Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TLS 1.3 Is an Opportunity for Amazon, Google and Microsoft to End Censorship

privateinternetaccess.com

Post reply on HN
Print view View original

41–50 of 102 posts

Re: TLS 1.3 Is an Opportunity for Amazon, Google and Microsoft to End Censorship

#41

Post by yardstick »

tialaramex wrote: post #17
yardstick wrote: post #12

Encrypted SNI is great for individual privacy but terrible for business/corporate security. At the moment it is possible to MITM proxy (without the possibility decryption) to inspect the SNI and determine if the host is allowed, and if so the proxy does its own IP resolution and transparently proxies/forwards the TCP traffic. Ie it never engages in the TLS session. This is useful for restricting access from a LAN to…

No, it makes no practical difference to "business/corporate security" but it's terrible for lazy and incompetent people who wanted to look as though they were effective. The "full MITM proxy" you mention is, and always has been, the only defined way to make this work. The cheaper, half-arsed solutions you describe earlier cause everybody else pain (socialising costs while privatizing profit) and often don't actually…

Which independent measures do you refer to? This is for non-decrypting MITM proxies that only use the SNI to validate they are going to the right domain and proxy the TCP data between the two. What’s the attack vector?

Re: TLS 1.3 Is an Opportunity for Amazon, Google and Microsoft to End Censorship

#42

Post by yardstick »

growse wrote: post #14
yardstick wrote: post #12

Encrypted SNI is great for individual privacy but terrible for business/corporate security. At the moment it is possible to MITM proxy (without the possibility decryption) to inspect the SNI and determine if the host is allowed, and if so the proxy does its own IP resolution and transparently proxies/forwards the TCP traffic. Ie it never engages in the TLS session. This is useful for restricting access from a LAN to…

Aren't businesses that are serious about meeting their legal/regulatory obligations for controlling internet access already using full MITM TLS interception with their own CAs? Given a malicious actor can register any old domain and get a cert for it very easily, I'm not sure what particular threat blocking TLS connections based just on the SNI is actually protecting you from.

Think of all the small 1-2 employee businesses / mom & pop businesses etc that take credit cards. They have no dedicated IT person. They’d be lucky to have a dedicated LAN for payments (a PCI DSS requirement). Increasing the barriers to compliance for these people is not a good thing. In practice they will just close their eyes and pretend nothing is wrong, or they will just pay the fine charges by the banks for non compliance— which doesn’t improve your credit card security at all.

You can’t tell all these small businesses they can’t take card payments, and you can’t make an already tough job harder, more complex and more expensive without an associated drop in compliance.

Re: TLS 1.3 Is an Opportunity for Amazon, Google and Microsoft to End Censorship

#43

Post by dagenix »

ctz wrote: post #9

This article is unfortunately inaccurate. TLS1.3 does not include encrypted SNI. Encrypted SNI is still being worked on by the TLS working group, and isn't in a deployable state.

I believe this article is talking about domain fronting, not the use of encrypted SNI. With domain fronting, you connect to one service, say, amazon.com and put amazon.com in the SNI field. However, once you have a secure connection, you then tell Amazon that you really want to talk to some other website and Amazon routes the connection appropriately. To an outside observer, however, it just looks like you are talking to amazon.com and the only thing that can be done to stop this would be to block all the servers that handle that site.

Re: TLS 1.3 Is an Opportunity for Amazon, Google and Microsoft to End Censorship

#44

Post by willglynn »

remoteorbust wrote: post #38
ctz wrote: post #9

This article is unfortunately inaccurate. TLS1.3 does not include encrypted SNI. Encrypted SNI is still being worked on by the TLS working group, and isn't in a deployable state.

Thanks for the heads up. I've made some proxy software that routes on SNI. If TLS1.3 drops SNI then I feel like that will accelerate ipv6 adoption because we're going to need a shitload more IP addresses.

TLS 1.3 still has SNI. SNI still transmits server names in the clear, just like always. This enables e.g. blocking a specific hostname without blocking an entire CDN, particularly now that CDNs are trying to stop domain fronting.

Some people were working on encrypted SNI during TLS 1.3's development, so that TLS could encrypt server names sort of like how it encrypts all later traffic. Encrypted SNI didn't make it into TLS 1.3.

Re: TLS 1.3 Is an Opportunity for Amazon, Google and Microsoft to End Censorship

#45

Post by joshstrange »

ufmace wrote: post #26

Why would anybody think that Amazon, Google, or Microsoft are against censorship? Recent events have demonstrated that they love them some censorship, when they do it. Witness the case of gab.ai - Google was happy to pull their app from the Play store. Microsoft didn't mind at all threatening to shut down their Azure account unless they censored a post. The Azure case is particularly amazing. I can't believe the tech…

No no no, you don't get to throw out gab.ai as an example without expanding on what they wanted censored. For those who don't know what was censored I'll link it as I will not be reposting it: https://heavy.com/news/2018/08/microsoft-threatened-gab-shut...

You muddle the waters greatly when you pretend it was just some free speech issue (Newsflash: FREE SPEECH DOES NOT EXTEND TO NON-GOVERNMENT ENTITIES),

Re: TLS 1.3 Is an Opportunity for Amazon, Google and Microsoft to End Censorship

#46

Post by djsumdog »

jonstokes wrote: post #31
ufmace wrote: post #26

Why would anybody think that Amazon, Google, or Microsoft are against censorship? Recent events have demonstrated that they love them some censorship, when they do it. Witness the case of gab.ai - Google was happy to pull their app from the Play store. Microsoft didn't mind at all threatening to shut down their Azure account unless they censored a post. The Azure case is particularly amazing. I can't believe the tech…

AWS has absolutely taken down websites because they didn't like what was on them, just recently, in fact: https://freebeacon.com/issues/gun-rights-activists-posted-gu... I'm a journalist and have seen a screencap of the takedown that Amazon issued to the Firearms Policy Coalition, which started and maintains the censored site (CodeIsFreeSpeech.com). The takedown erroneously cited a temporary restraining order issued…

I wrote about this last year:

https://fightthefuture.org/article/the-new-era-of-corporate-...

It's easy to side with CloudFlair when they go against a site like The Daily Stormer (Which is so out there it might just fall into Poe's Law).

The fact is that most decent hosting is only available in a handful of industries. Even the CF CEO has had misgivings of his decision and it gets us into a really questionable space.

Platforms should be free to do what they want right? They should be able to deny customers .. just like an airplane company should be allowed to keep people who crazy political opinions from boarding plans right? .. oh and black people too. Oh wait..what?

The freedom of speech in the US is pretty limited to government censorship. But we don't let businesses do whatever they want. They can't keep a certain ethnic group from eating at their restaurant, and in many states they can't choose if their venue allows smoking. The big question is, does speech need to fit into this same framework?

With the recent child protection act that gutted craigslist and took down backpage (an act that is leading to more violence against sex workers in the US and an act that the EFF and ACLU are actively fighting as being unconstitutional), we see the US government holding content hosting companies liable for the criminal actions of their user base. That is disturbing and already a form of government control over what customers a business is allowed to have.

It'd be one thing if censored sites could just go to another provider, but there are only a couple of big providers and their mass has the ability to crush anything they find questionable.

Re: TLS 1.3 Is an Opportunity for Amazon, Google and Microsoft to End Censorship

#47

Post by Karunamon »

joshstrange wrote: post #45
ufmace wrote: post #26

Why would anybody think that Amazon, Google, or Microsoft are against censorship? Recent events have demonstrated that they love them some censorship, when they do it. Witness the case of gab.ai - Google was happy to pull their app from the Play store. Microsoft didn't mind at all threatening to shut down their Azure account unless they censored a post. The Azure case is particularly amazing. I can't believe the tech…

No no no, you don't get to throw out gab.ai as an example without expanding on what they wanted censored. For those who don't know what was censored I'll link it as I will not be reposting it: https://heavy.com/news/2018/08/microsoft-threatened-gab-shut... You muddle the waters greatly when you pretend it was just some free speech issue (Newsflash: FREE SPEECH DOES NOT EXTEND TO NON-GOVERNMENT ENTITIES),

Free speech is a principle that transcends law. They might have no legal requirement to uphold it, as our government does, but these moves were absolutely censorship and absolutely counter to the principle of free speech.

The odiousness of the words in question don't factor into it.

Re: TLS 1.3 Is an Opportunity for Amazon, Google and Microsoft to End Censorship

#48

Post by repolfx »

djsumdog wrote: post #46
jonstokes wrote: post #31

Earlier quoted context omitted.

AWS has absolutely taken down websites because they didn't like what was on them, just recently, in fact: https://freebeacon.com/issues/gun-rights-activists-posted-gu... I'm a journalist and have seen a screencap of the takedown that Amazon issued to the Firearms Policy Coalition, which started and maintains the censored site (CodeIsFreeSpeech.com). The takedown erroneously cited a temporary restraining order issued…

I wrote about this last year: https://fightthefuture.org/article/the-new-era-of-corporate-... It's easy to side with CloudFlair when they go against a site like The Daily Stormer (Which is so out there it might just fall into Poe's Law). The fact is that most decent hosting is only available in a handful of industries. Even the CF CEO has had misgivings of his decision and it gets us into a really questionable space.…

It's actually worse than there being only a couple of big providers.

The problem is that the same sort of people who are trying to shut down sites through legal pressure tactics against Amazon, Google etc are absolutely happy to use illegal tactics too. In particular once sites are booted off large providers onto smaller ones or self hosted sites, that's when the DDoS attacks start. Infowars already saw one, for instance. How many firms can sink large DDoS attacks without needing to kick out the target? Not many.

If a pressure group or activist employee base can get content off CloudFlare, Google, Amazon and Microsoft then DDoS-wielding ideological zealots will do the rest and then the site is gone for good.

Where does speech go then?

It's a very dangerous game for the people at these content platforms to play. I don't see Republicans sitting back doing nothing as their worldview and voter base is systematically wiped off the internet. Legislation seems likely.

Re: TLS 1.3 Is an Opportunity for Amazon, Google and Microsoft to End Censorship

#49

Post by repolfx »

joshstrange wrote: post #45
ufmace wrote: post #26

Why would anybody think that Amazon, Google, or Microsoft are against censorship? Recent events have demonstrated that they love them some censorship, when they do it. Witness the case of gab.ai - Google was happy to pull their app from the Play store. Microsoft didn't mind at all threatening to shut down their Azure account unless they censored a post. The Azure case is particularly amazing. I can't believe the tech…

No no no, you don't get to throw out gab.ai as an example without expanding on what they wanted censored. For those who don't know what was censored I'll link it as I will not be reposting it: https://heavy.com/news/2018/08/microsoft-threatened-gab-shut... You muddle the waters greatly when you pretend it was just some free speech issue (Newsflash: FREE SPEECH DOES NOT EXTEND TO NON-GOVERNMENT ENTITIES),

So what? Twitter and many other sites hosted in the cloud are flooded with similar hate speech against other groups, and are typically left alone. See the case of the journalist who got hired at the New York Times despite having a Twitter account riddled with racist hatred directed at white people and men.

These platforms aren't doing censorship because of some systematic application of content rules. They're doing it as part of an overall ideological battle.

Re: TLS 1.3 Is an Opportunity for Amazon, Google and Microsoft to End Censorship

#50

Post by [deleted] »

ufmace wrote: post #26

Why would anybody think that Amazon, Google, or Microsoft are against censorship? Recent events have demonstrated that they love them some censorship, when they do it. Witness the case of gab.ai - Google was happy to pull their app from the Play store. Microsoft didn't mind at all threatening to shut down their Azure account unless they censored a post. The Azure case is particularly amazing. I can't believe the tech…

[deleted]
Post reply on HN