context. People's dislike over copyleft stems from wanting to make software proprietary (or proprietary-friendly through lax licensing). Copyleft removes that control, and the GPL's main strength is that it is so ubiquitous that you cannot practically avoid it (in most cases).
Post reply on HN