42 ms·

How does foreign cloud provider matters. As of now encrypted SNI is not there, so they can block simply based on SNI. If SNI info is not correct, they can ask t

How does foreign cloud provider matters. As of now encrypted SNI is not there, so they can block simply based on SNI. If SNI info is not correct, they can ask the foreign cloud provider to block the website. Any cloud provider where SNI block won't work well is large enough to not deny requests from the french government.

prussian 6y ago
Not that you're wrong, but passively sniffing SNI's is much more involved than DNS replying with an incorrect IP. Maybe countries highly invested in it like China can do it.
c22 6y ago
Not sure why you got downvoted, this is totally a thing that happens [0] [0] https://www.bleepingcomputer.com/news/security/south-korea-is-censoring-the-internet-by-snooping-on-sni-traffic/ https://www.bleepingcomputer.com/news/security/south-korea-i...
mantap 6y ago
In the long term plaintext SNI is going away. I'm not convinced that France can implement such a system much faster than TLS WG can thwart it. Also while some US cloud providers might cooperate I doubt that in particular Cloudflare would. It only takes one.
- enitihas 6y ago
  In the long term things are hard to predict. If we look from 2010, E2E encryption wasn't there, or atleast not in a form usable by the masses. E2E is now here, and is as easy as using Signal. However, you see countries making laws against it. I doubt they will let eSNI pass through. And eSNI will be much easier to block, since you don't need to block it for consumers, you just need to impose big fines on businesses using it, since any such business will need to earn money somehow from their customers in the country. Unlike E2E, you don't have to worry about some random person forking signal and running their own servers. And video on internet is expensive enough that only an entity with good bank balance can do it, thus easy to punish with economic fines.

prussian 6y ago

Not that you're wrong, but passively sniffing SNI's is much more involved than DNS replying with an incorrect IP. Maybe countries highly invested in it like China can do it.

c22 6y ago

Not sure why you got downvoted, this is totally a thing that happens [0] [0] https://www.bleepingcomputer.com/news/security/south-korea-is-censoring-the-internet-by-snooping-on-sni-traffic/ https://www.bleepingcomputer.com/news/security/south-korea-i...

mantap 6y ago

In the long term plaintext SNI is going away. I'm not convinced that France can implement such a system much faster than TLS WG can thwart it. Also while some US cloud providers might cooperate I doubt that in particular Cloudflare would. It only takes one.

enitihas 6y ago
In the long term things are hard to predict. If we look from 2010, E2E encryption wasn't there, or atleast not in a form usable by the masses. E2E is now here, and is as easy as using Signal. However, you see countries making laws against it. I doubt they will let eSNI pass through. And eSNI will be much easier to block, since you don't need to block it for consumers, you just need to impose big fines on businesses using it, since any such business will need to earn money somehow from their customers in the country. Unlike E2E, you don't have to worry about some random person forking signal and running their own servers. And video on internet is expensive enough that only an entity with good bank balance can do it, thus easy to punish with economic fines.