5 ms·

We need something that tunnels over HTTPS/Websockets, and utilizes domain fronting [1] with e.g. Google Cloud or Azure. Ideally it'd also work over WebRTC in un

We need something that tunnels over HTTPS/Websockets, and utilizes domain fronting [1] with e.g. Google Cloud or Azure. Ideally it'd also work over WebRTC in unreliable mode, but I'm not sure that works with domain fronting. [1] https://bamsoftware.com/papers/fronting/ https://bamsoftware.com/papers/fronting/ // edit: why the downvotes?

jerheinze 9y ago
> We need something that tunnels over HTTPS/Websockets, and utilizes domain fronting [1] with e.g. Google Cloud or Azure. Ideally it'd also work over WebRTC in unreliable mode, but I'm not sure that works with domain fronting. The Tor Browser already comes with the meek transport[1] that uses domain fronting, one with Amazon and the other with Azure. There's also a recent PT titled snowflake[2], that uses WebRTC to connect to short lived proxies that people can make by just running some JS code in their browser, it's currently available in the alpha builds for Linux and Mac. Note that meek is expensive, and the Tor Project pays for each byte. It should only be used when no other PT works. [1] : https://trac.torproject.org/projects/tor/wiki/doc/meek https://trac.torproject.org/projects/tor/wiki/doc/meek [2] : https://trac.torproject.org/projects/tor/wiki/doc/Snowflake https://trac.torproject.org/projects/tor/wiki/doc/Snowflake
- int_19h 9y ago
  The problem is that any website that allows domain fronting is itself illegal under this new law, and can be blocked on those grounds.
  - lgierth 9y ago
    The idea of domain fronting though is that the fronting website is "expensive" to block that the censor won't do it. As with everything else, this isn't a 100% technical solution, it has a political component of how expensive the fronting website is to block.
    - codedokode 9y ago
      Many users in Russia use russian social network (Vkontakte), russian email services and russian search engine (Yandex). There is also popular dating service (Badoo). So Google and Facebook can be blocked without causing much trouble. But there is no good replacement for Youtube and Android Store (yet).
- lgierth 9y ago
  Ah nice, I didn't know meek does domain fronting too, and thanks for mentioning snowflake.
subliminalpanda 9y ago
Openvpn over stunnel can somewhat already do this, albeit at a performance hit.
joshka 9y ago
One more idea to add to this (that sits on top of the idea that the distributed internet heals itself from attacks) would be to make it super simple for every HTTPS site to donate a portion of its bandwidth to defeating censorship. Imagine a world where VPN traffic was indistinguishable from a normal browsing session.
y_u_no_rust 9y ago
that just sounds gross a better idea would be to just ditch the browser/http stack

jerheinze 9y ago

> We need something that tunnels over HTTPS/Websockets, and utilizes domain fronting [1] with e.g. Google Cloud or Azure. Ideally it'd also work over WebRTC in unreliable mode, but I'm not sure that works with domain fronting. The Tor Browser already comes with the meek transport[1] that uses domain fronting, one with Amazon and the other with Azure. There's also a recent PT titled snowflake[2], that uses WebRTC to connect to short lived proxies that people can make by just running some JS code in their browser, it's currently available in the alpha builds for Linux and Mac. Note that meek is expensive, and the Tor Project pays for each byte. It should only be used when no other PT works. [1] : https://trac.torproject.org/projects/tor/wiki/doc/meek https://trac.torproject.org/projects/tor/wiki/doc/meek [2] : https://trac.torproject.org/projects/tor/wiki/doc/Snowflake https://trac.torproject.org/projects/tor/wiki/doc/Snowflake

int_19h 9y ago
The problem is that any website that allows domain fronting is itself illegal under this new law, and can be blocked on those grounds.
- lgierth 9y ago
  The idea of domain fronting though is that the fronting website is "expensive" to block that the censor won't do it. As with everything else, this isn't a 100% technical solution, it has a political component of how expensive the fronting website is to block.
  - codedokode 9y ago
    Many users in Russia use russian social network (Vkontakte), russian email services and russian search engine (Yandex). There is also popular dating service (Badoo). So Google and Facebook can be blocked without causing much trouble. But there is no good replacement for Youtube and Android Store (yet).
lgierth 9y ago
Ah nice, I didn't know meek does domain fronting too, and thanks for mentioning snowflake.

subliminalpanda 9y ago

Openvpn over stunnel can somewhat already do this, albeit at a performance hit.

joshka 9y ago

One more idea to add to this (that sits on top of the idea that the distributed internet heals itself from attacks) would be to make it super simple for every HTTPS site to donate a portion of its bandwidth to defeating censorship. Imagine a world where VPN traffic was indistinguishable from a normal browsing session.

y_u_no_rust 9y ago

that just sounds gross a better idea would be to just ditch the browser/http stack