Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Identifying Airtel middleboxes that censor HTTPS traffic

iamkush.me

Post reply on HN
Print view View original

81–90 of 130 posts

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#81

Post by SSLy »

Santosh83 wrote: post #49
crazy_hombre wrote: post #47

Earlier quoted context omitted.

That's weird. I just get a 301 redirect to the HTTPS version when I visit http://duckduckgo.com .

I also get redirected to the HTTPS site. I think different ISPs block inconsistently.

Airtel is so big they use roaming for their customers. If you have a SIM from Bengaluru and go to Delhi you'll see the little R indicator. That suggests the Airtel business in each state manages at least parts of their network independently. And so the MitMs could be deployed non-uniformly.

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#82

Post by PowerBar »

hedora wrote: post #73

I wish the world would adopt tcpcrypt. SSL provides two services, encryption, and authentication. tcpcrypt just does the encryption part. Once the connection is established, userspace on both sides can invoke an ioctl that provides a session nonce. If the nonce matches on both sides, the connection is not man-in-the-middled. It’s easy to confirm the nonce matches: Both sides sign it and send it to the other party. Th…

That would still rely on

A) some kind of secret that only the server knows that the client can verify in order to ensure it's not trading nonces with the MITM.

B) A way for the client to ensure that the nonce isn't being passed through a second tcpcrypt session between the MITM and the server with the connection being in cleartext between the 2 tcpcrypt streams.

Currently the best supported method of implementing both A and B is certificates, which means you may as well use TLS.

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#83

Post by codezero »

airtelblock wrote: post #11
davidhyde wrote: post #4

Does Airtel block TLS 1.3 with the encrypted SNI extension enabled? https://blog.cloudflare.com/encrypted-sni/

Setting esni to enabled in Firefox partially works. But Airtel really, really wants to run scripts and show ads on blocked pages. Duckduckgo - https://i.postimg.cc/SqkRhpRC/Mozilla-Firefox-29-09-20-w-PA.... Pirate Bay - https://i.postimg.cc/qMmwMXVY/t-29-09-20-9-Dv.png

Heads up, that site was injected with a ton of malware/adware and redirects. Possibly their ad network got hosed, but that site doesn't seem safe unless you are locked down.

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#84

Post by searchableguy »

joosters wrote: post #70
commandlinefan wrote: post #66

Earlier quoted context omitted.

> some ISPs might want to block highly illegal content There is no way - not even a theoretical way - to allow blocking of illegal content (for any definition of illegal) that won't allow for blocking of any other arbitrary content. Censorship is binary. You can accept either none of it, or all of it.

At some level, everywhere has some form of censorship. For any country you could name, there are, or could easily be, content in any kind of media - books, audio, video, games, whatever, that is so abhorrent that it would either not be published, or would be shut down as soon as possible. So if you say censorship is binary, it's already here, and has been here for ever. But I would guess that few believe that censors…

Censorship is fine if it's opt in. I don't use facebook and censor myself from it. I opt in to use a pihole and adblocker. It filters many things I otherwise would see.

You can't often choose your ISP so this makes it extra important for censorship of any kind of to be opt in rather than forced.

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#85

Post by davidhyde »

tialaramex wrote: post #38
davidhyde wrote: post #6

Earlier quoted context omitted.

Agreed and since TLS 1.3 is still work in progress the chances are slim that you will find a blocked website that meets your criteria. Great article, very accessible. Thanks!

TLS 1.3 was published as RFC 8446 back in 2018. I know it sometimes seems like this is still 2016 somehow, but it is not.

That RFC is marked as "PROPOSED STANDARD" which is why I saw it as work in progress but you're right, that seems to be the end of the road for RFC's (for example RFC 6455 December 2011 (websockets) is also marked as proposed standard but this is what everyone has implemented)

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#86

Post by walrus01 »

kitteh wrote: post #69
walrus01 wrote: post #37

On a meta level, this is one of the reasons why I tell every junior/entry level person I encounter in the ISP business the following: Ethics is important in network engineering. You can and should refuse to do things that cause measurable harm to the Internet. You should understand why certain things are bad, and should make a conscious choice not to aid and abet them. It is regretful that organizations like NANOG, R…

It'd be nice if we could address some things like BCP38 (anti spoofing), RPKI, route filtering and folks who knowingly support infrastructure that's used for outbound ddos (c2s and regular hosts), spam and malware phishing. Plenty of hosting shops in US and Canada have these problems. That seems a bit more within our reach whereas an ISP in India is more than happy to pay a vendor to implement middlebox packet molest…

Absolutely agreed. It is really easy to be a shitty, lazy colocation/hosting/VPS hosting company. It is somewhat more effort and more difficult to be a proper one. Margins are so thin in the hosting business that it would be own version of a personal hell... I feel a lot better about operating symmetric gigabit last mile residential services.

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#87

Post by addicted »

walrus01 wrote: post #59
joosters wrote: post #58

Earlier quoted context omitted.

All well and good, but are these kind of 'middleboxes' unequivocally unethical? For example, some ISPs might want to block highly illegal content - let's use the typical examples, e.g. child porn sites, malware domains, and so on. It's not inherently unethical (or, at least, there are plenty of reasonable people who would say it is ethical) to install a middlebox that will make it more difficult for users to access t…

> let's use the typical examples, e.g. child porn sites, malware domains a futile game of whack-a-mole that only serves to make politicians feel good, and so they can claim they're "doing something" about social threats. malware domains can be adequately addressed at the application level through things such as: https://www.google.com/search?channel=fs&client=ubuntu&q=goo...

Whack a mole can be a highly successful strategy if there is a cost to having the mole appear somewhere else and the whacker has more resources than the one controlling the mole.

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#88

Post by duskwuff »

davidhyde wrote: post #6
justDankin wrote: post #5

Earlier quoted context omitted.

I haven't been able to test that yet, neither am aware of any research which answers that question. IMO the only way to do that would be to either (i) block the IP (high collateral blocking) or (ii) block TLS 1.3 itself (GFC does this). A major blocker in answering this is finding a potentially blocked website that also supports TLS 1.3

Agreed and since TLS 1.3 is still work in progress the chances are slim that you will find a blocked website that meets your criteria. Great article, very accessible. Thanks!

Cloudflare supports TLS 1.3 and ESNI. A lot of web sites will inherit ESNI support from that.

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#89

Post by mindslight »

commandlinefan wrote: post #71

We have SNI because it's needed to support virtual hosting, which we really only need because IPv4 addresses are scarce. If we could ever get to IPv6, SNI could be retired completely.

Sure, but the security vulnerability of unencrypted SNI is still present with IP based vhosts - the destination IP precisely identifies the site.

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#90

Post by michaelmrose »

joosters wrote: post #67
conception wrote: post #65

Earlier quoted context omitted.

Because they create tools governments will use to restrict legitimate speech and freedoms. As history has shown they do.

...So, again, they can't be 'futile games of whack-a-mole', if they work, then?

There are easily measures that will cause the closure of your small business if used against you personally that would not stop A drug dealer let alone all drug dealing.
Post reply on HN