Investigating TLS Blocking in India

#1

Post by ZnZirconium » Sun, Sep 27, 2020, 11:40 PM UTC

Investigating TLS Blocking in India
ooni.org

Re: Investigating TLS Blocking in India

#2

Post by saagarjha » Mon, Sep 28, 2020, 12:49 AM UTC

> In the absence of a publicly available official list of blocked hostnames

This is the icing on the cake right here. It's just awful that not only do websites get censored largely arbitrarily, there is no insight into the process and what is even blocked–the fact that someone had to literally check sites to see if they are being blocked (via a variety of different methods largely indistinguishable from a malicious actor :/) is just a truly horrible state to be in.

Re: Investigating TLS Blocking in India

#3

Post by aravindet » Mon, Sep 28, 2020, 12:56 AM UTC

Does anyone have insight into why College Humor (referenced in the article) is blocked in India? This seems unusual and I wonder what (if any) reasons were provided.

Re: Investigating TLS Blocking in India

#4

Post by ignoramous » Mon, Sep 28, 2020, 1:31 AM UTC

And here's the latest in SNI and ESNI censorship bypass: https://geneva.cs.umd.edu/posts/china-censors-esni/esni/

https://getintra.org/ which is a DoH client for Android bypasses Indian censorship, btw. Ref: https://twitter.com/vinifortuna/status/1304189371688660992

Re: Investigating TLS Blocking in India

#5

Post by dylz » Mon, Sep 28, 2020, 2:03 AM UTC

aravindet wrote: post #3

Does anyone have insight into why College Humor (referenced in the article) is blocked in India? This seems unusual and I wonder what (if any) reasons were provided.

Probably some toilet humour that the censors didn't like.

Re: Investigating TLS Blocking in India

#6

Post by _9rq6 » Mon, Sep 28, 2020, 2:07 AM UTC

Will TLS 1.3 and ESNI support circumvent this?

Re: Investigating TLS Blocking in India

#7

Post by djsumdog » Mon, Sep 28, 2020, 2:23 AM UTC

_9rq6 wrote: post #6

Will TLS 1.3 and ESNI support circumvent this?

I'm wondering this too. The article claims some of the connection are proxied. However if it's a big site that uses a set range if incoming IPs, I feel like blocking could still happen at the TCP level (and maybe catch a bunch of other unrelated sites if it's on a shared hosting solution).

Re: Investigating TLS Blocking in India

#8

Post by [deleted] » Mon, Sep 28, 2020, 2:28 AM UTC

_9rq6 wrote: post #6

Will TLS 1.3 and ESNI support circumvent this?

[deleted]

Re: Investigating TLS Blocking in India

#9

Post by wtmt » Mon, Sep 28, 2020, 2:38 AM UTC

This is a great, detailed report. I use one of these providers and see somewhat similar results (I do not use my ISPs DNS, but another one with DoH).

Am I right in concluding that these blocking methodologies can be thwarted to a greater extent by the user using Tor (or a VPN outside the country) and/or the websites in question using ESNI (and the user also using a non-ISP DoH provider that doesn’t have legal presence in the country, since the DNS providers will be the next target for these ill defined blocking orders)?

Re: Investigating TLS Blocking in India

#10

Post by httgp » Mon, Sep 28, 2020, 2:38 AM UTC

It isn’t clear from the article, but how do we circumvent this? Would a VPN work?