Does anyone know how they "shut down https"?
They drop all encrypted connections. This means no https, no IMAP over TLS and no SSH connections. (Im in Iran)
Is their filtering on a per TCP port basis? Or more advanced packet inspection?
Iran Shuts Down Major Websites and Https Protocol
11–20 of 151 posts
Re: Iran Shuts Down Major Websites and Https Protocol
#12Earlier quoted context omitted.
They drop all encrypted connections. This means no https, no IMAP over TLS and no SSH connections. (Im in Iran)
Is it just by port, or do they detect SSL traffic at any port, and then block it?
They have packet inspection and detect encrypted traffic on any port.
Re: Iran Shuts Down Major Websites and Https Protocol
#13Does anyone know how they "shut down https"?
They drop all encrypted connections. This means no https, no IMAP over TLS and no SSH connections. (Im in Iran)
How do they distinguish an encrypted connection from a non-encrypted connection? How do they know those indecipherable bits are an encrypted message vs. a part of an image or video? I suspect they just block domains and IPs and common ports or they sniff for common handshakes and key exchanges and kill those.
Re: Iran Shuts Down Major Websites and Https Protocol
#14Does anyone know how they "shut down https"?
They drop all encrypted connections. This means no https, no IMAP over TLS and no SSH connections. (Im in Iran)
So where would one find SSL over http implementation? You know, you send your usual POST to a proxy, only the body would be an actual request. Whole handshake could probably be done like this. Not even the proxy would (wouldn't have to) know the content. Encrypted body could be translated to valid XML for extra effect.
Re: Iran Shuts Down Major Websites and Https Protocol
#15Earlier quoted context omitted.
They drop all encrypted connections. This means no https, no IMAP over TLS and no SSH connections. (Im in Iran)
How do they distinguish an encrypted connection from a non-encrypted connection? How do they know those indecipherable bits are an encrypted message vs. a part of an image or video? I suspect they just block domains and IPs and common ports or they sniff for common handshakes and key exchanges and kill those.
Headers are encrypted too. Easy to decide I guess.
Re: Iran Shuts Down Major Websites and Https Protocol
#16Does anyone know how they "shut down https"?
They drop all encrypted connections. This means no https, no IMAP over TLS and no SSH connections. (Im in Iran)
So it sounds like you need a tool that adds low-entropy content to encrypted traffic to make it appear as if it's unencrypted?
What unencrypted protocols are allowed / common?
Re: Iran Shuts Down Major Websites and Https Protocol
#17Earlier quoted context omitted.
They drop all encrypted connections. This means no https, no IMAP over TLS and no SSH connections. (Im in Iran)
So where would one find SSL over http implementation? You know, you send your usual POST to a proxy, only the body would be an actual request. Whole handshake could probably be done like this. Not even the proxy would (wouldn't have to) know the content. Encrypted body could be translated to valid XML for extra effect.
I was just googling this and it looks like http://www.nocrew.org/software/httptunnel.html could handle that use case. (Another interesting idea I saw was to steg the data in cat pictures sent normally. I'm not sure if cat pictures are as big in Iran as in the US though such that even user-level analysis wouldn't be too suspicious if there's a ton of cats.)
Re: Iran Shuts Down Major Websites and Https Protocol
#18And here I was, about to ask HN to force SSL on the login page..
Re: Iran Shuts Down Major Websites and Https Protocol
#19Earlier quoted context omitted.
They drop all encrypted connections. This means no https, no IMAP over TLS and no SSH connections. (Im in Iran)
So where would one find SSL over http implementation? You know, you send your usual POST to a proxy, only the body would be an actual request. Whole handshake could probably be done like this. Not even the proxy would (wouldn't have to) know the content. Encrypted body could be translated to valid XML for extra effect.
I personally use ProxyTunnel which does the same for SSH. There are other ways for bypassing their filter, but nothing that would work for everyone.
Re: Iran Shuts Down Major Websites and Https Protocol
#20I am really passionate about this problem. We are currently working on the VPN solution for consumers and I could dedicate some of our servers for this to develop a VPN that would work when governments shut down encrypted connections. where should we start? it it even feasible to do a secured tunnel hidden in normal traffic undetected?