4 ms·

That's just it; they can't! When you visit Wikipedia over HTTPS, the only thing actually visible in plain text is wikipedia.org, and that's only if your browser

That's just it; they can't! When you visit Wikipedia over HTTPS, the only thing actually visible in plain text is wikipedia.org, and that's only if your browser is using Server Name Identification (SNI). Since the rest of the request, including the URL is hidden, governments and other malicious agents between you and the server cannot actually see what pages you're requesting directly. They can only see that you are accessing wikipedia.org and transmitting some data. You may still be somewhat vulnerable to timing attacks to try to identify what pages you're viewing, but censorship can't happen at the page level over HTTPS; you have to block the whole thing in one go.

zkms 9y ago
This is how "domain fronting" (https://en.wikipedia.org/wiki/Domain_fronting https://en.wikipedia.org/wiki/Domain_fronting) works as well -- encryption makes blocking an all-or-nothing deal, and blocking everything that goes to an extremely popular IP range / SNI causes too much collateral damage :)
Amulet- 9y ago
The article says Although countries like China, Thailand and Uzbekistan were still censoring part or all of Wikipedia by the time the researchers wrapped up their study The top comment might be asking about the "were still censoring part" of the article.
- zeta0134 9y ago
  Oh, huh! I missed that entirely, now I'm curious too. HTTPS should make that difficult, but China has been known to employ all sorts of weird shenanigans-- perhaps they're running a "trusted' MitM as part of the great firewall? I know that certain companies (like Google and Microsoft) will actively censor themselves to continue to operate within China, but I figured Wikipedia would be against that practice on principal. Now I'm curious as to how it's done.
  - beefsack 9y ago
    Nitpick: Google opted to pull out of mainland China instead of self-censoring. They moved Chinese operations to Hong Kong, but operate uncensored there.
    - bumblebeard 9y ago
      Google was perfectly willing to self-censor in China until they were hacked by the Chinese government in 2010. That's when Google China moved to Hong Kong. https://googleblog.blogspot.com/2010/01/new-approach-to-china.html https://googleblog.blogspot.com/2010/01/new-approach-to-chin...
  - matt4711 9y ago
    I think china blocks zh.wikipedia.org but all other languages are not blocked.
    - kalleboo 9y ago
      When I visited China a bunch of years ago, zh.wikipedia was completely blocked, and on English wikipedia, only certain articles were deadholed (tiananmen square...)
    - Bakary 9y ago
      I just tested a few pages and it looks like you are right.
Edmond 9y ago
For committed governments like China, TLS may just be an extra hurdle but they can get around it if they want. Basically China could simply implement a massive proxy that terminates TLS. If your internet traffic is going to flow through infrastructure that a curious government owns, then you'll know that they're monitoring the traffic but there is no way to keep them from seeing what you're doing.
- matt123 9y ago
  No, TLS is not vulnerable to a MITM unless a) your client trusts the certificates issued by the attacker, or b) the attacker successfully forges the certificate of the website you are trying to visit. That is, assuming you don't click away your browser's security warning. https://security.stackexchange.com/questions/8145/does-https-prevent-man-in-the-middle-attacks-by-proxy-server#8309 https://security.stackexchange.com/questions/8145/does-https...
  - Edmond 9y ago
    It isn't but if you live in China and want to use the internet, you'll likely be forced to use a proxy that MITMs and serves its own certificate....My point is that TLS is not a solution to prevent government interference when the user has to rely on the government infrastructure for access.
    - throwaway2048 9y ago
      This is not how the great firewall works, check the facts known, not just baseless speculatation.
      - comex 9y ago
        Not how it currently works. The parent was referring to hypothetical future changes.
  - ars 9y ago
    > TLS is not vulnerable to a MITM unless a) your client trusts the certificates issued by the attacker, Or in other words it is vulnerable. China can (and probably does) issue a certificate that all Chinese browsers must install, they can then do MITM https using their certificate to sign the new versions. Companies do this routinely BTW. Since it's their equipment, it's considered just fine. (But be aware of it if you are using a company computer.)
ishitatsuyuki 9y ago
Note that the server certs are also parsable even if you're not using SNI.
raverbashing 9y ago
DNS requests are still transparent

zkms 9y ago

This is how "domain fronting" (https://en.wikipedia.org/wiki/Domain_fronting https://en.wikipedia.org/wiki/Domain_fronting) works as well -- encryption makes blocking an all-or-nothing deal, and blocking everything that goes to an extremely popular IP range / SNI causes too much collateral damage :)

Amulet- 9y ago

The article says Although countries like China, Thailand and Uzbekistan were still censoring part or all of Wikipedia by the time the researchers wrapped up their study The top comment might be asking about the "were still censoring part" of the article.

zeta0134 9y ago
Oh, huh! I missed that entirely, now I'm curious too. HTTPS should make that difficult, but China has been known to employ all sorts of weird shenanigans-- perhaps they're running a "trusted' MitM as part of the great firewall? I know that certain companies (like Google and Microsoft) will actively censor themselves to continue to operate within China, but I figured Wikipedia would be against that practice on principal. Now I'm curious as to how it's done.
- beefsack 9y ago
  Nitpick: Google opted to pull out of mainland China instead of self-censoring. They moved Chinese operations to Hong Kong, but operate uncensored there.
  - bumblebeard 9y ago
    Google was perfectly willing to self-censor in China until they were hacked by the Chinese government in 2010. That's when Google China moved to Hong Kong. https://googleblog.blogspot.com/2010/01/new-approach-to-china.html https://googleblog.blogspot.com/2010/01/new-approach-to-chin...
- matt4711 9y ago
  I think china blocks zh.wikipedia.org but all other languages are not blocked.
  - kalleboo 9y ago
    When I visited China a bunch of years ago, zh.wikipedia was completely blocked, and on English wikipedia, only certain articles were deadholed (tiananmen square...)
  - Bakary 9y ago
    I just tested a few pages and it looks like you are right.

Edmond 9y ago

For committed governments like China, TLS may just be an extra hurdle but they can get around it if they want. Basically China could simply implement a massive proxy that terminates TLS. If your internet traffic is going to flow through infrastructure that a curious government owns, then you'll know that they're monitoring the traffic but there is no way to keep them from seeing what you're doing.

matt123 9y ago
No, TLS is not vulnerable to a MITM unless a) your client trusts the certificates issued by the attacker, or b) the attacker successfully forges the certificate of the website you are trying to visit. That is, assuming you don't click away your browser's security warning. https://security.stackexchange.com/questions/8145/does-https-prevent-man-in-the-middle-attacks-by-proxy-server#8309 https://security.stackexchange.com/questions/8145/does-https...
- Edmond 9y ago
  It isn't but if you live in China and want to use the internet, you'll likely be forced to use a proxy that MITMs and serves its own certificate....My point is that TLS is not a solution to prevent government interference when the user has to rely on the government infrastructure for access.
  - throwaway2048 9y ago
    This is not how the great firewall works, check the facts known, not just baseless speculatation.
    - comex 9y ago
      Not how it currently works. The parent was referring to hypothetical future changes.
- ars 9y ago
  > TLS is not vulnerable to a MITM unless a) your client trusts the certificates issued by the attacker, Or in other words it is vulnerable. China can (and probably does) issue a certificate that all Chinese browsers must install, they can then do MITM https using their certificate to sign the new versions. Companies do this routinely BTW. Since it's their equipment, it's considered just fine. (But be aware of it if you are using a company computer.)

ishitatsuyuki 9y ago

Note that the server certs are also parsable even if you're not using SNI.

raverbashing 9y ago

DNS requests are still transparent