4 ms·

They're hosting a proxy on appspot.

closeparen 10y ago
Can you really not draw a distinction between appspot and google.com? They run googleusercontent.com to maintain that separation for Google Cache, after all.
- subliminalpanda 10y ago
  Not unless you MITM the connection, otherwise it wouldn't be an effective measure. There's a pretty good write up I found here: https://trac.torproject.org/projects/tor/wiki/doc/meek https://trac.torproject.org/projects/tor/wiki/doc/meek commit for the ios version is here: https://github.com/WhisperSystems/SignalServiceKit/commit/78515377b14f1055c4a87548a7899650b753ce52 https://github.com/WhisperSystems/SignalServiceKit/commit/78...
  - smartbit 10y ago
    Thanks for the links, informative. So the proxy app that the Egypt government would like to take down is signal-reflector-meek.appspot.com
    - kijiki 10y ago
      No, per the linked check-in, the Egyptian govt would have to block OWSCensorshipConfigurationFrontingHost, which is "https://google.com" https://google.com". That is the domain looked up in DNS and included in the TLS Certificate's SNI field. These are the only domains that are sent plain-text. "signal-reflector-meek.appspot.com" domain only shows up in the HTTP "Host" header, which is TLS encrypted, and thus not visible to the censors.
- nandhp 10y ago
  That's only for cookie/XSS purposes. It still runs from the same server farm, so you can do things like this: $ curl -H 'Host: xss-game.appspot.com' https://www.google.com/ <!doctype html> [...] <title>XSS game</title> This works for all the AppSpot hostnames I tried (even my own), but not for any custom domains.
- walrus01 10y ago
  At brute force they will do as Turkey has done with YouTube, and order the ISPs to null route entire /20 to /16 sized pieces of the internet belonging to YouTube, etc. Same with appspot.
- Buge 10y ago
  In most cases you could, but due to how google implements TLS termination, google ignores the SNI domain when considering what content to send, it only pays attention to the host header.

Can you really not draw a distinction between appspot and google.com? They run googleusercontent.com to maintain that separation for Google Cache, after all.

subliminalpanda 10y ago
Not unless you MITM the connection, otherwise it wouldn't be an effective measure. There's a pretty good write up I found here: https://trac.torproject.org/projects/tor/wiki/doc/meek https://trac.torproject.org/projects/tor/wiki/doc/meek commit for the ios version is here: https://github.com/WhisperSystems/SignalServiceKit/commit/78515377b14f1055c4a87548a7899650b753ce52 https://github.com/WhisperSystems/SignalServiceKit/commit/78...
- smartbit 10y ago
  Thanks for the links, informative. So the proxy app that the Egypt government would like to take down is signal-reflector-meek.appspot.com
  - kijiki 10y ago
    No, per the linked check-in, the Egyptian govt would have to block OWSCensorshipConfigurationFrontingHost, which is "https://google.com" https://google.com". That is the domain looked up in DNS and included in the TLS Certificate's SNI field. These are the only domains that are sent plain-text. "signal-reflector-meek.appspot.com" domain only shows up in the HTTP "Host" header, which is TLS encrypted, and thus not visible to the censors.
nandhp 10y ago
That's only for cookie/XSS purposes. It still runs from the same server farm, so you can do things like this: $ curl -H 'Host: xss-game.appspot.com' https://www.google.com/ <!doctype html> [...] <title>XSS game</title> This works for all the AppSpot hostnames I tried (even my own), but not for any custom domains.
walrus01 10y ago
At brute force they will do as Turkey has done with YouTube, and order the ISPs to null route entire /20 to /16 sized pieces of the internet belonging to YouTube, etc. Same with appspot.
Buge 10y ago
In most cases you could, but due to how google implements TLS termination, google ignores the SNI domain when considering what content to send, it only pays attention to the host header.