4 ms·

Russian government wants to make use of HTTPS illegal

25 points by ivan_gammel 6y ago

ivan_gammel 6y ago
The text of the draft legislation translated to English: „...Clause 2 of Article 10 shall be supplemented with the following paragraphs: "It is prohibited to use encryption protocols on the territory of the Russian Federation that allow you to hide the name (identifier) Internet pages or site on the Internet, except for cases established by the legislation of the Russian Federation. Violation of the prohibition on the use in the Russian Federation of encryption protocols that allow hiding the name (identifier) of a web page or site on the Internet shall entail the suspension of the functioning of the Internet resource no later than 1 (one) business day from the day the violation was discovered by the authorized federal executive body.“
- JPLeRouzic 6y ago
  > to hide the name (identifier) Internet pages or site on the Internet I may be a bit rusty, but if it is forbidden to hide the URL of a web site, it does not forbid HTTPS. (edit: I am wrong, thanks for the comments)
  - jolmg 6y ago
    I didn't downvote, but > in HTTPS the URL is in clear. You can see the domain from a previous DNS query, but the URL requested is encrypted. Everything HTTP is encapsulated in TLS.
    - ivan_gammel 6y ago
      ...and the explaining letter attached to the draft explicitly mentions both TLS 1.3 and DNS over HTTPS.
    - deleted 6y ago
      [deleted]
    - Xylakant 6y ago
      You don’t need the DNS query to get the host name/domain: The hostname is sent in clear before the TLS connection is established, otherwise name based virtual hosting would break with TLS. The host would not know which certificate to present. The feature is called SNI - Server Name Indication. AFAIK encrypted SNI is being worked on, but I haven’t followed the latest developments.
maxbaines 6y ago
Good to see the site it's self uses HTTPS
- m-p-3 6y ago
  "except for cases established by the legislation of the Russian Federation" would probably apply here.
plan_c 6y ago
they want to forbid esni, not https: https://en.wikipedia.org/wiki/Server_Name_Indication#Encrypted_Client_Hello https://en.wikipedia.org/wiki/Server_Name_Indication#Encrypt...
danielEM 6y ago
Well, these moves are to protect status quo of Russia's people in power (political and economical). Despite of their best efforts, they're loosing now Belarus, they've lost completely Ukraine, all they're left is to make sure they will keep control in their own country.

25 points by ivan_gammel 6y ago

The text of the draft legislation translated to English: „...Clause 2 of Article 10 shall be supplemented with the following paragraphs: "It is prohibited to use encryption protocols on the territory of the Russian Federation that allow you to hide the name (identifier) Internet pages or site on the Internet, except for cases established by the legislation of the Russian Federation. Violation of the prohibition on the use in the Russian Federation of encryption protocols that allow hiding the name (identifier) of a web page or site on the Internet shall entail the suspension of the functioning of the Internet resource no later than 1 (one) business day from the day the violation was discovered by the authorized federal executive body.“

JPLeRouzic 6y ago
> to hide the name (identifier) Internet pages or site on the Internet I may be a bit rusty, but if it is forbidden to hide the URL of a web site, it does not forbid HTTPS. (edit: I am wrong, thanks for the comments)
- jolmg 6y ago
  I didn't downvote, but > in HTTPS the URL is in clear. You can see the domain from a previous DNS query, but the URL requested is encrypted. Everything HTTP is encapsulated in TLS.
  - ivan_gammel 6y ago
    ...and the explaining letter attached to the draft explicitly mentions both TLS 1.3 and DNS over HTTPS.
  - deleted 6y ago
    [deleted]
  - Xylakant 6y ago
    You don’t need the DNS query to get the host name/domain: The hostname is sent in clear before the TLS connection is established, otherwise name based virtual hosting would break with TLS. The host would not know which certificate to present. The feature is called SNI - Server Name Indication. AFAIK encrypted SNI is being worked on, but I haven’t followed the latest developments.

maxbaines 6y ago

Good to see the site it's self uses HTTPS

m-p-3 6y ago
"except for cases established by the legislation of the Russian Federation" would probably apply here.

plan_c 6y ago

they want to forbid esni, not https: https://en.wikipedia.org/wiki/Server_Name_Indication#Encrypted_Client_Hello https://en.wikipedia.org/wiki/Server_Name_Indication#Encrypt...

danielEM 6y ago

Well, these moves are to protect status quo of Russia's people in power (political and economical). Despite of their best efforts, they're loosing now Belarus, they've lost completely Ukraine, all they're left is to make sure they will keep control in their own country.