Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Domain fronting to be blocked on Azure

news.ycombinator.com

Post reply on HN
Print view View original

101–110 of 132 posts

Re: Tell HN: Domain fronting to be blocked on Azure

#101

Post by andix »

matheusmoreira wrote: post #81
toast0 wrote: post #71

Earlier quoted context omitted.

Domain fronting leads to collateral damage in terms of blocking. If I really want to block X and X is using domain fronting to blend in with traffic on a given CDN, that CDN is going to get blocked. CDN customers that are having their stuff blocked because of that are not going to be happy, in general.

The goal is to get people to stop wanting to block X in the first place. Alternatively, make it so they have to block the entire internet along with X.

That doesn’t seem to match up with reality. A lot of legislations don’t care a lot about collateral damage. They just block. And other customers on the shared IP have to deal with it (move to another IP).

Re: Tell HN: Domain fronting to be blocked on Azure

#102

Post by mindslight »

sylens wrote: post #40
hedora wrote: post #37

Earlier quoted context omitted.

Can’t they use almost any read-write service for C2 though? “Because Security” arguments like this are increasingly used in place of “think of the children”.

How many read-write services can you use to redirect traffic to your C2 infrastructure while almost guaranteeing organizations will allow outbound connections to it and not look too closely at it?

Unless corporate firewalls have advanced to the point where they're DNS aware (eg the client queries www.microsoft.com and only then is allowed to contact those IPs), can one not just direct domain-fronting-style traffic to any VPS?

Re: Tell HN: Domain fronting to be blocked on Azure

#103

Post by hungryforeggs »

FiloSottile wrote: post #83
jgrahamc wrote: post #82

Earlier quoted context omitted.

I clearly remember it being an explicit decision though, not a bug mitigation To be clear, that's not correct we did do this to mitigate the bug. We were facing the bug that I described (the cross stream thing) showing up when Lantern was used. It was causing disruption to our service and customers were writing in. We were trying to understand what was happening and needed to stop it. One of the things we did to stop…

Maybe domain fronting was initially disabled as an unsuccessful attempt to fix that bug, that's possible and as I said I was not involved in that decision. Still, if that's the case, there was a policy decision afterwards to leave it disabled, because disabling it did not fix the bug, as you seem to agree. (Again, not elaborating on the bug publicly without permission, but I remember it turned out to have nothing to…

No post body was provided.

Re: Tell HN: Domain fronting to be blocked on Azure

#104

Post by mindslight »

jgrahamc wrote: post #74
FiloSottile wrote: post #33

Earlier quoted context omitted.

It's been many years, and I am still angry and disappointed by Cloudflare's decision to block domain fronting and drop Lantern as a customer. Lantern was one of the most effective Great Firewall bypass proxies at the time, and Cloudflare was expanding in China. (I was at Cloudflare at the time, but I don't have private information on the deliberation. I strongly considered quitting over it, maybe I should have, but I…

The insinuation is that somehow we had to stop domain fronting because “China”. That’s false. What actually happened was we started to get reports from customers that we were serving content from unrelated sites under their domains. Wasn’t happening a lot but for a reverse proxy that’s terrifying and about as bad as it can get. And what made it even weirder was that the domain fronting was connecting to other proxy s…

Could you not make domain fronting only work when the inside Host contains a specific component like start-frontin.example.com ? Then it will never work for a naive browser wanting to reach www.customer.com, but will work for non-browser clients deliberately trying to front.

Re: Tell HN: Domain fronting to be blocked on Azure

#105

Post by beauHD »

bagels wrote: post #100

For this domain fronting, do you need to control the 'innocuous' domain for this to even work? I can't hide my traffic behind someone else's domain, can I?

The thing about domain fronting, is you have to use a heavyweight corporate entity's domain because for a would-be censor, blocking those domains would be 'overblocking' and their censorship wouldn't really work. It would be like blocking a bunch of Amazon, Cloudflare, Google IPs. The Internet basically would be unusable, so they have to allow these corporate mega-giants in their allowlist.

Re: Tell HN: Domain fronting to be blocked on Azure

#106

Post by 8note »

_8j50 wrote: post #42
gruez wrote: post #34

Earlier quoted context omitted.

>Keep in mind another name for censorship is moderation No it's not, see https://news.ycombinator.com/item?id=33446064 On most social media sites they're implemented the same way (ie. posts deleted/hidden from other users), but the objectives are totally different.

Let me rephrase then: what one calls censorship another might call moderation. The difference is authority to remove of hide content, if you have it then it is moderation. So, to be controversial for the sake or discussion then, Russia blocking Signal is moderation within the realm of their authority as is Iran blocking content they don't like or the US gov seizing domains. Either way, domain fronting was never an ex…

I'd see them being different in terms of moderation acting as an allow list, and censorship acting as a deny list.

They also have different targets - moderation is about a forum, while censorship is about an idea

Re: Tell HN: Domain fronting to be blocked on Azure

#107

Post by mindslight »

_8j50 wrote: post #90
denton-scratch wrote: post #68

Earlier quoted context omitted.

> You can't write tech that overrides the authority of governments Really? Tor springs to mind.

Same. What's your point? VPNs also bypass government blocks. It's a cat and mouse game, they block vpns and guards as they see fit when they have a good reason to. Look at tor, if a country tls decrypts everything and blocks connections that can't be decrypted can it still bypass their blocks? Just because not every government is doing it does not mean Tor can't be blocked. Hell, countries allow-list connections to a…

> many in other countries consider it a form of neo-colonialism where you undermine their sovreignity and self-determination.

Only if by "their" you mean the ruling class, and by "self-determination" you mean their ability to control others. You can't really say their opinions represent the will of the people, especially when it's the people themselves ultimately choosing to engage in "illegal" activities.

And sure, "the will of the people" bakes in two very western individual/collectivist values. But as I get older I'm learning to not play the relativism card as much. We should certainly be critical of our culture - but to the point of making it better, not handicapping its spread.

Plus there's still a very easy answer for the poor oppressed tyrant who doesn't like freedom of communication - shut down all Internet connections.

Re: Tell HN: Domain fronting to be blocked on Azure

#108

Post by jtokoph »

msravi wrote: post #46

> will block any HTTP request that exhibits domain fronting behavior. How does the CDN detect this? The CDN only sees the encrypted domain, correct?

This also only really affective with a popular CDN because you’re leveraging the fact that a government won’t want to block an entire CDN. You can just do this yourself because your IP is just your IP and not shared with anyone important.

Re: Tell HN: Domain fronting to be blocked on Azure

#109

Post by ebfe1 »

counttheforks wrote: post #30

How does domain fronting negatively affect microsoft? Why do they care? Is this all just about making peoples lifes worse?

Unfortunately much like every nice thing on the internet, once it is being abused, it gets axed... Domain fronting (having Host header differ to SNI in TLS) is a powerful way a malware author could send payload into organisations.. imagine seeing seemingly legitimate traffic to azure.com but end up with malwaredomain.com/lulz.exe... Unless organisations are peeking into TLS, check Host header, response with MZ file header...There is nothing they can do to stop this.

Re: Tell HN: Domain fronting to be blocked on Azure

#110

Post by jiggawatts »

I suddenly understand why Azure has been dragging their feet on implementing TLS v1.3*. They're trying to avoid having to implement encrypted client hello, which would make their CDN products usable again by groups trying to hide information from government censorship and surveillance by mingling it amongst ordinary web pages.

*) Or at least one of the reasons, none of which are good.

Post reply on HN