4 ms·
You don't really always need a VPN to bypass SNI based censorship since most implementations give-up on reading SNI when the ClientHello TCP segment is split ov
by ignoramous 6y ago
You don't really always need a VPN to bypass SNI based censorship since most implementations give-up on reading SNI when the ClientHello TCP segment is split over two IP packets [0] (apologies John Nagle [1]). Besides, there are various tricks just at the TCP-level that could be employed to bypass SNI related attacks [2] (though, a pretty competent firewall/censor would remain unaffected, which is where ESNI comes in).
Re: DNS-layer security: It is really not that hard to bypass it and if folks are subject to phishing via IDN homographic attacks (ex: https://www.аррӏе.com/ https://www.xn--80ak6aa92e.com/) or typo-squatting attacks (ex: googel.com) then it is time for Firefox to up its game and improve upon DoH to tackle those, as well. Extensions are helpful too, but how many people care enough to remember and install those [3]?
Between HSTS (or https-everywhere [4]), DoH (thanks Mozilla!), ESNI (thanks Mozilla!), and domain-fronting [5] (thanks CDNs!) we've got a pretty good VPN-free future to look forward to in terms of anti-censorship which is what most users use it for (sure, if you care enough to not leak your IP address, discounting the fact that device / browser fingerprinting is a thing, then VPN helps, but by how much? [6]).
The VPN industry does a lot of "scareware" marketing, I feel, and ESNI is a potential existential threat to them. Time will tell.
[0] https://twitter.com/vinifortuna/status/1304189371688660992 https://twitter.com/vinifortuna/status/1304189371688660992
[1] https://en.wikipedia.org/wiki/Nagle%27s_algorithm https://en.wikipedia.org/wiki/Nagle%27s_algorithm
[2] https://geneva.cs.umd.edu/posts/china-censors-esni/esni/ https://geneva.cs.umd.edu/posts/china-censors-esni/esni/
[3] Not sure if uBlock Origin defends against such attacks, but wouldn't it be rad if it did?
[4] https://www.eff.org/https-everywhere https://www.eff.org/https-everywhere
[5] https://en.wikipedia.org/wiki/Domain_fronting https://en.wikipedia.org/wiki/Domain_fronting
[6] https://news.ycombinator.com/item?id=19601503 https://news.ycombinator.com/item?id=19601503
- danShumway 6y agoIP addresses matter for tracking. If they didn't, then Tor wouldn't exist. Of course a VPN is strictly worse than Tor, but it's often strictly better than a straight connection from your ISP. Knowing my IP address would get you within 5 miles of my house on most geo lookups, and that's information I'm transmitting to literally every single website that I visit. > discounting the fact that device / browser fingerprinting is a thing Device fingerprinting is something I can (to some extent) control locally on a site-by-site basis. I can disable Javascript, I can use containers, I can (to some extent) inspect what data websites can transmit. I can't control what a website does with my IP address, and I can't see how they store it or transmit it. Again, to the privacy fatalists who think that protecting against fingerprinting is impossible: why is Tor wasting its time with features like letterboxing? Why is anyone in the advertising industry getting worked up about 3rd-party cookie blocking if that doesn't matter? Do you think that Mozilla/Apple are wasting their time by trying to harden the browser interface? ---- I'm kind of done arguing with people about this, so my position has evolved. My new advice is that if you think that moving trust is a fundamentally broken, universally bad idea, then you don't have to move trust. Don't buy a VPN. But in that case, you should still be thinking about setting up your own VPN on a remote server. That will give you most of the same privacy benefits. It won't make it harder to build up profiles on you, but it'll still mask your physical location, it'll still give you some level of disassociation between your physical identity and your online identity. In the US, it'll still mean that you're moving trust away from known hostile entities (ISPs and routers). It won't protect you from the FBI, but the point of a VPN is not to protect you from the FBI. And honestly, deploying your own VPN on a remote server is simpler than trying to figure out whether or not DoH security is good enough to rely on yet (it's not, Firefox falls back on regular DNS when DoH fails), and whether or not ESNI is being widely used on most domains (it's not). Especially now that Wireguard has really come into its own and simplified this process, learning one thing is easier than trying to keep up to date with a dozen half-implemented security features. Anyone who doesn't have the technical chops to deploy a Wireguard server on Linode also probably doesn't have the technical chops to talk about ESNI and DoH. Because Troy is completely right -- as nice as those technologies are, they aren't widely deployed enough or correctly deployed often enough to rely on as more than a defense in depth.
- ignoramous 6y agoI don't necessarily disagree with your points. In fact, I am in agreement [0]. My observation is that most VPN users use it for anti-censorship. And as for the points Tory raised (VPNs as a security measure against phishing et al), most of them are better mitigated on-the-client like how Tor works so hard to mitigate browser fingerprinting on-the-client as well, for example. Of course, I never touched upon anti-surveillance, and if that's your threat-model, VPN is absolutely a necessity amongst a myriad of other things [1]. [0] https://news.ycombinator.com/item?id=19603091 https://news.ycombinator.com/item?id=19603091 [1] https://news.ycombinator.com/item?id=21601031 https://news.ycombinator.com/item?id=21601031
- Causality1 6y agoI think "most VPN users use it for anti-censorship" is an unfounded opinion. Going strictly by people I know and the marketing materials from. VPN providers, most commercial VPN users use it for piracy.