You should consider using HTTPS :)
Haha yeah, I've been procrastinating for the last 5 years now
Identifying Airtel middleboxes that censor HTTPS traffic
31–40 of 130 posts
Re: Identifying Airtel middleboxes that censor HTTPS traffic
#32This is completely off-topic but the strike-through on links had me confused for a good few minutes. I was not clicking on those because I thought the link were not valid today and hence it has strike-through.
What strike-through?
Re: Identifying Airtel middleboxes that censor HTTPS traffic
#33I wonder what they intend to do (other than just blocking entire IP ranges of non-Indian hosting providers, which I would not be surprised by) when things increasingly move to TLS1.3 with ESNI.
Re: Identifying Airtel middleboxes that censor HTTPS traffic
#34Earlier quoted context omitted.
DuckDuckGo is blocked in India??
Yes, ISPs are blocking DDG. Airtel(ISP) is blocking DDG but HTTPS version is accessible. https://imgur.com/a/y7wnOjD
What reason could they have for blocking DDG? Is it easier to find pirated content there than on Google or something? That's my best guess. I can't imagine they'd block on behalf of a competitor or something.
Re: Identifying Airtel middleboxes that censor HTTPS traffic
#35I wonder what they intend to do (other than just blocking entire IP ranges of non-Indian hosting providers, which I would not be surprised by) when things increasingly move to TLS1.3 with ESNI.
Well, they could block TLS1.3 entirely (which would force hosts to drop down to 1.2 for connections)
GFC does this, I really hope it doesn't happen here
Re: Identifying Airtel middleboxes that censor HTTPS traffic
#36Does Airtel block TLS 1.3 with the encrypted SNI extension enabled? https://blog.cloudflare.com/encrypted-sni/
I haven't been able to test that yet, neither am aware of any research which answers that question. IMO the only way to do that would be to either (i) block the IP (high collateral blocking) or (ii) block TLS 1.3 itself (GFC does this). A major blocker in answering this is finding a potentially blocked website that also supports TLS 1.3
This is wrong. The ClientHello message is not encrypted in TLS 1.3, so, the client has to announce any extensions in plaintext. Thus the Great Firewall blocks connections which say they want to do encrypted SNI.
TLS 1.3 works fine in China, but if you use TLS 1.3 with the earlier proposed encrypted SNI draft it is blocked. The Great Firewall can't tell which name you actually wanted, but it can tell you're encrypting the SNI and block that.
With the currently proposed Encrypted Client Hello with a GREASE-style dummy ECH on all connections (so the "real" Hello is sometimes in an encrypted block and sometimes that encrypted block was just noise), China would still be able to choose to block all ECH-enabled connections since their presence is detectable. This would break everything, but China can choose to do that. What happens next is a policy question.
If you want to sneak past nation state snooping you need something else, that's not what TLS is for. The TOR project does not directly offer this either, but they can help you find out how to connect to TOR in a sneaky way if that's necessary for you.
Re: Identifying Airtel middleboxes that censor HTTPS traffic
#37On a meta level, this is one of the reasons why I tell every junior/entry level person I encounter in the ISP business the following: Ethics is important in network engineering. You can and should refuse to do things that cause measurable harm to the Internet. You should understand why certain things are bad, and should make a conscious choice not to aid and abet them.
It is regretful that organizations like NANOG, RIPE, ARIN, APNIC and others do not take a stronger stance (on a global geopolitical level) against censorship of the Internet, and attempts to create walled gardens and national firewalls.
The people who possess the equivalent of 'enable'/'configure' on the core routers of gigantic ASNs have real power to refuse to further harm the Internet.
We have seen a number of discussions on HN about ethics in software engineering. A quick search for posts with 'ethics' in the subject line turns up a number of things. In my opinion, ethics in the ISP, telecom and network engineering industry is equally important.
Re: Identifying Airtel middleboxes that censor HTTPS traffic
#38Earlier quoted context omitted.
I haven't been able to test that yet, neither am aware of any research which answers that question. IMO the only way to do that would be to either (i) block the IP (high collateral blocking) or (ii) block TLS 1.3 itself (GFC does this). A major blocker in answering this is finding a potentially blocked website that also supports TLS 1.3
Agreed and since TLS 1.3 is still work in progress the chances are slim that you will find a blocked website that meets your criteria. Great article, very accessible. Thanks!
TLS 1.3 was published as RFC 8446 back in 2018. I know it sometimes seems like this is still 2016 somehow, but it is not.
Re: Identifying Airtel middleboxes that censor HTTPS traffic
#39Earlier quoted context omitted.
Yes, ISPs are blocking DDG. Airtel(ISP) is blocking DDG but HTTPS version is accessible. https://imgur.com/a/y7wnOjD
What reason could they have for blocking DDG? Is it easier to find pirated content there than on Google or something? That's my best guess. I can't imagine they'd block on behalf of a competitor or something.
You never know. Could be a mistake where they were trying to block a certain path due to some search result of copyright infringement, but ended up banning the domain itself. One can only guess.
Reddit and Github have previously been temporarily banned in India due to similar "mistakes"
Re: Identifying Airtel middleboxes that censor HTTPS traffic
#40Earlier quoted context omitted.
Setting esni to enabled in Firefox partially works. But Airtel really, really wants to run scripts and show ads on blocked pages. Duckduckgo - https://i.postimg.cc/SqkRhpRC/Mozilla-Firefox-29-09-20-w-PA.... Pirate Bay - https://i.postimg.cc/qMmwMXVY/t-29-09-20-9-Dv.png
How do they inject stuff into HTTPS pages?
things that do stuff like this can't, they try whatever tricks are possible to push javascript or redirects to send the client browser to something non https, on port 80