An unidentifiable mechanism that helps bypass the Great Firewall of China
1–10 of 40 posts
Re: An unidentifiable mechanism that helps bypass the Great Firewall of China
#2I think anything looking to serve China should at least avoid hosting on github pages until encrypted SNI is widely available. When someone visits the online documentation at trojan-gfw.github.io, the FQDN is sent plaintext as part of HTTPS.
If the data is plainly on github.com (like the wiki), it would at least require an MITM to see what you are reading. Of course an MITM might be likely in China regardless.
It's also worth noting the Tor project has done a lot of work in this area: https://2019.www.torproject.org/docs/pluggable-transports.ht...
Re: An unidentifiable mechanism that helps bypass the Great Firewall of China
#3This page has more details than the "executive summary"
https://github.com/trojan-gfw/trojan/blob/master/docs/protoc...
As far as I understand it:
1. Client connects to the standard HTTPS port.
2. If it provides a packet with the right (encrypted) password, then the server acts as a SOCKS5 proxy.
3. If it doesn't provide the right password, the server responds like a normal HTTP server over the TLS connection.
Seems pretty clever, the hard bit is making sure the passwords don't leak and the firewall starts bombarding suspect servers with requests (brute-forcing passwords). Also if there are timing differences between a genuinely confused HTTP server and a "Trojan" server faking the confusion, they'd figure that out too.
Also, things like continuous back-and-forth between the client and a simple webserver would be suspicious, because usually clients send small requests in bursts, get the response, and activity would stop (it doesn't apply to streaming sites, obviously, but there the clients won't be as chatty either). So things like Skype calls might be easily recognized...
Re: An unidentifiable mechanism that helps bypass the Great Firewall of China
#4I think anything looking to serve China should at least avoid hosting on github pages until encrypted SNI is widely available. When someone visits the online documentation at trojan-gfw.github.io, the FQDN is sent plaintext as part of HTTPS. If the data is plainly on github.com (like the wiki), it would at least require an MITM to see what you are reading. Of course an MITM might be likely in China regardless. It's a…
> the FQDN is sent plaintext as part of HTTPS.
Can you please elaborate on that? domain name is sent after ssl handshake, no? Why is it sent plaintext?
Re: An unidentifiable mechanism that helps bypass the Great Firewall of China
#5I think anything looking to serve China should at least avoid hosting on github pages until encrypted SNI is widely available. When someone visits the online documentation at trojan-gfw.github.io, the FQDN is sent plaintext as part of HTTPS. If the data is plainly on github.com (like the wiki), it would at least require an MITM to see what you are reading. Of course an MITM might be likely in China regardless. It's a…
> the FQDN is sent plaintext as part of HTTPS. Can you please elaborate on that? domain name is sent after ssl handshake, no? Why is it sent plaintext?
He’s probably talking about the DNS lookup.
Re: An unidentifiable mechanism that helps bypass the Great Firewall of China
#6I think anything looking to serve China should at least avoid hosting on github pages until encrypted SNI is widely available. When someone visits the online documentation at trojan-gfw.github.io, the FQDN is sent plaintext as part of HTTPS. If the data is plainly on github.com (like the wiki), it would at least require an MITM to see what you are reading. Of course an MITM might be likely in China regardless. It's a…
> the FQDN is sent plaintext as part of HTTPS. Can you please elaborate on that? domain name is sent after ssl handshake, no? Why is it sent plaintext?
No. It's part of the cleartext SNI header. There is a proposal to encrypt the SNI information, but afaik, it's not yet widely used.
Re: An unidentifiable mechanism that helps bypass the Great Firewall of China
#7I think anything looking to serve China should at least avoid hosting on github pages until encrypted SNI is widely available. When someone visits the online documentation at trojan-gfw.github.io, the FQDN is sent plaintext as part of HTTPS. If the data is plainly on github.com (like the wiki), it would at least require an MITM to see what you are reading. Of course an MITM might be likely in China regardless. It's a…
> the FQDN is sent plaintext as part of HTTPS. Can you please elaborate on that? domain name is sent after ssl handshake, no? Why is it sent plaintext?
A given server might be hosting multiple websites, each with a different certificate (e.g. a CDN endpoint). It needs to know which certificate to present to the user. Therefore, during the initial TLS handshake, the client sends the server name (hostname) in plaintext in a field called the Server Name Indication (SNI). This is mandated by the fact that a certificate identifies a website, not a server.
This is distinct from the HTTP Host: header, which is sent inside the TLS session and therefore is encrypted along with the rest of the HTTP request.
Re: An unidentifiable mechanism that helps bypass the Great Firewall of China
#8I think anything looking to serve China should at least avoid hosting on github pages until encrypted SNI is widely available. When someone visits the online documentation at trojan-gfw.github.io, the FQDN is sent plaintext as part of HTTPS. If the data is plainly on github.com (like the wiki), it would at least require an MITM to see what you are reading. Of course an MITM might be likely in China regardless. It's a…
> the FQDN is sent plaintext as part of HTTPS. Can you please elaborate on that? domain name is sent after ssl handshake, no? Why is it sent plaintext?
No.
Cloudflare can explain it much better than me.
Re: An unidentifiable mechanism that helps bypass the Great Firewall of China
#9it took me a few minutes to figure out what "GFW" meant
Re: An unidentifiable mechanism that helps bypass the Great Firewall of China
#10it took me a few minutes to figure out what "GFW" meant
Global Force Wrestling, right? :D