3 ms·
Unless I'm mistaken, the site could be made reachable if only TPB would enable SSL between Cloudflare and their origin. Currently, Airtel is blocking based on
by apeace 10y ago
Unless I'm mistaken, the site could be made reachable if only TPB would enable SSL between Cloudflare and their origin.
Currently, Airtel is blocking based on the Host header. If they can't see the Host header, they'd have to instead know TPB's origin IP, which they wouldn't.
- mikecb 10y agoTLS transmits the host in cleartext.
- theandrewbailey 10y agoCompletely beside the point. Airtel is obviously looking at the HTTP host header.
- mikecb 10y agoParent suggested deploying TLS from origin to Cloudflare would resolve this. Simply pointing out that it will not.
- aptwebapps 10y agoThe post said that Cloudfare communicates with TPB via its IP address, not its host name, and that Airtel must be sniffing the hostname out of the header. So if they went full TLS Airtel would have to block the relevant IPs, which can be a little harder to find out, instead of the host.
- astrange 10y agoCloudflare does use SNI to talk to origin servers.
- captn3m0 10y agoonly if the origin server uses HTTPS and SNI.
- scurvy 10y agoMost layer 7 blocking mechanisms look for the SNI header in a TLS datagram or the host header. It's not complicated and trivial to do. Only looking at the host header would be quite amateurish. I'm not a security expert, and even I know this. CF could use some sort of IPSec or SSL tunnel back to another datacenter to make the origin request. It would add a lot of latency, but it would ensure that local authorities don't mess with the traffic. This was a popular way for CDN's to get around China for a while. I believe one CDN provider billed it as "Secure origin routing." I doubt that they still offer it, as everyone wants to play ball and make money in the end.
- deleted 10y ago[deleted]