51–60 of 82 posts
Why hasn't this become the modern Right to Bear Arms? The root of the second amendment was trying to ensure that one class of citizenry did not have tools at their hands to force another class of citizenry to comply. It maintained a balance. The right to encrypt and keep your data private should be a modern equivalent of the right to bear arms.
Earlier quoted context omitted.
there are two edges to this sword. DoH also means breaking stuff like pihole and other ad filtering. It means you trust companies like google who base their revenue off ads, or cloudflare who have censored content numerous times in the past, to serve you DNS. its also kind of pointless if the state knows youre using it outside of a tunnel...they can just watch your next packets to see where you decided to go.
Quick thought. If software wanted to, could they not, today, bypass your DNS resolvers anyways? Choosing to use DoH on software where you control the DNS resolution seems like an unambiguous win. FWIW, the Chromium implementation of DoH upgrading only upgrades you to DoH if your configured DNS provider is known to support it via a hardcoded list. In theory, you could have Pihole resolve using a DoH resolver and your…
Earlier quoted context omitted.
>DoH also means breaking stuff like pihole and other ad filtering. No, it doesn't. e.g. I run DoH behind my home's dns cache server. >its also kind of pointless if the state knows youre using it outside of a tunnel...they can just watch your next packets to see where you decided to go. This is where HTTPS and eSNI further help.
> e.g. I run DoH behind my home's dns cache server. I think GP is referring to the fact that apps can now bypass network / os wide dns stub / recursive resolvers undetected with DoH. > This is where HTTPS and eSNI further help. I believe TLS v1.3 specifically has anti-censorship and anti-surveillance properties baked in: https://blog.cloudflare.com/rfc-8446-aka-tls-1-3/
Using software that doesn't respect you is the problem.
Earlier quoted context omitted.
there are two edges to this sword. DoH also means breaking stuff like pihole and other ad filtering. It means you trust companies like google who base their revenue off ads, or cloudflare who have censored content numerous times in the past, to serve you DNS. its also kind of pointless if the state knows youre using it outside of a tunnel...they can just watch your next packets to see where you decided to go.
> cloudflare who have censored content numerous times in the past Besides Stormfront[0], what else did they censor? [0] https://en.wikipedia.org/wiki/Stormfront_%28website%29
Earlier quoted context omitted.
> e.g. I run DoH behind my home's dns cache server. I think GP is referring to the fact that apps can now bypass network / os wide dns stub / recursive resolvers undetected with DoH. > This is where HTTPS and eSNI further help. I believe TLS v1.3 specifically has anti-censorship and anti-surveillance properties baked in: https://blog.cloudflare.com/rfc-8446-aka-tls-1-3/
They could have had their own resolver before, or even hard coded IPs. Using software that doesn't respect you is the problem.
Why hasn't this become the modern Right to Bear Arms? The root of the second amendment was trying to ensure that one class of citizenry did not have tools at their hands to force another class of citizenry to comply. It maintained a balance. The right to encrypt and keep your data private should be a modern equivalent of the right to bear arms.
This is a nice workaround for those stuck under censorship regimes such as the UK, South Korea, Turkey, India or China. Now, Encrypted DNS (thanks to DNS over TLS/HTTPS) and HTTPS (thanks to Let's Encrypt and HSTS) are getting deployed somewhat widely. The next step is encrypted SNI[0], and it'll get this much harder to do any meaningful DPI, for censorship or else. [0]: https://en.wikipedia.org/wiki/Server_Name_Indi…
I still prefer VPNs and Tor, but hey.
> GET / HTTP/1.0 > Host: www.youtube.com > We send it in 2 parts: first comes GET / HTTP/1.0 \n Host: www.you and second sends as tube.com \n .... In this example, ISP cannot find blocked word YouTube in packets and you can bypass it! If you talk to anyone from China that this is how you bypass (HTTP) "deep packet inspection", it would sound incrediblely naive. I'm not criticizing here, thanks for developing an anti-…
Shadowsocks being the most well-known example. From a cryptographic perspective, it was a big step backwards. Since Diffie-Hellman handshakes were subjected to traffic classifiers, these tools only used symmetric encryption with fixed keys. Their encryption protocols were ad-hoc, and not cryptographically robust. While it was a matter of fact that nobody could break a simple AES-CBC encryption, nobody would trust the…
You mentioned that for many of these efforts bypassing censorship trumped secrecy concerns. Is this still the case?
If I were a citizen regularly bypassing censorship of an authoritarian government, I’d be concerned for my safety if it was well documented that I regularly accessed censored material.
Earlier quoted context omitted.
Looks interesting. From https://www.v2ray.com/en/index.html it seems that it's "just" a VPN protocol / software that can tunnel over TLS. I assume the point of using your own server + Cloudflare is that it breaks IP based blocking of most VPN providers. I guess just your own server without Cloudflare would work fine for a while, but they probably have heuristics for a lot of encrypted traffic sent to a single unknown…
https://www.scmp.com/news/china/politics/article/3030563/big... They want to make the networks transparent to the government, and apply machine learning for understanding the data and warnings the monitoring system will provide. You either provide decryption keys, or your traffic will be dropped.