4 ms·

It is actually a good idea to use https rather than your own protocol because then your network provider/government will not be able to (easily) find out that y

It is actually a good idea to use https rather than your own protocol because then your network provider/government will not be able to (easily) find out that you aren't just making https requests using your browser. Useful for people living in oppressive governments as well as employees/students under restrictive firewalls. In addition to that this will get more efficient once we have http over quic.

BlueTemplar 7y ago
Quic seems to be the UDP equivalent to TCPcrypt? Both of which should be used by default on the Internet? But why should in your examples "the authorities" care or not whether you are using a browser over HTTP(S) or any other kind of software/protocol? If any communication channel is available, it's possible to send any kind of VPN traffic through it. Bits are bits. Especially when encrypted, so the censor has no idea as to what is inside...
- BlueTemplar 7y ago
  Also, IPSec.
- dependenttypes 7y ago
  > But why should in your examples "the authorities" care or not whether you are using a browser over HTTP(S) or any other kind of software/protocol? You are going to be more suspicious if you are using $protocol-specific-for-encrypted-chat than if you are just browing the web. > Bits are bits I agree, but this does not stop my ISP from throttling my SSH speed.
Uehreka 7y ago
Bear in mind that when students and employees are on their school/work network, they often have to accept the network admin's certificate authority in order to be allowed to connect to the network. So effectively, the network admin can spoof SSL certificates and MITM traffic, even if it's encrypted.
- pmontra 7y ago
  If that's part of the threat model, a layer 7 protocol can encrypt and sign the payload. Then anybody terminating the connection wouldn't be able to read and modify messages. There are also replay attacks and probably many other issues I can't think about. Maybe some IM protocol already deals with that.
ppjet6 7y ago
You can also do XMPP over HTTP (long-polling aka bosh, or websockets). If people really want to add a layer, it is doable :)

BlueTemplar 7y ago

Quic seems to be the UDP equivalent to TCPcrypt? Both of which should be used by default on the Internet? But why should in your examples "the authorities" care or not whether you are using a browser over HTTP(S) or any other kind of software/protocol? If any communication channel is available, it's possible to send any kind of VPN traffic through it. Bits are bits. Especially when encrypted, so the censor has no idea as to what is inside...

BlueTemplar 7y ago
Also, IPSec.
dependenttypes 7y ago
> But why should in your examples "the authorities" care or not whether you are using a browser over HTTP(S) or any other kind of software/protocol? You are going to be more suspicious if you are using $protocol-specific-for-encrypted-chat than if you are just browing the web. > Bits are bits I agree, but this does not stop my ISP from throttling my SSH speed.

Uehreka 7y ago

Bear in mind that when students and employees are on their school/work network, they often have to accept the network admin's certificate authority in order to be allowed to connect to the network. So effectively, the network admin can spoof SSL certificates and MITM traffic, even if it's encrypted.

pmontra 7y ago
If that's part of the threat model, a layer 7 protocol can encrypt and sign the payload. Then anybody terminating the connection wouldn't be able to read and modify messages. There are also replay attacks and probably many other issues I can't think about. Maybe some IM protocol already deals with that.

ppjet6 7y ago

You can also do XMPP over HTTP (long-polling aka bosh, or websockets). If people really want to add a layer, it is doable :)