6 ms·

> So when you visit HTTPS sites, anyone along the communication path... can see their domain names (e.g. wikipedia.org) and when you visit them. But these parti

> So when you visit HTTPS sites, anyone along the communication path... can see their domain names (e.g. wikipedia.org) and when you visit them. But these parties can’t see the pages you visit on those sites (e.g. wikipedia.org/controversial-topic), your login name, or messages you send. I believe this is the reason Turkey blocked the entirety of Wikipedia[0], which was recently lifted[1]. They wanted to block specific pages that revealed negative information (and I believe they did at some point), but when Wikipedia went https only[2] the only avenue was to block the entire domain. 0: https://en.wikipedia.org/wiki/Block_of_Wikipedia_in_Turkey https://en.wikipedia.org/wiki/Block_of_Wikipedia_in_Turkey 1: https://wikimediafoundation.org/news/2020/01/15/access-to-wikipedia-restored-in-turkey-after-more-than-two-and-a-half-years/ https://wikimediafoundation.org/news/2020/01/15/access-to-wi... 2:

dkarras 7y ago
Am Turkish, and not really. There is no evidence of Turkey caring about what the individual citizens visit (except in case of a crime investigation etc.) Bans in Turkey works like this: Turkey sees something they don't like on the Internet, Turkey reaches the company / individuals behind it (they can be anywhere in the world) and tells them "take it down or we will block your access to Turkish citizens and you'll lose revenue / traffic". If the site owners comply nothing happens. If site owners refuse for any reason, they block the site so it is not accessible from Turkey. In the older days, they used to do it through DNS but it was easy to circumvent. Now they use other methods so changing your DNS isn't enough, but a VPN works just fine. This was also the case before https wasn't as common BTW. Turkey either didn't have the technical capability to block individual pages (even back then) or they were seeking to punish the site by blocking access in whole. A site like wikipedia values integrity more so they don't take pages down without good reason. But companies seeing Turkish citizens as a revenue source generally comply. If you browse Twitter in Turkey, it is common to see tweets where it just says something like "this tweet is blocked in your country" - Turkey reaches twitter to mark the tweet invisible and that individual tweet goes away. IIRC it also applies to entire profiles - I'm not a frequent twitter user but I remember seeing entire profiles blocked by country.
- frandroid 7y ago
  The parent post didn't mention individual citizens.
- duxup 7y ago
  I feel like asking the site to take something down ... is effectively caring about who sees it. Otherwise you wouldn't do that.
  - dkarras 7y ago
    Sorry I was not clearer. What I meant was an operation like in China where you have to be careful about what you look for on the Internet. I saw a video from China where the police was interrogating someone supposedly because of his remarks about police confiscating motorcycles in WeChat. They were actively mass monitoring, found someone they didn't like and took him in for intimidation and questioning, perhaps more. So in effect, they are monitoring what individuals are doing on the Internet to catch and punish them en masse. My point was this type of "watching citizens and snubbing those that look at things they are not supposed to see" thing is not (yet) a thing here. You can go ahead and "read" anything, they don't care (by that I mean nothing will happen to you) but they have a problem with the site being able to serve a Turkish audience here.
danShumway 7y ago
> But these parties can’t see the pages you visit on those sites (e.g. wikipedia.org/controversial-topic) This is... not entirely wrong, but overly simplified. My impression is that TLS fingerprinting is sometimes-to-often good enough to figure out which exact page of a static website that a user is visiting[0]. That's not to say TLS is useless, or that the fingerprinting isn't hard enough that some adversaries won't just give up, it's just that the protections are more complicated, and it's not quite as simple as just saying, "I have TLS, I'm fine." [0]: http://rabexc.org/posts/guessing-tls-pages http://rabexc.org/posts/guessing-tls-pages

dkarras 7y ago

Am Turkish, and not really. There is no evidence of Turkey caring about what the individual citizens visit (except in case of a crime investigation etc.) Bans in Turkey works like this: Turkey sees something they don't like on the Internet, Turkey reaches the company / individuals behind it (they can be anywhere in the world) and tells them "take it down or we will block your access to Turkish citizens and you'll lose revenue / traffic". If the site owners comply nothing happens. If site owners refuse for any reason, they block the site so it is not accessible from Turkey. In the older days, they used to do it through DNS but it was easy to circumvent. Now they use other methods so changing your DNS isn't enough, but a VPN works just fine. This was also the case before https wasn't as common BTW. Turkey either didn't have the technical capability to block individual pages (even back then) or they were seeking to punish the site by blocking access in whole. A site like wikipedia values integrity more so they don't take pages down without good reason. But companies seeing Turkish citizens as a revenue source generally comply. If you browse Twitter in Turkey, it is common to see tweets where it just says something like "this tweet is blocked in your country" - Turkey reaches twitter to mark the tweet invisible and that individual tweet goes away. IIRC it also applies to entire profiles - I'm not a frequent twitter user but I remember seeing entire profiles blocked by country.

frandroid 7y ago
The parent post didn't mention individual citizens.
duxup 7y ago
I feel like asking the site to take something down ... is effectively caring about who sees it. Otherwise you wouldn't do that.
- dkarras 7y ago
  Sorry I was not clearer. What I meant was an operation like in China where you have to be careful about what you look for on the Internet. I saw a video from China where the police was interrogating someone supposedly because of his remarks about police confiscating motorcycles in WeChat. They were actively mass monitoring, found someone they didn't like and took him in for intimidation and questioning, perhaps more. So in effect, they are monitoring what individuals are doing on the Internet to catch and punish them en masse. My point was this type of "watching citizens and snubbing those that look at things they are not supposed to see" thing is not (yet) a thing here. You can go ahead and "read" anything, they don't care (by that I mean nothing will happen to you) but they have a problem with the site being able to serve a Turkish audience here.

danShumway 7y ago

> But these parties can’t see the pages you visit on those sites (e.g. wikipedia.org/controversial-topic) This is... not entirely wrong, but overly simplified. My impression is that TLS fingerprinting is sometimes-to-often good enough to figure out which exact page of a static website that a user is visiting[0]. That's not to say TLS is useless, or that the fingerprinting isn't hard enough that some adversaries won't just give up, it's just that the protections are more complicated, and it's not quite as simple as just saying, "I have TLS, I'm fine." [0]: http://rabexc.org/posts/guessing-tls-pages http://rabexc.org/posts/guessing-tls-pages