Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Domain fronting to be blocked on Azure

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 132 posts

Re: Tell HN: Domain fronting to be blocked on Azure

#51

Post by jesprenj »

tialaramex wrote: post #8

Some of the key people behind ECH (Encrypted Client Hello, work to hide SNI and other potentially sensitive information from the Client Hello in TLS) work for outfits which would be delivering basically the same functionality via ECH, such as Cloud companies and CDNs. Of course it is possible they don't intend to ever deploy this (but then they've wasted months of work which seems strange) or that their employers won…

How would this work? How is the name encrypted before the pubkey is known? I've seen that it uses DNS to fetch another pubkey, but there is no encrypted DNS (DNSSEC is signed DNS).

DNS-over-HTTPS is only used in the last-mile --- recursive resolver to client, not NS to NS, so the request is still sent in plain. Besides, DNS-over-HTTPS still requires ... TLS ...

Re: Tell HN: Domain fronting to be blocked on Azure

#52

Post by [deleted] »

codetrotter wrote: post #7

For anyone else wondering what domain fronting is: > Domain fronting is a technique for Internet censorship circumvention that uses different domain names in different communication layers of an HTTPS connection to discreetly connect to a different target domain than is discernable to third parties monitoring the requests and connections. https://en.wikipedia.org/wiki/Domain_fronting Cool, so we are bowing down furth…

[deleted]

Re: Tell HN: Domain fronting to be blocked on Azure

#54

Post by factsarelolz »

nibbleshifter wrote: post #11

Well, that sucks. What's worse is it is wankers in the "infosec" industry that pushed MS to do this (or at least, are taking credit for it).

Could you explain to me how "nibbleshifter" would use the "feature" for good?

What are you losing here "nibbleshifter"?

Why do you put infosec in scare quotes? Why are they "wankers"? Why scare quote and name call a legitimate profession? Because you have qualms?

Re: Tell HN: Domain fronting to be blocked on Azure

#55

Post by brookst »

lzooz wrote: post #17
_8j50 wrote: post #12

Earlier quoted context omitted.

That definition is incomplete. Threat actors also abuse this to hide their command and control infrastructure.

Threat actors use knives to stab people - we have to stop selling those.

You’re mixing up definition and policy.

If airlines banned knives and someone posted a definition of “knife” that suggested they are only used for eating food, it would be perfectly reasonable for a reply to point out that there are dangerous uses which might have led to the bad, and that it’s disingenuous to suggest that the ban was obviously motivated by a desire to make eating difficult.

It’s still fair to debate the balance of use and the merits of the ban, but IMO it is not reasonable to be upset over a more complete definition and context.

Re: Tell HN: Domain fronting to be blocked on Azure

#56

Post by exedore6 »

oneplane wrote: post #41
hedora wrote: post #36

Earlier quoted context omitted.

Generations of Native Americans beg to differ.

The native-american generations population probably doesn't intersect with the population of teenage knife-wielding attackers in london, which is what we're talking about. Then again, if you want to argue stone-age semantics: we can't ban anything and should just resort to continuous murder since rule-based society is too hard.

We just need to watch out for teenagers learning flint-knapping.

Re: Tell HN: Domain fronting to be blocked on Azure

#57

Post by sieabahlpark »

_8j50 wrote: post #42
gruez wrote: post #34

Earlier quoted context omitted.

>Keep in mind another name for censorship is moderation No it's not, see https://news.ycombinator.com/item?id=33446064 On most social media sites they're implemented the same way (ie. posts deleted/hidden from other users), but the objectives are totally different.

Let me rephrase then: what one calls censorship another might call moderation. The difference is authority to remove of hide content, if you have it then it is moderation. So, to be controversial for the sake or discussion then, Russia blocking Signal is moderation within the realm of their authority as is Iran blocking content they don't like or the US gov seizing domains. Either way, domain fronting was never an ex…

No post body was provided.

Re: Tell HN: Domain fronting to be blocked on Azure

#58

Post by teddyh »

jesprenj wrote: post #51
tialaramex wrote: post #8

Some of the key people behind ECH (Encrypted Client Hello, work to hide SNI and other potentially sensitive information from the Client Hello in TLS) work for outfits which would be delivering basically the same functionality via ECH, such as Cloud companies and CDNs. Of course it is possible they don't intend to ever deploy this (but then they've wasted months of work which seems strange) or that their employers won…

How would this work? How is the name encrypted before the pubkey is known? I've seen that it uses DNS to fetch another pubkey, but there is no encrypted DNS (DNSSEC is signed DNS). DNS-over-HTTPS is only used in the last-mile --- recursive resolver to client, not NS to NS, so the request is still sent in plain. Besides, DNS-over-HTTPS still requires ... TLS ...

I believe that the new “HTTPS” record in DNS will help with that (and other issues): https://datatracker.ietf.org/doc/draft-ietf-dnsop-svcb-https...

Re: Tell HN: Domain fronting to be blocked on Azure

#59

Post by skeeter2020 »

counttheforks wrote: post #30

How does domain fronting negatively affect microsoft? Why do they care? Is this all just about making peoples lifes worse?

Unfortunately the most common use-case of fronting is phishing and other scams that do make our lives worse. There's a legit anti-censorship angle but it is not the major use-case.

Re: Tell HN: Domain fronting to be blocked on Azure

#60

Post by zhfliz »

skeeter2020 wrote: post #59
counttheforks wrote: post #30

How does domain fronting negatively affect microsoft? Why do they care? Is this all just about making peoples lifes worse?

Unfortunately the most common use-case of fronting is phishing and other scams that do make our lives worse. There's a legit anti-censorship angle but it is not the major use-case.

how would domain fronting help with phishing?

your standard user agent (e.g. browser) will not send different values in SNI and HTTP Host header.

this is a deliberate action by the user agent to obscure the actual traffic destination.

this can of course be used both for censorship circumvention but also misleading corporate traffic inspection when TLS is not broken, though it's debatable whether that should work in the first place.

Post reply on HN