We have SNI because it's needed to support virtual hosting, which we really only need because IPv4 addresses are scarce. If we could ever get to IPv6, SNI could be retired completely.
Identifying Airtel middleboxes that censor HTTPS traffic
71–80 of 130 posts
Re: Identifying Airtel middleboxes that censor HTTPS traffic
#72Earlier quoted context omitted.
Devil's advocate response: If these content blockers are just 'futile games of whack-a-mole', then why are you getting up-in-arms about their existence? Should be easy to avoid them if you truly believe what you say.
Stuff like what the UK is trying to do with a DNS based "black list" of bad things on the internet? Futile game of whack a mole. Authoritarian regime that forces all ISPs in a country to run networks funnelling all traffic through a government run central point where they do DPI and flow analysis on it (Chinese GFW for instance)? More of a real threat. For instance there is one ASN in Iran that has transit connection…
Well, yes, the original article is about funneling traffic through a centralised DPI content blocker, and not a trivial DNS blacklist.
Agreed, the UK's DNS filtering is definitely a simple to defeat by anybody whack-a-mole (e.g. thepiratebay.org is blocked? Oh no! Let's just google for Pirate Bay and pick one of the many, many unblocked mirrors)
But the kind of DPI, forced blocking utilised by these middleboxes is certainly a step above that, to the point that most people will not be (say) using measures like a VPN to bypass the block.
Re: Identifying Airtel middleboxes that censor HTTPS traffic
#73I wish the world would adopt tcpcrypt. SSL provides two services, encryption, and authentication.
tcpcrypt just does the encryption part. Once the connection is established, userspace on both sides can invoke an ioctl that provides a session nonce. If the nonce matches on both sides, the connection is not man-in-the-middled. It’s easy to confirm the nonce matches: Both sides sign it and send it to the other party.
This has two big advantages:
(1) operating systems can opportunistically encrypt traffic for unmodified legacy applications and network protocols, allowing the endpoints to detect mass surveillance without requiring any certificates.
(2) Like newer versions of SSL, it encrypts the information currently sent in cleartext in the SNI, preventing the type of censorship in the article.
Re: Identifying Airtel middleboxes that censor HTTPS traffic
#74Tor Project closely cooperates with The Open Observatory of Network Interference . OONI provides a standardized testsuit that automatically probes a wide range of websites for evaluating the censorship status in different parts of the world, and volunteers can contribute data by running an instance. But the objective of the project is only to identify governmental and ISP-wide censorships. And its capabilities for ch…
Oooo.
How does that compare with something like RIPE ATLAS? Is there a list of such monitoring projects somewhere?
Re: Identifying Airtel middleboxes that censor HTTPS traffic
#75Earlier quoted context omitted.
Because they create tools governments will use to restrict legitimate speech and freedoms. As history has shown they do.
...So, again, they can't be 'futile games of whack-a-mole', if they work, then?
I think it's more like taking the whack-a-mole bat and going and beating up people all around the arcade.
Re: Identifying Airtel middleboxes that censor HTTPS traffic
#76On a meta level, this is one of the reasons why I tell every junior/entry level person I encounter in the ISP business the following: Ethics is important in network engineering. You can and should refuse to do things that cause measurable harm to the Internet. You should understand why certain things are bad, and should make a conscious choice not to aid and abet them. It is regretful that organizations like NANOG, R…
This is a great position. As someone who works in SP on the vendor side, I think it's great someone is carrying the torch.
Re: Identifying Airtel middleboxes that censor HTTPS traffic
#77Earlier quoted context omitted.
All well and good, but are these kind of 'middleboxes' unequivocally unethical? For example, some ISPs might want to block highly illegal content - let's use the typical examples, e.g. child porn sites, malware domains, and so on. It's not inherently unethical (or, at least, there are plenty of reasonable people who would say it is ethical) to install a middlebox that will make it more difficult for users to access t…
> some ISPs might want to block highly illegal content There is no way - not even a theoretical way - to allow blocking of illegal content (for any definition of illegal) that won't allow for blocking of any other arbitrary content. Censorship is binary. You can accept either none of it, or all of it.
> There is no way - not even a theoretical way - to allow blocking of illegal content (for any definition of illegal) that won't allow for blocking of any other arbitrary content.
Well, there is: take the person or body that ultimately determines whether content is illegal, and have them review each request and proposed response and decide whether to allow the content through to the requester.
For slightly better scalability, have that body review all content outside of any request-response cycle before it can be published and sign any approved content, then block any content they haven’t signed.
Somewhat more generally, as long as the specific blocking methodology is itself part of the definition of what content is legal, any blocking method can meet the standard of “allows blocking illegal content without allowing blocking of other content”, since any content blocked by the method is, ipso facto, illegal.
Re: Identifying Airtel middleboxes that censor HTTPS traffic
#78On a meta level, this is one of the reasons why I tell every junior/entry level person I encounter in the ISP business the following: Ethics is important in network engineering. You can and should refuse to do things that cause measurable harm to the Internet. You should understand why certain things are bad, and should make a conscious choice not to aid and abet them. It is regretful that organizations like NANOG, R…
All well and good, but are these kind of 'middleboxes' unequivocally unethical? For example, some ISPs might want to block highly illegal content - let's use the typical examples, e.g. child porn sites, malware domains, and so on. It's not inherently unethical (or, at least, there are plenty of reasonable people who would say it is ethical) to install a middlebox that will make it more difficult for users to access t…
ISPs should help LEAs find illegal content all day long, but developing this sort of blocking technology is not the same thing, and neither is using it. There are legitimate uses of it though, namely in employers' networks, for example.
Re: Identifying Airtel middleboxes that censor HTTPS traffic
#79Earlier quoted context omitted.
Setting esni to enabled in Firefox partially works. But Airtel really, really wants to run scripts and show ads on blocked pages. Duckduckgo - https://i.postimg.cc/SqkRhpRC/Mozilla-Firefox-29-09-20-w-PA.... Pirate Bay - https://i.postimg.cc/qMmwMXVY/t-29-09-20-9-Dv.png
DuckDuckGo is blocked in India??
[deleted]
Re: Identifying Airtel middleboxes that censor HTTPS traffic
#80Earlier quoted context omitted.
Setting esni to enabled in Firefox partially works. But Airtel really, really wants to run scripts and show ads on blocked pages. Duckduckgo - https://i.postimg.cc/SqkRhpRC/Mozilla-Firefox-29-09-20-w-PA.... Pirate Bay - https://i.postimg.cc/qMmwMXVY/t-29-09-20-9-Dv.png
DuckDuckGo is blocked in India??
Not blocked for me on my home and mobile (Jio) connection. I think airtel is just crap. Just switch.