4 ms·

ISPs can still see the IP your requests resolves to, and in many cases can still track this info. Unless the site is using shared IP, like many behind caching s

ISPs can still see the IP your requests resolves to, and in many cases can still track this info. Unless the site is using shared IP, like many behind caching services, etc

mantap 7y ago
To your caveat, I can access thepiratebay even though it is supposedly IP blocked in the UK because the courts are not willing to order a block of the whole cloudflare IP range. With so many websites using cloud hosting, it has become very hard for the authorities to block IP ranges. DNS is really the last bastion of government interference. The UK is supposed to be rolling out a nation-wide porn block at some point but it will be totally defeated by encrypted DNS.
- deleted 7y ago
  [deleted]
- deleted 7y ago
  [deleted]
- throwawaydoh 7y ago
  My Indian ISP blocks certain sites. I use Firefox and has DNS over HTTPS with CloudFlare enabled. I also use CloudFlare's 1.1.1.1 DNS in my router. The sites are still blocked. Firefox shows the error "Secure Connection Failed. An error occurred during a connection to 'site url'. PR_CONNECT_RESET_ERROR". When I search for this error, one of the first results say "this behavior is fairly typical for DPI firewalls". To anyone knowledgeable about this: How can I confirm if my ISP is using DPI?
  - StreamBright 7y ago
    https://security.stackexchange.com/questions/108985/is-it-possible-to-detect-dpi-deep-packet-inspection https://security.stackexchange.com/questions/108985/is-it-po...
  - tgragnato 7y ago
    Find an (allegedly) blocked website that is using CloudFlare and has TLS 1.3 enabled. In about:config set network.trr.mode=3, network.security.esni.enabled=true, security.OCSP.enabled=0, security.tls.version.max=4, security.tls.version.min=4. Exit, open Firefox again; if the website loads, then your ISP is using a DPI middlebox.
    - throwawaydoh 7y ago
      Thank you. Unfortunately, I wasn't able to find a blocked site that has TLS 1.3 enabled. I checked 3 blocked sites after enabling the options you suggested. They were still blocked. I confirmed all 3 didn't have TLS 1.3 by testing them with ssllabs ssltest. All had results show TLS 1.3 as "No".
      - tgragnato 7y ago
        Expected, without esni (which requires tls1.3) there’s no way to conceal the domain from the boxes. Or.. your ISP might be blocking the IPs. Remember to revert the settings to the original values.

ISPs can still see the IP your requests resolves to, and in many cases can still track this info. Unless the site is using shared IP, like many behind caching services, etc

mantap 7y ago

To your caveat, I can access thepiratebay even though it is supposedly IP blocked in the UK because the courts are not willing to order a block of the whole cloudflare IP range. With so many websites using cloud hosting, it has become very hard for the authorities to block IP ranges. DNS is really the last bastion of government interference. The UK is supposed to be rolling out a nation-wide porn block at some point but it will be totally defeated by encrypted DNS.

deleted 7y ago
[deleted]
deleted 7y ago
[deleted]
throwawaydoh 7y ago
My Indian ISP blocks certain sites. I use Firefox and has DNS over HTTPS with CloudFlare enabled. I also use CloudFlare's 1.1.1.1 DNS in my router. The sites are still blocked. Firefox shows the error "Secure Connection Failed. An error occurred during a connection to 'site url'. PR_CONNECT_RESET_ERROR". When I search for this error, one of the first results say "this behavior is fairly typical for DPI firewalls". To anyone knowledgeable about this: How can I confirm if my ISP is using DPI?
- StreamBright 7y ago
  https://security.stackexchange.com/questions/108985/is-it-possible-to-detect-dpi-deep-packet-inspection https://security.stackexchange.com/questions/108985/is-it-po...
- tgragnato 7y ago
  Find an (allegedly) blocked website that is using CloudFlare and has TLS 1.3 enabled. In about:config set network.trr.mode=3, network.security.esni.enabled=true, security.OCSP.enabled=0, security.tls.version.max=4, security.tls.version.min=4. Exit, open Firefox again; if the website loads, then your ISP is using a DPI middlebox.
  - throwawaydoh 7y ago
    Thank you. Unfortunately, I wasn't able to find a blocked site that has TLS 1.3 enabled. I checked 3 blocked sites after enabling the options you suggested. They were still blocked. I confirmed all 3 didn't have TLS 1.3 by testing them with ssllabs ssltest. All had results show TLS 1.3 as "No".
    - tgragnato 7y ago
      Expected, without esni (which requires tls1.3) there’s no way to conceal the domain from the boxes. Or.. your ISP might be blocking the IPs. Remember to revert the settings to the original values.