Live data from Hacker News

Identifying Airtel middleboxes that censor HTTPS traffic

iamkush.me

11–20 of 130 posts

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#11

Does Airtel block TLS 1.3 with the encrypted SNI extension enabled? https://blog.cloudflare.com/encrypted-sni/

Setting esni to enabled in Firefox partially works.

But Airtel really, really wants to run scripts and show ads on blocked pages.

Duckduckgo - https://i.postimg.cc/SqkRhpRC/Mozilla-Firefox-29-09-20-w-PA....

Pirate Bay - https://i.postimg.cc/qMmwMXVY/t-29-09-20-9-Dv.png

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#12

Duckduckgo is blocked in India with Airtel. HTTP url refuses to connect. I have to manually type https://duckduckgo.com to connect. https://i.postimg.cc/SqkRhpRC/Mozilla-Firefox-29-09-20-w-PA....

Yeah there was a huge outcry about it on Twitter some time back.

P.S. From the screenshot, it looks like you're trying to connect to [http]://duck.., hence shifting to https works.

This also hints towards a mixture of plain old http censorship and https censorship, which Airtel (in fact all ISPs) do randomly

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#13

Duckduckgo is blocked in India with Airtel. HTTP url refuses to connect. I have to manually type https://duckduckgo.com to connect. https://i.postimg.cc/SqkRhpRC/Mozilla-Firefox-29-09-20-w-PA....

Yeah there was a huge outcry about it on Twitter some time back. P.S. From the screenshot, it looks like you're trying to connect to [http]://duck.., hence shifting to https works. This also hints towards a mixture of plain old http censorship and https censorship, which Airtel (in fact all ISPs) do randomly

This is not about the block a month ago. This is a new block.

When it was blocked a month ago, there was no notice. Now, there is a notice that it is a TRAI order. usually seen on sites that the govt themselves ask to block (piratebay, torrentz.eu, etc)

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#15

Earlier quoted context omitted.

Yeah there was a huge outcry about it on Twitter some time back. P.S. From the screenshot, it looks like you're trying to connect to [http]://duck.., hence shifting to https works. This also hints towards a mixture of plain old http censorship and https censorship, which Airtel (in fact all ISPs) do randomly

This is not about the block a month ago. This is a new block. When it was blocked a month ago, there was no notice. Now, there is a notice that it is a TRAI order. usually seen on sites that the govt themselves ask to block (piratebay, torrentz.eu, etc)

[deleted]

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#16

Does Airtel block TLS 1.3 with the encrypted SNI extension enabled? https://blog.cloudflare.com/encrypted-sni/

Setting esni to enabled in Firefox partially works. But Airtel really, really wants to run scripts and show ads on blocked pages. Duckduckgo - https://i.postimg.cc/SqkRhpRC/Mozilla-Firefox-29-09-20-w-PA.... Pirate Bay - https://i.postimg.cc/qMmwMXVY/t-29-09-20-9-Dv.png

DuckDuckGo is blocked in India??

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#17
This is pretty clever! The reset within airtel_103.224.212.222_fullhd720.com.pcap arrives with IP time-to-live of fifty-seven while the segment carrying synchronize | acknowledge flags arrived with a time-to-live of forty-four. So without any active probing, and some educated guesses around default IP time-to-live values @ 1<<[6..8] you could could conclude that the reset originated fourteen hops closer to the capture than other packets in same five-tuple defined "flow".

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#18
Tor Project closely cooperates with The Open Observatory of Network Interference. OONI provides a standardized testsuit that automatically probes a wide range of websites for evaluating the censorship status in different parts of the world, and volunteers can contribute data by running an instance.

But the objective of the project is only to identify governmental and ISP-wide censorships. And its capabilities for checking protocol-level censorship techniques are rather limited [0]. Perhaps we need a similar tool or fork for probing middleboxes and censorship in private networks.

[0] https://ooni.org/nettest/

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#19

This is pretty clever! The reset within airtel_103.224.212.222_fullhd720.com.pcap arrives with IP time-to-live of fifty-seven while the segment carrying synchronize | acknowledge flags arrived with a time-to-live of forty-four. So without any active probing, and some educated guesses around default IP time-to-live values @ 1<<[6..8] you could could conclude that the reset originated fourteen hops closer to the captur…

Yes! That's a great observation

However, the reason I went for probing the entire path is because the TTL itself can be spoofed

Re: Identifying Airtel middleboxes that censor HTTPS traffic

#20
post #16

Earlier quoted context omitted.

Setting esni to enabled in Firefox partially works. But Airtel really, really wants to run scripts and show ads on blocked pages. Duckduckgo - https://i.postimg.cc/SqkRhpRC/Mozilla-Firefox-29-09-20-w-PA.... Pirate Bay - https://i.postimg.cc/qMmwMXVY/t-29-09-20-9-Dv.png

DuckDuckGo is blocked in India??

Nope
Post reply on HN