Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Domain fronting to be blocked on Azure

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 132 posts

Re: Tell HN: Domain fronting to be blocked on Azure

#61

Post by bluehatbrit »

rovr138 wrote: post #47
tialaramex wrote: post #31

Earlier quoted context omitted.

In the UK if you're under age and you decided to buy a knife you will have a lot of difficulty unless it's a little folding (but non-locking) pocket knife, like the small Swiss Army type utility knives. Indeed legally as old as 17 you can't even buy a steak knife in England although you can in Scotland. Once you've bought a knife, it will usually be illegal to carry it in public unless you have a good reason, and "se…

I'm not trying to be an asshole, but we don't get much info from UK here besides things like the Queen dying, so I have to ask, Does it work? I mean, are instances of kids The reason I'm asking is because as a kid, if I had been told to not do something, I'd just find a way to do it. Not to use it, but to find loopholes and just say, _so what?, I can do x_

I don't know enough about when various laws were passed to say whether the introduction of the laws have had an impact. In 2021 the Office for National Statistics published a reasarch breifing on the topic with some top level numbers [1]. I can say I don't walk around expecting people to have a weapon on them, even in some of the higher crime areas of my city (Bristol). But that's just anecdotal and it'll greatly depend on where you live.

[1] https://commonslibrary.parliament.uk/research-briefings/sn04...

Re: Tell HN: Domain fronting to be blocked on Azure

#62

Post by remram »

lzooz wrote: post #5
eurasiantiger wrote: post #2

This seems to be a user-hostile move. https://en.m.wikipedia.org/wiki/Domain_fronting ”Many large cloud service providers, including Amazon and Google, now actively prohibit domain fronting, which has limited it as a censorship bypass technique. Pressure from censors in Russia and China is thought to have contributed to these prohibitions”

Well if they didn't do this the entire Azure would get banned which is even worse.

Banned by whom and why do you think that?

Re: Tell HN: Domain fronting to be blocked on Azure

#63

Post by metiscus »

voakbasda wrote: post #48
rovr138 wrote: post #47

Earlier quoted context omitted.

I'm not trying to be an asshole, but we don't get much info from UK here besides things like the Queen dying, so I have to ask, Does it work? I mean, are instances of kids The reason I'm asking is because as a kid, if I had been told to not do something, I'd just find a way to do it. Not to use it, but to find loopholes and just say, _so what?, I can do x_

It absolutely does not work. Violence finds a way.

The mind is humanity's most lethal weapon. With the "right" mindset the entire universe can become a weapon. Efforts to reduce violence tend to focus on the presence of concrete weapons (because this is easier to quantify and measure etc) with much less focus on violent ideation and the root causes of the various forms of interpersonal violence.

Reducing violence is a tricky thing because to a large extent it seems to me to be a symptom of broader and nearly intractable societal malaise. Not that it isn't worth removing nuclear weapons from circulation but the returns diminish quicker than most public policy folks seem to want to admit.

Re: Tell HN: Domain fronting to be blocked on Azure

#64

Post by easrng »

sylens wrote: post #40
hedora wrote: post #37

Earlier quoted context omitted.

Can’t they use almost any read-write service for C2 though? “Because Security” arguments like this are increasingly used in place of “think of the children”.

How many read-write services can you use to redirect traffic to your C2 infrastructure while almost guaranteeing organizations will allow outbound connections to it and not look too closely at it?

Google Docs/Forms/Sheets/etc, anything with an image proxy, probably Microsoft's Office Online stuff tho I personally haven't used it, webpush connections, the possibilities are endless.

Re: Tell HN: Domain fronting to be blocked on Azure

#66

Post by denton-scratch »

rovr138 wrote: post #47
tialaramex wrote: post #31

Earlier quoted context omitted.

In the UK if you're under age and you decided to buy a knife you will have a lot of difficulty unless it's a little folding (but non-locking) pocket knife, like the small Swiss Army type utility knives. Indeed legally as old as 17 you can't even buy a steak knife in England although you can in Scotland. Once you've bought a knife, it will usually be illegal to carry it in public unless you have a good reason, and "se…

I'm not trying to be an asshole, but we don't get much info from UK here besides things like the Queen dying, so I have to ask, Does it work? I mean, are instances of kids The reason I'm asking is because as a kid, if I had been told to not do something, I'd just find a way to do it. Not to use it, but to find loopholes and just say, _so what?, I can do x_

Speaking for myself, I own a Buck Hunter knife that I used to carry as a pocket knife. When I learned that it's not street-legal (it's blade locks, and is 1/2" too long) I stopped carrying it. So that's one anecdatum. I'm not particularly unusual; I imagine many people that once carried a locking pocket knife no longer do.

There was a spate of stabbing reports, about a decade ago. That seems to have died down. My guess (and it's only a guess) is that only drug dealers and people bent on mayhem carry guns or knives that aren't street-legal these days; what's the point in getting busted for carrying a penknife?

Incidentally, I don't get the point of the ban on locking knives. If you stab someone with a knife that doesn't lock, then I suppose there's a risk to your own fingers; but the dude you stabbed won't care if it was a locking knife or not. I do get the blade-length restriction though. You don't need a 3" blade to sharpen pencils.

My straight razors are street-legal, though, and I think they're quite a lot more dangerous than a 3" knife that locks. The sharpened edge of a razor is only about 2" long, so I assume it's street-legal; but you could really make a mess of someone's face with a razor (the preferred weapon of Pinky, the gangster from Brighton Rock).

Re: Tell HN: Domain fronting to be blocked on Azure

#68

Post by denton-scratch »

_8j50 wrote: post #43
saddlerustle wrote: post #21

Earlier quoted context omitted.

It’s too late. Whole countries block all eSNI requests, so it’s always going to fail open.

Well then hopefully tech people will soon wrap their head around the fact that political problems are best solved politically. You can't write tech that overrides the authority of governments but you can override or change governments.

> You can't write tech that overrides the authority of governments

Really? Tor springs to mind.

Re: Tell HN: Domain fronting to be blocked on Azure

#69

Post by hoppla »

psychphysic wrote: post #26

Lack of SNI encryption is the Achilles heel of modern web when it comes to oppressive regimes blocking access. Between encrypted SNI (Or domain name fronting), encrypted DNS and of course HTTPS. The biggest legitimate use case of Tor would vanish.

It will still be possible to correlate IP addresses and hostnames. You can only hope for plausible deniability provided that the site you are visiting share IP address with a bunch of other sites.

Re: Tell HN: Domain fronting to be blocked on Azure

#70

Post by poisonbug »

zhfliz wrote: post #60
skeeter2020 wrote: post #59

Earlier quoted context omitted.

Unfortunately the most common use-case of fronting is phishing and other scams that do make our lives worse. There's a legit anti-censorship angle but it is not the major use-case.

how would domain fronting help with phishing? your standard user agent (e.g. browser) will not send different values in SNI and HTTP Host header. this is a deliberate action by the user agent to obscure the actual traffic destination. this can of course be used both for censorship circumvention but also misleading corporate traffic inspection when TLS is not broken, though it's debatable whether that should work in t…

The issue isn't with phishing. The issue is with threat actors using domain fronting as a network masquerading technique when having command and control traffic call back to Cobalt Strike servers. You can use domain fronting look like it's heading back to legitimate sources such as Microsoft, but unless the corporation is doing SSL termination on the endpoints, it's impossible to determine the exact destination.

Azure originally started on this path in 2021: https://www.microsoft.com/en-us/security/blog/2021/03/26/sec...

Working in the pentest/red team field, I've seen various providers ban consulting companies and red teams from using domain fronting -- however, this doesn't stop the threat actors.

Post reply on HN