6 ms·
How do governments censor only parts of Wikipedia when the site is encrypted? How do they know which pages you are browsing if they can't see the URL?
by rocky1138 9y ago
How do governments censor only parts of Wikipedia when the site is encrypted? How do they know which pages you are browsing if they can't see the URL?
- azernik 9y agoThat's exactly the point of the article?
- zeta0134 9y agoThat's just it; they can't! When you visit Wikipedia over HTTPS, the only thing actually visible in plain text is wikipedia.org, and that's only if your browser is using Server Name Identification (SNI). Since the rest of the request, including the URL is hidden, governments and other malicious agents between you and the server cannot actually see what pages you're requesting directly. They can only see that you are accessing wikipedia.org and transmitting some data. You may still be somewhat vulnerable to timing attacks to try to identify what pages you're viewing, but censorship can't happen at the page level over HTTPS; you have to block the whole thing in one go.
- zkms 9y agoThis is how "domain fronting" (https://en.wikipedia.org/wiki/Domain_fronting https://en.wikipedia.org/wiki/Domain_fronting) works as well -- encryption makes blocking an all-or-nothing deal, and blocking everything that goes to an extremely popular IP range / SNI causes too much collateral damage :)
- Amulet- 9y agoThe article says Although countries like China, Thailand and Uzbekistan were still censoring part or all of Wikipedia by the time the researchers wrapped up their study The top comment might be asking about the "were still censoring part" of the article.
- zeta0134 9y agoOh, huh! I missed that entirely, now I'm curious too. HTTPS should make that difficult, but China has been known to employ all sorts of weird shenanigans-- perhaps they're running a "trusted' MitM as part of the great firewall? I know that certain companies (like Google and Microsoft) will actively censor themselves to continue to operate within China, but I figured Wikipedia would be against that practice on principal. Now I'm curious as to how it's done.
- beefsack 9y agoNitpick: Google opted to pull out of mainland China instead of self-censoring. They moved Chinese operations to Hong Kong, but operate uncensored there.
- bumblebeard 9y agoGoogle was perfectly willing to self-censor in China until they were hacked by the Chinese government in 2010. That's when Google China moved to Hong Kong. https://googleblog.blogspot.com/2010/01/new-approach-to-china.html https://googleblog.blogspot.com/2010/01/new-approach-to-chin...
- matt4711 9y agoI think china blocks zh.wikipedia.org but all other languages are not blocked.
- Edmond 9y agoFor committed governments like China, TLS may just be an extra hurdle but they can get around it if they want. Basically China could simply implement a massive proxy that terminates TLS. If your internet traffic is going to flow through infrastructure that a curious government owns, then you'll know that they're monitoring the traffic but there is no way to keep them from seeing what you're doing.
- matt123 9y agoNo, TLS is not vulnerable to a MITM unless a) your client trusts the certificates issued by the attacker, or b) the attacker successfully forges the certificate of the website you are trying to visit. That is, assuming you don't click away your browser's security warning. https://security.stackexchange.com/questions/8145/does-https-prevent-man-in-the-middle-attacks-by-proxy-server#8309 https://security.stackexchange.com/questions/8145/does-https...
- Edmond 9y agoIt isn't but if you live in China and want to use the internet, you'll likely be forced to use a proxy that MITMs and serves its own certificate....My point is that TLS is not a solution to prevent government interference when the user has to rely on the government infrastructure for access.
- throwaway2048 9y agoThis is not how the great firewall works, check the facts known, not just baseless speculatation.
- comex 9y agoNot how it currently works. The parent was referring to hypothetical future changes.
- ars 9y ago> TLS is not vulnerable to a MITM unless a) your client trusts the certificates issued by the attacker, Or in other words it is vulnerable. China can (and probably does) issue a certificate that all Chinese browsers must install, they can then do MITM https using their certificate to sign the new versions. Companies do this routinely BTW. Since it's their equipment, it's considered just fine. (But be aware of it if you are using a company computer.)
- ishitatsuyuki 9y agoNote that the server certs are also parsable even if you're not using SNI.
- raverbashing 9y agoDNS requests are still transparent
- varenc 9y agoGovernments can't censor parts of Wikipedia when it's all encrypted, that's sort of the point of the article.
- jacquesm 9y agoWell, they can block it whole. Once they figure out they can't block parts that's exactly what they will do. Either that or a re-host on their own infrastructure with the offending parts removed, conveniently seizing whatever domain names wikipedia has in that country for added authenticity.
- MR4D 9y agoI wonder about this. If a government can hack into a server and steal the private encryption key, then they could just look like any other server in the server farm, right? Given the recent Shadow Brokers release of the NSA tools, it seems to me that this was not only possible, but probable (not necessarily with Wikipedia, but any website).
- rocky1138 9y agohttps://news.ycombinator.com/item?id=14442127 https://news.ycombinator.com/item?id=14442127
- ekarulf 9y agoWho says they can't see the URL? A sufficiently motivate government would probably be able to create forged certificates and mass interception isn't really out of the question. Especially with browsers homogenizing on fast ciphers AES-GCM/POLY-1305, I bet it's much more economical than you would think. Cert Pinning or HPKP is one type of solution, but it's tricky to get right especially for a large site like wikipedia.
- iancarroll 9y agoEven if this could happen, which is far from trivial, it would be almost immediately detected.
- rocky1138 9y agoFrom TFA: "In Turkey, Wikipedia articles about female genitals have been banned; Russia has censored articles about weed; in the UK, articles about German metal bands have been blocked..."
- rgbrenner 9y agoaccording to the paper.. the answer is subdomains.. For example, in one instance China blocked zh.wikipedia.org (the entire subdomain.. they cant see what page you're visiting), but left their other 291 subdomains unblocked.
- deleted 9y ago[deleted]