Google disables “domain fronting” capability used to evade censors

https://arstechnica.com/information-technology/2018/04/google-disables-domain-fronting-capability-used-to-evade-censors/

by okket • 8 years ago

80 42 8 years ago

arstechnica.com

StavrosK3• 8 years ago

Would someone be able to block packets more easily or less easily if TLS didn't have the domain name in the packet in plaintext? Presumably someone couldn't tell where the packet was going, but that might mean you have to send it to the right server in the first place.

dvno42• 8 years ago

If you could remove the common name/url from the clear text portion of the packet, that would make filtering the web site more difficult. Some enterprise firewalls/filters look at the CN to match against a ratings database in lieu of DPI-SSL/MITM. Ex: https://itzecurity.blogspot.com/2014/05/configuring-fortios-...

yardstick• 8 years ago

I suspect if encrypted SNI became popular, you would find them censored via one means or another. I imagine state operators have the resources to scan all domains, connect to them to identify their content and just blacklist their IPs (along with any innocent domains hosted on the same IP).

I could also see state operators mandating the plaintext SNI (by dropping non-SNI TLS), and operating a transparent TLS proxy based on that SNI with their own DNS lookup (so you would have to provide a legit, resolvable hostname in the plaintext SNI).

icebraining• 8 years ago

SNI is used to allow the frontend gateway to select the correct certificate; it should be harder to block if the frontend gateway instead had a single certificate with all the domains it proxied (obviating the need for SNI).

Of course, that means the gateway must terminate the TLS connection for every site (and therefore be able to read its contents), whereas with SNI it could redirect the TLS connection itself to the appropriate server, while being unable to spy on it.

In practice what happened before SNI is that every SSL/TLS site used a dedicated IP, which makes it quite easy to block.

StavrosK3• 8 years ago

I meant something more like encrypted SNI in TLS 1.3[1], but that has covering as an explicit design goal, so I guess that answers my question.

Still, it's a matter of politics, and not of technology. Google here chooses to stop covering for Telegram/Signal, even if the technology allows it.

[1] https://www.ietf.org/proceedings/94/slides/slides-94-tls-8.p...

breakingcups• 8 years ago

What fortunate timing.

kome3• 8 years ago

What fortunate timing indeed. That's just a kind reminder about what the interests of Google and Amazon are. Not those of their consumers for sure.

Also, especially Google have all the interest to let the Russians destroy Telegram. At this point I would be very suspicious of all other messengers that still work in Russia.

Edit: also Amnesty International is on it: https://twitter.com/amnesty/status/986955700550144002

baybal24• 8 years ago

At this point I would be very suspicious of all other messengers that still work in Russia.

That's a conjecture is rational, but I think you already have to be very suspicious of anything that worked there for last 5 years, Telegram inclusively.

It is unbelievable for me that they maintained legal presence in the country up until now, while all others were indiscriminately blocked years ago, and incompliant software authors were raided by 3 letter agencies and raped with assault rifles.

Traubenfuchs• 8 years ago

If you want to spin conspiracy theories think about the following: It's very likely that every time we hear that government x can't beat software y (TrueCrypt, Telegram, etc.) it's fake news to make you think that software is safe and increase the amount of users who trust it.

codedokode5• 8 years ago

Viber currently has problems with connectivity in Russia. They have been complying with russian laws, but they made an unwise decision to use servers in Amazon network that are being blocked now because of Telegram. So the messenger that complies with the law now has problems and Telegram just works.

anc84• 8 years ago

What are you referring to?

lucb1e• 8 years ago

Telegram I'd assume.

ckastner• 8 years ago

I already guessed a few days ago that this is probably the next step we will see from Google and Amazon after the Russian blanket ban on AWS and GCP IPs [1]. It was either that, or the Russian goverment backing off an extreme measure.

[1] https://news.ycombinator.com/item?id=16856763

tribby• 8 years ago

awful news, but not the end just yet - hopefully amazon and azure stay viable for meek.

etaioinshrdlu2• 8 years ago

This seems like something you could do yourself on a VM instance, no?

rocqua• 8 years ago

It helps a lot more to masquerade as google.com than it does to masquarade as etaioinshrdlu.com. The censors would need to think more about blocking something as big a google than a single use-domain.

etaioinshrdlu2• 8 years ago

That explains it.

est• 8 years ago

Another reason why Google/Amazon is too centralized to be a single point of failure.

We need more decentralized Internet. Not more clever hacks.

Lionsion2• 8 years ago

Another reason why Google/Amazon is too centralized to be a single point of failure.
We need more decentralized Internet. Not more clever hacks.

IIRC, didn't domain fronting only work because Google/Amazon were thought to be too big to block?

IMHO, what we need is a stronger consensus that Western companies shouldn't let themselves be bullied by censorious regimes dangling the promise of profits or access. They shouldn't be allowed to defend such decisions as profit-seeking amorality.

Shorel• 8 years ago

In this particular case, the problem is not Google or Amazon. They are technology providers and isolating each of their customers is actually a good thing.

The problem is the Internet censoring by governments.

vatueil• 8 years ago

Previous discussion: https://news.ycombinator.com/item?id=16868564

As was brought up in the previous thread, though only briefly mentioned in the linked article, domain fronting is used by malware as well. It was allegedly exploited by Russian state-sponsored hacking group APT29.[0][1]

It's unfortunate that it can't be used to help avoid censorship either now, but it was never an intended feature. As the article quotes, other CDNs such as Cloudfront also do not support domain fronting.

[0] https://www.fireeye.com/blog/threat-research/2017/03/apt29_d...

[1] https://www.cyberark.com/threat-research-blog/red-team-insig...

chisleu• 8 years ago

You can still use ELB's to hide behind amazon.com, right?

Google disables “domain fronting” capability used to evade censors

Related Stories