111–120 of 126 posts
Earlier quoted context omitted.
Except China has their own browser made by a state controlled company that a lot of people use. This browser is already demonstrated to accept the government CA and ordinary people in China don't care.
If some websites will break down in this browser while working in other browsers, people will probably notice.
It won't last, at least for China. Their government is working on a clone of wiki, scheduled for 2018[0]. Once that's done they'll likely completely ban the original. Wikipedia publishes database dumps every couple of days[1]. So it shouldn't be that expensive for smaller governments to create and host their own censored mirror. You'd maintain a list of banned and censored articles, then pull from wikipedia once a mo…
I thought China already blocked https, so switching to https only would effectively ban/block wikipedia.
I was using https://www.dotcom-tools.com/website-speed-test.aspx?se=1403....
Earlier quoted context omitted.
If some websites will break down in this browser while working in other browsers, people will probably notice.
Why would they break? If the MITM certificate is trusted at the local level, everything should work fine in their browsers.
Earlier quoted context omitted.
I thought China already blocked https, so switching to https only would effectively ban/block wikipedia.
I don't believe so. I just tested one of my own websites, which only serves over HTTPS, from Hong Kong (admittedly a special case), and Beijing. It worked fine from both. Surprisingly, because I thought Adsense was blocked, an advert even appeared on the Beijing screenshot. On the other hand, it reported as temporarily unavailable from Shanghai. I was using https://www.dotcom-tools.com/website-speed-test.aspx?se=1403…
Can an expert comment on side-channel attacks on HTTPS and whether they're less viable on HTTP/2? My assumption is that because wikipedia has a known plaintext and a known link graph it's plausible to identify pages with some accuracy and either block them or monitor who's reading what. I also assume that the traffic profile of editing looks different from viewing.
The government could force pc manufacturers to deploy a root CA that they control and then do a MITM proxy to read everything the user is doing, they could also redirect wikipedia domain to another domain that just acts as a reverse proxy and deploy a legit cert on that other site
Earlier quoted context omitted.
I don't believe so. I just tested one of my own websites, which only serves over HTTPS, from Hong Kong (admittedly a special case), and Beijing. It worked fine from both. Surprisingly, because I thought Adsense was blocked, an advert even appeared on the Beijing screenshot. On the other hand, it reported as temporarily unavailable from Shanghai. I was using https://www.dotcom-tools.com/website-speed-test.aspx?se=1403…
Okay, thanks for testing for me. When I lived in Shanghai 5 yrs ago, I had a lot of trouble connecting to https and whenever possible, I would try and connect unencrypted.
There were few censored pages on the Turkish Wikipedia when it was on HTTP. They were the "vagina" article and election prediction article. Only those pages were censored. Last month there were some articles on the English Wikipedia about ISIS-Erdoğan (I don't care true or not). Then they have blocked all Wikipedia (all languages). Because they were unable to block those individual pages.
Fired up my VPN, accessed the page, thank you very much.
"The Net interprets censorship as damage and routes around it." - John Gilmore
Earlier quoted context omitted.
> In practice, governments will probably just MITM the connection If they routinely MITM connections they will quickly be found out, and the CA would be removed from browsers.
Except China has their own browser made by a state controlled company that a lot of people use. This browser is already demonstrated to accept the government CA and ordinary people in China don't care.
Earlier quoted context omitted.
Except China has their own browser made by a state controlled company that a lot of people use. This browser is already demonstrated to accept the government CA and ordinary people in China don't care.
What's the browser, or do you mean Opera?
TIL: HTTPS encrypts the URL.
I think it's a fun/educational process to interact with some daemons over telnet. You can telnet into port 80 and create an HTTP request, for instance. Certification negotiation happens before the GET request happens, which means that the "URL" (or, rather, everything after the domain) is encrypted. You can also see some of this process with curl. So: curl -vvv https://www.google.com/
WireShark also provides a good visualization of the HTTPS negotiation process and the various layers of HTTPS requests and responses. It does take a lot more to figure out than telnet though.