Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Investigating TLS Blocking in India

ooni.org

Post reply on HN
Print view View original

81–90 of 136 posts

Re: Investigating TLS Blocking in India

#81

Post by Santosh83 »

justDankin wrote: post #69
kburman wrote: post #55

For anyone in India, just use a DoH client and you would be good to go. I use greentunnel and it works fine.

DoH just by itself won't help unfortunately, since it just fetches the DNS (btw, only Airtel, ACT, BSNL, and MTNL bother with DNS censorship). ISPs have been looking at the cleartext hostname in the TLS handshake to block these connections As someone correctly pointed out, greentunnel does much more than DoH.

Thanks to everyone in this subthread. I'm on BSNL which I find is one of the Indian ISPs that seems to implement easy to circumvent blocks (DNS based), so far. Reliance no doubt is a different beast with its financial and technical clout and increasing market share. Rather concerning that we're quickly catching up to China in terms of implementing an increasingly sophisticated firewall.

Seriously can't expect the average Joe to know about stuff like greentunnel. And that's concerning...

Re: Investigating TLS Blocking in India

#82

Post by gnaman »

xplune wrote: post #33
indiablock wrote: post #30

I run a tech company that got randomly blocked in India. There's no way it wasn't some kind of mistake. It's been months and there's no way to find out why and there's no documented method to resolve the problem. While looking into this, it turns out it happens all the time and many websites have been blocked for years. If you're big enough then maybe you can get unblocked. Or you might just be SOL. Some examples: ht…

Which ISP are you using? Because alexa.com, trinet.com, behance.net, NYTimes are working for me.

behance was definitely blocked for the longest time. I had Jio and Airtel both and I had tried them. Things have changed now because of the uproar.

Re: Investigating TLS Blocking in India

#83

Post by ignoramous »

bgdam wrote: post #57
kburman wrote: post #55

For anyone in India, just use a DoH client and you would be good to go. I use greentunnel and it works fine.

Greentunnel is not just a DoH client. Greentunnel also breaks up your packets in such a manner that prevents SNI sniffing, which is what makes it able to prevent blocking by Jio.

> Greentunnel also breaks up your packets in such a manner that prevents SNI sniffing...

Yep, here's the code that does the trick: https://github.com/SadeghHayeri/GreenTunnel/blob/master/src/...

Re: Investigating TLS Blocking in India

#84

Post by Santosh83 »

justDankin wrote: post #78
amitheonlyone wrote: post #74

Earlier quoted context omitted.

Do i have to keep it installed or is it a one-off thing

You can delete it after running. Each run on an (ISP, state) combination gives a new test point. Thanks!

Off-topic but I'm noticing that every comment of yours on this post shows up as greyed-out and 'dead' immediately after you post, within minutes. There's not enough time for people to downvote and in any case none of your comments are downvote-worthy. I've been 'vouching' for your comments so others can read them. Maybe something @dang can look into?

Re: Investigating TLS Blocking in India

#85

Post by boruto »

sbmthakur wrote: post #50
indiablock wrote: post #30

I run a tech company that got randomly blocked in India. There's no way it wasn't some kind of mistake. It's been months and there's no way to find out why and there's no documented method to resolve the problem. While looking into this, it turns out it happens all the time and many websites have been blocked for years. If you're big enough then maybe you can get unblocked. Or you might just be SOL. Some examples: ht…

Alexa, Behance and Trinet are accessible to me on Jio's network. Do you have a better source for this? r/India is not a reliable source.

r/India has extremely cynical view of current administration. I was a leftist, That sub-reddit is extreme left.

Re: Investigating TLS Blocking in India

#86

Post by rishav_sharan »

iamsb wrote: post #68
daliusd wrote: post #27

Earlier quoted context omitted.

https://rsf.org/en/ranking It seems you are not that right.

In that ranking India is only 0.01 points ahead of pakistan. Does not pass my smell test about its methodology to be honest.

As an Indian, knowing the journalistic persecution and state of free speech in India, I wouldn't be surprised if India is tied up with Pakistan.

Here is some stuff to read up on this http://www.rightsrisks.org/banner/india-medias-crackdown-dur...

http://attacksonrtiusers.org/

Re: Investigating TLS Blocking in India

#87

Post by rishav_sharan »

axaxs wrote: post #34
daliusd wrote: post #27

Earlier quoted context omitted.

https://rsf.org/en/ranking It seems you are not that right.

And it seems anyone who has traveled outside of their home country recognizes this list as the bullshit that it is. Please stop linking it.

I'd say that as someone who actually has traveled outside their country, this list seems pretty fair to me ( at least for the countries I have traveled to or have friends/family staying in). what is your exact bone of contention? Methodology or specific country's ranking?

Re: Investigating TLS Blocking in India

#88

Post by justDankin »

Santosh83 wrote: post #84
justDankin wrote: post #78

Earlier quoted context omitted.

You can delete it after running. Each run on an (ISP, state) combination gives a new test point. Thanks!

Off-topic but I'm noticing that every comment of yours on this post shows up as greyed-out and 'dead' immediately after you post, within minutes. There's not enough time for people to downvote and in any case none of your comments are downvote-worthy. I've been 'vouching' for your comments so others can read them. Maybe something @dang can look into?

I'm new to HN(3 months, low karma). Maybe that's the reason? Not sure what would be the correct way to "fix" this

Thanks for vouching!

Re: Investigating TLS Blocking in India

#89

Post by detaro »

justDankin wrote: post #88
Santosh83 wrote: post #84

Earlier quoted context omitted.

Off-topic but I'm noticing that every comment of yours on this post shows up as greyed-out and 'dead' immediately after you post, within minutes. There's not enough time for people to downvote and in any case none of your comments are downvote-worthy. I've been 'vouching' for your comments so others can read them. Maybe something @dang can look into?

I'm new to HN(3 months, low karma). Maybe that's the reason? Not sure what would be the correct way to "fix" this Thanks for vouching!

email the mods through the contact link in the footer. Probably some spam filter gone haywire.

Re: Investigating TLS Blocking in India

#90

Post by topranks »

ignoramous wrote: post #15
wtmt wrote: post #9

This is a great, detailed report. I use one of these providers and see somewhat similar results (I do not use my ISPs DNS, but another one with DoH). Am I right in concluding that these blocking methodologies can be thwarted to a greater extent by the user using Tor (or a VPN outside the country) and/or the websites in question using ESNI (and the user also using a non-ISP DoH provider that doesn’t have legal presenc…

You don't really need tor or any other VPN for that matter, https://getintra.org/ a DoH client for Android works just fine [0] [0] https://twitter.com/vinifortuna/status/1304189371688660992

DoH client won’t stop SNI blocking, of which this report found a lot.

ESNI, of the new trick of using ESNI plus a fake plaintext SNI, is definitely a more robust approach.

Post reply on HN