3 ms·
> There are benefits (censorship circumvention) to be reaped, but also great peril. There is no way this encrypted SNI could enable censorship circumvention.
by zzzcpan 8y ago
> There are benefits (censorship circumvention) to be reaped, but also great peril.
There is no way this encrypted SNI could enable censorship circumvention.
- toomuchtodo 8y agoMy understanding was that encrypted SNI was to avoid the sniffing of the host header that travels unencrypted with SNI, and that in combination with a large host (Cloudflare, Google, AWS), an encrypted SNI prevents censorship (unless you're dropping all traffic to the IP block or AS). Is this understanding inaccurate?
- vetinari 8y agoIf you are state-level actor wanting to censor, the ISPs in your country you will ask politely the large host (Cloudflare, Google, AWS) to cooperate and drop any traffic coming for the censored domain from their IP ranges. Only if the large host does not cooperate, the respective ISPs will block their entire IP range, (if they want to keep operating in given jurisdiction).
- toomuchtodo 8y agoAll roads lead to layer 8.
- zzzcpan 8y agoThis is what was their public reasoning, but it ignores all the research and ideas in censorship circumvention from Tor, Signal, Telegram, why domain fronting didn't work and why collateral freedom doesn't work if there is a corporation to pressure, etc. At this point I believe it was entirely PR if not deception to centralize DNS.