4 ms·
> simply using a domain name you dont own in the SNI header just because it is terminated at the same service as you want to use is something you cannot do Why
by nebulous1 8y ago
> simply using a domain name you dont own in the SNI header just because it is terminated at the same service as you want to use is something you cannot do
Why not out of curiosity? I'm not disputing Amazon's right to disallow this (it's their service after all), but before that I don't see any objective reason why this is something they they "cannot" or even "should not" do. Also, unless Amazon put in a technical barrier (which they are in the process of doing), then they can't stop a third party from doing it anyway (i.e. me personally sending a different domain in the SNI header than the one I actually end up communicating with), and on that level (ie me rather than Amazon's customer) I see no reason why I wouldn't do exactly that if my ISP was blocking the target domain.
- mvanbaak 8y ago> Why not out of curiosity? Because you are lying about what domain you want to access. This is against the TOS, and simply something you should not do. I know it helps signal to get around censorship and blocks, and it's technically working, but one should not do that.
- Tepix 8y agoYou are only pretending to contact a certain address during the (short) unencrypted phase of the request. As soon as encryption is present you reveal the real address you want to talk to. The only ones getting spoofed are the censors.
- mvanbaak 8y agoCorrect. But still it's something one should not do and is against the TOS of AWS Cloudfront.
- nebulous1 8y agoI'm not lying about anything. This entire system is designed so that the user can get what they're looking for, and the user is using it to get what they're looking for. Whether doing this as AWS's customer breaks their TOS is up for debate, but it's a fairly moot one as Amazon could easily change their TOS.