3 ms·

Use DNS over HTTP. Firefox is very easily configurable (network.trr.bootstrapAddress, network.trr.mode, etc) so that if you pick the right bootstrap provider an

Use DNS over HTTP. Firefox is very easily configurable (network.trr.bootstrapAddress, network.trr.mode, etc) so that if you pick the right bootstrap provider and DNS over HTTP provider you'll never send an unencrypted DNS query (including no SNIs) and it will fail completely rather than reverting to your OS's DNS Client if it cannot be resolved via the DNS over HTTP channel you define. Because the S3 buckets are virtual-hosted they share IPs so there is deniability if you can hide the DNS/SNI.

aaomidi 8y ago
Yes but https SNI still exists.
- simcop2387 8y ago
  TLS v1.3 finally addresses this, https://blog.cloudflare.com/encrypted-sni/ https://blog.cloudflare.com/encrypted-sni/
  - yardstick 8y ago
    I expect this will only work until the government in question is sufficiently angered that they just outright block the entire AWS infrastructure. Or whoever else supports ESNI.
    - Spivak 8y ago
      But the only reason domain fronting works in the first place is because people think that large web hosting providers are too large to block. If a hypothetical tyrantical government was willing to block all of Amazon S3 this change doesn't affect anything.
      - yardstick 8y ago
        If it impacted Amazon’s (or whoever is targeted) bottom line then I would expect they would be open to dropping domain fronting support. But I admit I don’t know this for sure - time will tell. China has blocked GitHub and Akamai before. https://www.latimes.com/business/technology/la-fi-tn-great-firewall-china-censorship-20141126-story.html https://www.latimes.com/business/technology/la-fi-tn-great-f...
    - shawnz 8y ago
      But the alternative, which is to just not force this virtual host change in the first place, similarly might have gotten AWS blocked from those countries anyway
  - samat 8y ago
    We need this in Chrome, badly.
  - tialaramex 8y ago
    TLS 1.3 was completed, published as RFC 8446 but eSNI is still a work in progress. You need TLS 1.3 because in prior versions the certificate is transmitted plaintext, but eSNI itself is not part of TLS 1.3 and is still actively being worked on as https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ https://datatracker.ietf.org/doc/draft-ietf-tls-esni/
    - deleted 8y ago
      [deleted]
- geofft 8y ago
  This isn't a general-case solution (because you can no longer just give someone a link), but, can't you send "s3.amazonaws.com" or really any other bucket name in the SNI and give the full bucket name in the Host header inside the encrypted channel? Or does S3 block SNI/Host mismatches?
  - tedunangst 8y ago
    They will possibly block mismatches (I believe they do for cloudfront etc. now), but also if the point of moving to sub domains is sharding, there's no guarantee the bucket you want is behind the faked hostname you connected to.
  - agwa 8y ago
    This currently works, but considering their crackdown on domain fronting last year, I don't expect it to work for much longer.
tirumaraiselvan 8y ago
Did you mean use DNS over HTTPS?

aaomidi 8y ago

Yes but https SNI still exists.

simcop2387 8y ago
TLS v1.3 finally addresses this, https://blog.cloudflare.com/encrypted-sni/ https://blog.cloudflare.com/encrypted-sni/
- yardstick 8y ago
  I expect this will only work until the government in question is sufficiently angered that they just outright block the entire AWS infrastructure. Or whoever else supports ESNI.
  - Spivak 8y ago
    But the only reason domain fronting works in the first place is because people think that large web hosting providers are too large to block. If a hypothetical tyrantical government was willing to block all of Amazon S3 this change doesn't affect anything.
    - yardstick 8y ago
      If it impacted Amazon’s (or whoever is targeted) bottom line then I would expect they would be open to dropping domain fronting support. But I admit I don’t know this for sure - time will tell. China has blocked GitHub and Akamai before. https://www.latimes.com/business/technology/la-fi-tn-great-firewall-china-censorship-20141126-story.html https://www.latimes.com/business/technology/la-fi-tn-great-f...
  - shawnz 8y ago
    But the alternative, which is to just not force this virtual host change in the first place, similarly might have gotten AWS blocked from those countries anyway
- samat 8y ago
  We need this in Chrome, badly.
- tialaramex 8y ago
  TLS 1.3 was completed, published as RFC 8446 but eSNI is still a work in progress. You need TLS 1.3 because in prior versions the certificate is transmitted plaintext, but eSNI itself is not part of TLS 1.3 and is still actively being worked on as https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ https://datatracker.ietf.org/doc/draft-ietf-tls-esni/
  - deleted 8y ago
    [deleted]
geofft 8y ago
This isn't a general-case solution (because you can no longer just give someone a link), but, can't you send "s3.amazonaws.com" or really any other bucket name in the SNI and give the full bucket name in the Host header inside the encrypted channel? Or does S3 block SNI/Host mismatches?
- tedunangst 8y ago
  They will possibly block mismatches (I believe they do for cloudfront etc. now), but also if the point of moving to sub domains is sharding, there's no guarantee the bucket you want is behind the faked hostname you connected to.
- agwa 8y ago
  This currently works, but considering their crackdown on domain fronting last year, I don't expect it to work for much longer.

tirumaraiselvan 8y ago

Did you mean use DNS over HTTPS?