5 ms·
It seems to me that all of the changes described in this story will contribute to thwarting intermediaries and their agendas. HTTP/2 and its "effective" encryp
by topspin 9y ago
It seems to me that all of the changes described in this story will contribute to thwarting intermediaries and their agendas. HTTP/2 and its "effective" encryption requirement are proof against things like Comcast's nasty JavaScript injection[1]. QUIC has mandatory encryption all the way down; even ACKs are encrypted, obviating some of the traditional throttling techniques. And as you say TLS 1.3 and DOH further protect traffic from analysis and manipulation by middlemen.
Perhaps our best weapon against Internet rent seekers and spooks is technical innovation.
It is astonishing to me that Google can invent QUIC, deploy it on their network+Chrome and boom! 7% of all Internet traffic is QUIC.
Traditional HTTP over TCP and traditional DNS are becoming a ghetto protocol stack; analysis of such traffic is sold to who knows whom, the content is subject to manipulation by your ISP, throttling is trivial and likely to become commonplace with Ajit Pai et al. Time to pull the plug on these grifters and protect all the traffic.
[1] https://news.ycombinator.com/item?id=15890551 https://news.ycombinator.com/item?id=15890551
- zb3 9y agoBut I, as an user, want to be able to block domains, inject scripts and see what Chrome is sending to Google on my own devices (which is what Google doesn't want me to do). That's why I can't support these protocols...
- JoshTriplett 9y agoYou, as a user, absolutely can. An ISP or network administrator who does not control the endpoints, on the other hand, cannot, by design. That's a feature.
- fiddlerwoaroof 9y agoWhat if I want to use my router to block telemetry domains? Or other malware sites? It’s looking like the only way forward is running my own CA to mitm all encrypted traffic.
- JoshTriplett 9y ago> It’s looking like the only way forward is running my own CA to mitm all encrypted traffic. Correct. Middleboxes should be presumed hostile; if you control the endpoints you can install a MITM CA, but it's safer to put what you want directly on the endpoint.
- aoeusnth1 9y agoThat seems superior anyway - you could keep blocking domains even when you're on the go.
- kuschku 9y agoCan I? On Android, apps now can decide if they want to accept user-installed CAs, or not. So if an app is hostile (say, all the Google apps), then I have no way to intercept their traffic anymore.
- pas 9y agoYou can decide to install the app or not. And you can put your CA into the system CA store if you have root. (You can make an Android image, so technically the requirement is unlocked - unlockable - bootloader.)
- kuschku 9y agoUnlocking the bootloader makes the device permanently fail the strictest SafetyNet category. Apps can and will refuse to run in that situation. Modifying /system will make every SafetyNet check fail, as result Netflix, Snapchat, Google Play Movies, and most banking apps will refuse to run. I can decide to install the app or not? How do I go about replacing Google's system apps with my own, without preventing above mentioned apps from running? I can't. And I can't buy reasonable devices withou Google Android, due to the non-compete clause in the OEM contracts.
- pas 9y ago
- jacksmith21006 9y agoIncorrect. You can on your end but Google stops the people in the middle which is what we want.
- zb3 9y agoHow can I decrypt QUIC traffic then? Do Wireshark and mitmproxy support QUIC? Will DOH respect /etc/hosts files?
- slrz 9y agoPatch your program to dump the keys or traffic?
- zb3 9y agoI know that I could edit the source code and recompile the program. I know I could disassemble the binary, find out addresses of functions and then use things like uprobes to dump/modify registers/memory. I know that in theory I could write my own version of mitmproxy that supports QUIC. But I don't have time to do all that, and that's why I speak against those protocols (which changes nothing anyway)