61–70 of 82 posts
Earlier quoted context omitted.
They could have had their own resolver before, or even hard coded IPs. Using software that doesn't respect you is the problem.
Firewalls can redirect port 53 to another IP. That prevents things from hard coding to a specific IP. https://forum.opnsense.org/index.php?topic=9245.0
> GET / HTTP/1.0 > Host: www.youtube.com > We send it in 2 parts: first comes GET / HTTP/1.0 \n Host: www.you and second sends as tube.com \n .... In this example, ISP cannot find blocked word YouTube in packets and you can bypass it! If you talk to anyone from China that this is how you bypass (HTTP) "deep packet inspection", it would sound incrediblely naive. I'm not criticizing here, thanks for developing an anti-…
Shadowsocks being the most well-known example. From a cryptographic perspective, it was a big step backwards. Since Diffie-Hellman handshakes were subjected to traffic classifiers, these tools only used symmetric encryption with fixed keys. Their encryption protocols were ad-hoc, and not cryptographically robust. While it was a matter of fact that nobody could break a simple AES-CBC encryption, nobody would trust the…
> GET / HTTP/1.0 > Host: www.youtube.com > We send it in 2 parts: first comes GET / HTTP/1.0 \n Host: www.you and second sends as tube.com \n .... In this example, ISP cannot find blocked word YouTube in packets and you can bypass it! If you talk to anyone from China that this is how you bypass (HTTP) "deep packet inspection", it would sound incrediblely naive. I'm not criticizing here, thanks for developing an anti-…
Shadowsocks being the most well-known example. From a cryptographic perspective, it was a big step backwards. Since Diffie-Hellman handshakes were subjected to traffic classifiers, these tools only used symmetric encryption with fixed keys. Their encryption protocols were ad-hoc, and not cryptographically robust. While it was a matter of fact that nobody could break a simple AES-CBC encryption, nobody would trust the…
Earlier quoted context omitted.
ISPs in the UK have to obey court orders, and there are some court orders in place for the "big 5" ISPs around certain piracy websites. If I try to go to thepiratebay.org I get this --- Access to this website has been blocked under an Order of the Higher Court. Any TalkTalk customer affected by the Court Order has a right under the Court Order to apply to vary or discharge it. Any such application must: (i) clearly i…
I believe it's illegal not to apply the Internet Watch Foundation blacklist (despite the IWF being completely unaccountable). A&A does a scheme where they'll set you up as a 1-person ISP and provide an unfiltered feed, but you have to sign something saying you're applying the blacklist yourself.
I briefly looked at the legal side of offering public Wi-Fi (essentially becoming an ISP) and besides debunking a ton of BS (turns out you don’t need to collect traffic data unless explicitly ordered by the government, and sign-in pages/captive portals/ToS aren’t necessary either) I never even heard of the IWF.
Curious how this law would apply to the ISPs providing connectivity to dedicated servers.
This is a nice workaround for those stuck under censorship regimes such as the UK, South Korea, Turkey, India or China. Now, Encrypted DNS (thanks to DNS over TLS/HTTPS) and HTTPS (thanks to Let's Encrypt and HSTS) are getting deployed somewhat widely. The next step is encrypted SNI[0], and it'll get this much harder to do any meaningful DPI, for censorship or else. [0]: https://en.wikipedia.org/wiki/Server_Name_Indi…
there are two edges to this sword. DoH also means breaking stuff like pihole and other ad filtering. It means you trust companies like google who base their revenue off ads, or cloudflare who have censored content numerous times in the past, to serve you DNS. its also kind of pointless if the state knows youre using it outside of a tunnel...they can just watch your next packets to see where you decided to go.
That way you could do DNS to pihole, do the filtering and let it use DoH to the outside world.
So basically it just does two things: carefully chunking HTTP header packets and encrypted DNS? Not sure this will work for very long.
>Not sure this will work for very long. Maybe if it gets popular. Defeating chunking would require additional memory + compute power on the DPI boxes, which I suspect ISPs don't want to bear.
You'd have better luck sending the TCP packets out-of-order. But some DPI boxes will buffer these to a small degree to catch such shenanigans.
Source: in a previous life I worked on the layer-7 inspection subsystem (among others) of a DPI box.
EDIT: Also what @cpitman said. DPI boxes will often err on the side of caution. The DPI will happily kill your goofy-but-standards-compliant flow if it can't figure out that it's safe.
> We send it in 2 parts: first comes GET / HTTP/1.0 \n Host: www.you and second sends as tube.com How does this even work? "www.you" won't return a valid HTTP response and "tube.com" won't either. How can you fetch the content at "youtube.com" but splitting the domain name in half? Won't you get two completely wrong responses that don't fit together?
It's split across two network packets. It's still one request for the web server.
> GET / HTTP/1.0 > Host: www.youtube.com > We send it in 2 parts: first comes GET / HTTP/1.0 \n Host: www.you and second sends as tube.com \n .... In this example, ISP cannot find blocked word YouTube in packets and you can bypass it! If you talk to anyone from China that this is how you bypass (HTTP) "deep packet inspection", it would sound incrediblely naive. I'm not criticizing here, thanks for developing an anti-…
It is working perfectly for Turkcell Superonline, Turkey. Unfortunately, anti-censorship tools are very crucial for us these days. Thank you for your work.
Why hasn't this become the modern Right to Bear Arms? The root of the second amendment was trying to ensure that one class of citizenry did not have tools at their hands to force another class of citizenry to comply. It maintained a balance. The right to encrypt and keep your data private should be a modern equivalent of the right to bear arms.