Hacker News new | ask | show | jobs
by pot8n 2239 days ago
Yes, I think most DPIs and Firewalls these days terminate the connections after the ClientHello message which contains the SNI
1 comments

Companies are dragging their feet with encrypted SNI
Encrypted SNI still has a few years to go before it's deployed. Meanwhile, the Great Firewall continues to block TLS connections with an unwanted SNI via a TCP Reset attack. "news.ycombinator.com is on the list, too.
I mean if we get ESNI faster, the GFW is going to have a hard time keeping up. What do you even do at that point? Just block every CDN?
My opinion is that it's basically a mutually assured destruction game. Either the censor blocks everything and creates significant damages to the national economy and popular support, or it has to allow free access to these websites. I'm optimistic, and to me, both outcomes are good outcomes. I support these aggressive industrial efforts to increase security. Free access is the most desirable result, but a complete block is not really a big issue - it cannot last forever, and the collateral damage will force the censor to eventually back off.

But there are some potential issues. One problem is the assumption that MAD as a forever-lasting situation may be flawed. In the Telegram incident in Russia, the Russian government literally blocked all Amazon servers and created massive disruption, however, Amazon also suffered economic damaged so it surrendered first before the Russian government backed off, and blocked the domain-fronting technique used for censorship circumvention. It's a way that the plan can fail. So the key to a successful ESNI deployment depending on the fact that cloud providers will never surrender after they received a total block.

Another argument says the possibility to bypass censorship is ultimately a dynamic balance - on one hand, the Great Firewall has loophope that allow circumvention, on the other hand, it's effective enough that the censor lack an incentive to implement stricter control. By introducing aggressive web security measures, this balance will be broken. As a result, an process to implement stricter censorship that would take 5 years otherwise, will instead take 2 years, and the result is a net negative, thus it's a terrible idea.

I maintain my own opinion, but I do find these are interesting and persuasive arguments.