TLS 1.3 Is an Opportunity for Amazon, Google and Microsoft to End Censorship
privateinternetaccess.com
TLS 1.3 Is an Opportunity for Amazon, Google and Microsoft to End Censorship
1–10 of 102 posts
Re: TLS 1.3 Is an Opportunity for Amazon, Google and Microsoft to End Censorship
#2I'm sure that many countries will block Amazon, Google and whatever else if needed. It won't end censorship, it would make life of ordinary people there even harder.
Re: TLS 1.3 Is an Opportunity for Amazon, Google and Microsoft to End Censorship
#3> Currently, SNI in TLS 1.2 has a flaw that allows censors to differentiate between a “real” service and a “fake” service if they are savvy enough to figure it out. Interestingly, SNI in TLS 1.3 fixes this problem by hiding all of the information about the service behind encryption.
Isn't this (Encrypted SNI) was the one been extensively discussed here: https://news.ycombinator.com/item?id=17538390 ?
This is great. I hope CDNs like Cloudflare etc deploy it ASAP. Also, deprecate previous TLS versions as ASAP so it can be more effective.
Re: TLS 1.3 Is an Opportunity for Amazon, Google and Microsoft to End Censorship
#4> The problem is that Amazon Web Services and Google Cloud currently do not allow domain fronting. Only Microsoft Azure does.
Is there an official word from Microsoft that they allow it or just "they didn't ban it yet"?
Re: TLS 1.3 Is an Opportunity for Amazon, Google and Microsoft to End Censorship
#5> Currently, SNI in TLS 1.2 has a flaw that allows censors to differentiate between a “real” service and a “fake” service if they are savvy enough to figure it out. Interestingly, SNI in TLS 1.3 fixes this problem by hiding all of the information about the service behind encryption. Isn't this (Encrypted SNI) was the one been extensively discussed here: https://news.ycombinator.com/item?id=17538390 ? This is great. I…
That was my thought reading the article. https://tools.ietf.org/html/draft-ietf-tls-sni-encryption-03 indicates this is not a solved problem for TLS 1.3, and the key in DNS solution is still in the experimental phase (though compatible with TLS 1.3)
This article is premature?
Re: TLS 1.3 Is an Opportunity for Amazon, Google and Microsoft to End Censorship
#6I'm sure that many countries will block Amazon, Google and whatever else if needed. It won't end censorship, it would make life of ordinary people there even harder.
The first reasonable thing I read on this subject.
Re: TLS 1.3 Is an Opportunity for Amazon, Google and Microsoft to End Censorship
#7I'm sure that many countries will block Amazon, Google and whatever else if needed. It won't end censorship, it would make life of ordinary people there even harder.
The idea here is, quite obviously, that blocking these services, plus everything that runs on their cloud infrastructure, is too high a price to pay.
That mechanism is well established, if only by these governments previously being unable to just ban internet access outright, even though it was universally perceived as a threat to their control on the flow of information.
Re: TLS 1.3 Is an Opportunity for Amazon, Google and Microsoft to End Censorship
#8> If Google Cloud, Amazon Web Services, and Microsoft Azure allow domain fronting with TLS 1.3, censorship countries like China are faced with a binary choice.
This sounds inaccurate to me. If encrypted SNI is applied, the middleman should not be able to figure out which domain you are connecting to, without interrupting the connection. Domain fronting is a technique for prior TLS which you had to disguise the hostname.
Re: TLS 1.3 Is an Opportunity for Amazon, Google and Microsoft to End Censorship
#9This article is unfortunately inaccurate. TLS1.3 does not include encrypted SNI. Encrypted SNI is still being worked on by the TLS working group, and isn't in a deployable state.
Re: TLS 1.3 Is an Opportunity for Amazon, Google and Microsoft to End Censorship
#10Seeing how search results are being censored in “free countries” due to things like the DMCA and The Right To Be Forgotten, maybe we shouldn’t look to private companies to fix this issue.