23 ms·

Investigating TLS Blocking in India

210 points by ZnZirconium 6y ago

saagarjha 6y ago
> In the absence of a publicly available official list of blocked hostnames This is the icing on the cake right here. It's just awful that not only do websites get censored largely arbitrarily, there is no insight into the process and what is even blocked–the fact that someone had to literally check sites to see if they are being blocked (via a variety of different methods largely indistinguishable from a malicious actor :/) is just a truly horrible state to be in.
- wtmt 6y ago
  Yes, it’s frustrating to see the lack of transparency and the sheer futility in some cases to find who issued an order for what purpose in which jurisdiction affecting which ISPs. DuckDuckGo was blocked a couple of o this ago. The nebulous words “national security”, without any context, are used as the justification for blocking many sites.
  - throwaway8941 6y ago
    At least Indian authorities seem to be relatively open about the censorship. Here in Kazakhstan they simply block everything they want, taking down many "innocent" sites as collateral damage, and write it off as "temporary networking problems" and "works for me, what are you talking about?". For the past week I've had numerous problems connecting to TLS directly, without using a VPN. I still update my system directly from a mirror to avoid wasting limited data on a remote VM, that's how I discovered it personally. I worry they're trying to implement something nefarious behind the scenes, again.
aravindet 6y ago
Does anyone have insight into why College Humor (referenced in the article) is blocked in India? This seems unusual and I wonder what (if any) reasons were provided.
- dylz 6y ago
  Probably some toilet humour that the censors didn't like.
- wtmt 6y ago
  You have to understand that reasons aren’t provided for blocking, because the blocking orders may come from different authorities and may not be disclosed due to “national security” reasons. All that we can glean from a site being blocked is that someone influential (not necessarily from an arm of the government) got offended by the site and used some means to get it blocked. One can construct a list of hundreds of URLs and get a blocking order, with a few innocent ones slipped in between. Nobody will investigate the claims, and nobody can contest the claims before it’s ordered, but the order for blocking will be issued.
- as1mov 6y ago
  Another peculiar one being blocked (at least on Airtel) is Newgrounds. Not really sure what was going on when they decided to ban it.
  - jeroenhd 6y ago
    Newgrounds is full of porn. It's probably blocked for the same reason pornhub is.
    - hawkoy 6y ago
      > In July 2015 the Supreme Court of India refused to allow the blocking of pornographic websites and said that watching pornography indoors in the privacy of one's own home was not a crime.[13] In August 2015 the Government of India issued an order to Indian ISPs to block at least 857 websites that it considered to be pornographic.[14] In 2015 the Department of Telecommunications (DoT) had asked internet service providers to take down 857 websites in a bid to control cyber crime, but after receiving criticism from the authorities it partially rescinded the ban. The ban from the government came after a lawyer filed a petition in the Supreme Court arguing that online pornography encourages sex crimes and rapes.[15] > In February 2016 the Supreme Court asked the Indian Government to suggest ways of banning all forms of child pornography.[16] > In October 2018 the government directed Internet service providers to block 827 websites that host pornographic content following an order by the Uttarakhand High Court. The court cited the rape of a 10th standard girl from Dehradun by four of her seniors. The four accused told police that they raped the girl after watching pornography on the Internet.[17] https://en.m.wikipedia.org/wiki/Pornography_in_India#Legality https://en.m.wikipedia.org/wiki/Pornography_in_India#Legalit...
ignoramous 6y ago
And here's the latest in SNI and ESNI censorship bypass: https://geneva.cs.umd.edu/posts/china-censors-esni/esni/ https://geneva.cs.umd.edu/posts/china-censors-esni/esni/ https://getintra.org/ https://getintra.org/ which is a DoH client for Android bypasses Indian censorship, btw. Ref: https://twitter.com/vinifortuna/status/1304189371688660992 https://twitter.com/vinifortuna/status/1304189371688660992
- kwesthaus 6y ago
  Fascinating, thank you for sharing. I'm impressed they were able to find so many ways to essentially confuse the GFW as to the current state of the connection. Looks like any company which wants to do business in China will just avoid implementing ESNI for the foreseeable future.
- notRobot 6y ago
  Apparently the 1.1.1.1 DoH app bypasses censoring in India too, from what I've read elsewhere on HN.
  - ignoramous 6y ago
    I wouldn't be surprised if 1.1.1.1 for Android was a Intra fork.
sreeramb93 6y ago
Will TLS 1.3 and ESNI support circumvent this?
- djsumdog 6y ago
  I'm wondering this too. The article claims some of the connection are proxied. However if it's a big site that uses a set range if incoming IPs, I feel like blocking could still happen at the TCP level (and maybe catch a bunch of other unrelated sites if it's on a shared hosting solution).
- deleted 6y ago
  [deleted]
- salamander9 6y ago
  Have used ESNI to successfully circumvent this in the past.
- deleted 6y ago
  [deleted]
- gsich 6y ago
  In most cases: no. ESNI is still a draft and most sites are identifiable by IP only.
- justDankin 6y ago
  Pretty much yes, unless ISPs start blocking IPs as well. We haven't seen this in India (at least yet)
  - topranks 6y ago
    That also gets tricky for them, when say IPs are from Cloudflare, AWS or other cloud-scalers and CDNs. Nations will struggle to block the IP ranges for big players like that without blocking a lot of stuff they don’t intend to.
wtmt 6y ago
This is a great, detailed report. I use one of these providers and see somewhat similar results (I do not use my ISPs DNS, but another one with DoH). Am I right in concluding that these blocking methodologies can be thwarted to a greater extent by the user using Tor (or a VPN outside the country) and/or the websites in question using ESNI (and the user also using a non-ISP DoH provider that doesn’t have legal presence in the country, since the DNS providers will be the next target for these ill defined blocking orders)?
- ignoramous 6y ago
  You don't really need tor or any other VPN for that matter, https://getintra.org/ https://getintra.org/ a DoH client for Android works just fine [0] [0] https://twitter.com/vinifortuna/status/1304189371688660992 https://twitter.com/vinifortuna/status/1304189371688660992
  - wtmt 6y ago
    As stated in my comment, I am using a DoH provider outside the country, but see similar blocking results as the article. Handling DNS alone isn’t going to work all the time, which is what the article detailed out.
    - ignoramous 6y ago
      Did you try https://getintra.org/ https://getintra.org/ (hint: it isnt your typical DoH client)? You're in for a surprise. Source: Work extensively on an Intra fork.
      - captn3m0 6y ago
        I read through https://support.getintra.org/s/article/How-Intra-works https://support.getintra.org/s/article/How-Intra-works and it sounds exactly like any other DoH client with a denylist.
        ignoramous 6y ago
httgp 6y ago
It isn’t clear from the article, but how do we circumvent this? Would a VPN work?
- djsumdog 6y ago
  Judging from the details, a Proxy/VPN to another nation should work.
  - pacificleo12 6y ago
    Noob question : How is that effective if "SNI travels on the network in cleartext"
    - alexmingoia 6y ago
      SNI is part of the HTTPS request, which would travel through the encrypted VPN channel. All network traffic would travel through your VPN, which is encrypted. The other end of the VPN channel is in another country which doesn’t block the website. Your computer <—-encrypted channel to VPN in other country—-> https communication to blocked website What a country could do but we haven’t seen before, is block all VPN protocol traffic, effectively banning VPNs. This would be disruptive to business or politicians using VPN for privacy, so it’s not as politically feasible.
    - Sophistifunk 6y ago
      That's cleartext within your TCP/IP connection. If you use a VPN, that connection itself is encrypted.
- ignoramous 6y ago
  You can use https://getintra.org/ https://getintra.org/ and its numerous forks to overcome censorship as implemented by Indian ISPs today. Then there is Tor on Android https://guardianproject.info/apps/orbot/ https://guardianproject.info/apps/orbot/ and VPN services like https://getlantern.com/ https://getlantern.com/ and https://psiphon.ca/ https://psiphon.ca/ that exclusively focus on anti-censorship measures. Check their privacy policies before committing to use them.
djsumdog 6y ago
I remember visiting India as a kid with my family, and one of my cousins telling me about an America TV series that was banned. I didn't think much of it at the time, but as I've grown older, I've really come to appreciate the freedom of speech we have in America. I just wrote a post about it: https://battlepenguin.com/politics/why-i-no-longer-hate-america/#the-freedom-to-speak https://battlepenguin.com/politics/why-i-no-longer-hate-amer... India is literally the largest democratic country by population in the world. Despite its issues, it has a functioning democracy, yet its freedom of speech is limited. I've lived in a few different countries, and one thing that still amazes me is that America still has some of the strongest court prescient when it comes to speech laws. We have restrictions of course, like all countries do, but I've never seen the US ranked high on the free speech indexes I've seen. My own research leads me to believe the US and Japan stand out as the two nations with some of the strongest free speech laws (although Japan's have some challenging issues with copyright and fair use).
- wozniacki 6y ago
  What good is all of this semblance of free speech when the communication and print platforms of our age that enable the transmission of vast portions of our speech essentially dictate what they will carry and what they wont. Unless you publish a physical book of course and then promote it and distribute it yourself or on a much smaller scale, you post pamphlets on utility poles or other such low tech-low reach media, a FB or a Twitter or a Tik Tok can take down even your "missing pet" posts, because your pet breed offends some people in some manner. They reserve the right to do so. Of course you wont find them doing that, but the fact that they have to power to do so, in itself should be disconcerting. I don't know what you're getting at ( in this post ; I havent read your blog post yet ) but America currently is one of the most restrictive places on earth to express your thoughts and then hope to have them transmitted fairly to a wide swath of people, both geographically and ideologically. America still has some of the strongest court prescient when it comes to speech laws Also, I don't know what that means.
  - lotsofpulp 6y ago
    >I don't know what you're getting at ( in this post ; I havent read your blog post yet ) America currently is one of the most restrictive places on earth to express your thoughts and then hope to have them transmitted fairly to a wide swath of people, both geographically and ideologically. I'm in America, and I can access plenty of racist, sexist, government propaganda, anti government propaganda, anti religion, pro religion, anti police, pro police, violence, pornography, and so much more with the click of a button. If I wanted to, I can also upload any of these thoughts myself to someone else's computer (or use my own computer) and then post links to it to any number of online forums or chat groups where people would have access to them just by clicking on a link.
indiablock 6y ago
I run a tech company that got randomly blocked in India. There's no way it wasn't some kind of mistake. It's been months and there's no way to find out why and there's no documented method to resolve the problem. While looking into this, it turns out it happens all the time and many websites have been blocked for years. If you're big enough then maybe you can get unblocked. Or you might just be SOL. Some examples: https://www.alexa.com/ https://www.alexa.com/ has been blocked for over 1 year (https://www.reddit.com/r/india/comments/b084so/why_alexacom_is_blocked_in_india/ https://www.reddit.com/r/india/comments/b084so/why_alexacom_...) (wtf?) Trinet.com, an HR tech+services company is blocked in India (wtf?) Adobe-owned behance.net is blocked in India. (why?) reddit.com or parts of it are frequently blocked/unblocked https://thenextweb.com/apps/2019/03/14/isps-are-reportedly-blocking-reddit-in-india/ https://thenextweb.com/apps/2019/03/14/isps-are-reportedly-b... 9gag and collegehumor have been blocked for over 5 years (https://www.news18.com/news/buzz/comedy-websites-colleghumor-and-9gag-tv-are-a-part-of-the-857-websites-to-be-banned-because-of-indecent-content-1029567.html https://www.news18.com/news/buzz/comedy-websites-colleghumor...). At least there's some reason here. Three environmentalist websites were blocked (and eventually unblocked): https://scroll.in/latest/967589/centre-run-agency-blocks-website-of-environmental-collective-after-it-criticises-draft-law https://scroll.in/latest/967589/centre-run-agency-blocks-web... The NYTimes was blocked for a while: https://gadgets.ndtv.com/internet/news/new-york-times-access-restored-in-india-following-outage-in-many-cities-2258619 https://gadgets.ndtv.com/internet/news/new-york-times-access... In 2014, India blocked Github for a while: https://qz.com/india/319866/a-threat-from-isis-prompts-india-to-block-github-and-a-handful-of-other-sites https://qz.com/india/319866/a-threat-from-isis-prompts-india... India is known for filtering websites belonging to NGOs, feminist groups, and others https://indianexpress.com/article/india/india-tops-list-of-websites-blocked-its-telcos-filter-the-most-netsweeper-5150620/ https://indianexpress.com/article/india/india-tops-list-of-w... As far as I can tell, if there's some random bureaucrat that doesn't like you, your website is going to get blocked. Equally likely, the process is so poor that you might get blocked for no reason at all.
- xplune 6y ago
  Which ISP are you using? Because alexa.com, trinet.com, behance.net, NYTimes are working for me.
kul_ 6y ago
Isnt' SNI based on the 'Host' header?! This is a news for me that SNI is not encrypted in TLS. Its a problem with the protocol not the ISPs then.
- Polylactic_acid 6y ago
  Encrypted SNI has been in talks for a long time now. It was meant to be out now but it was shot down at the last minute. And yes, its the last thing that allows a MitM to work out which site you are on if its hosted on a shared hosting platform. Likely this is the reason its hard to get approved.
- cmeacham98 6y ago
  To determine which certificate to use the web server needs the client to send it the domain. To send the domain securely the client needs to know the public key of the certificate the server is using. This chicken and egg problem has gone unresolved for a long time, and only now are there efforts to fix it (see the work on esni).
deleted 6y ago
[deleted]
square_usual 6y ago
Using firefox 81 on Jio broadband, one of the ISPs mentioned, and I was able to access www.womenonweb.org, one of the websites they mention was blocked. Maybe that's because of firefox's DoH?
- AmIDev 6y ago
  Yes. Firefox DoH, or using 1.1.1.1 is generally enough to bypass most blocks in India
kburman 6y ago
For anyone in India, just use a DoH client and you would be good to go. I use greentunnel and it works fine.
- Santosh83 6y ago
  Is something like greentunnel necessary. I'm in India and I've found that Firefox with its builtin DoH connection to Cloudflare seems to bypass all govt blocks I've personally come across. Haven't tested specifically for this though... just normal browsing experience.
  - bgdam 6y ago
    Try using your setup to access a blocked website on a Jio connection. You'll find why greentunnel is required :)
- bgdam 6y ago
  Greentunnel is not just a DoH client. Greentunnel also breaks up your packets in such a manner that prevents SNI sniffing, which is what makes it able to prevent blocking by Jio.
  - ignoramous 6y ago
    > Greentunnel also breaks up your packets in such a manner that prevents SNI sniffing... Yep, here's the code that does the trick: https://github.com/SadeghHayeri/GreenTunnel/blob/master/src/handlers/https.js#L45-L56 https://github.com/SadeghHayeri/GreenTunnel/blob/master/src/...
    - inshadows 6y ago
      Hmmm... No thanks. "dependencies": { "app-data-folder": "^1.0.0", "chalk": "^2.4.2", "clear": "^0.1.0", "consola": "^2.11.0", "debug": "^4.1.1", "dns-over-http": "^0.1.2", "dns-over-tls": "0.0.6", "esm": "^3.2.22", "is-docker": "^2.0.0", "lru-cache": "^5.1.1", "node-localstorage": "^2.1.5", "ora": "^3.2.0", "std-env": "^2.2.1", "universal-analytics": "^0.4.20", "update-notifier": "^2.5.0", "validator": "^10.11.0", "winreg": "^1.2.4", "yargs": "^13.2.2" },
known 6y ago
I use https://www.torproject.org/download/ https://www.torproject.org/download/ to access blocked urls;
known 6y ago
collegehumor.com pornhub.com are not blocked in https://www.torproject.org/download/ https://www.torproject.org/download/
vkaku 6y ago
I think that censorship in India is a losing end, and it does not help anyone, not the government, not the ISPs, not the media lobbies. They should just expose more endpoints, like the way TPB got over the problem, and keep these ISPs at bay. This is just my opinion.
justDankin 6y ago
I'm one of the authors of the post, we're trying to extend this work by crowdsourcing censorship measurements from different vantage points in India. We've compiled these tests into an android app, please consider running it if you live in India and would like to contribute to the research :) https://play.google.com/store/apps/details?id=com.censorwatch.netprobesapp https://play.google.com/store/apps/details?id=com.censorwatc... It's completely anonymous, doesn't require any permissions, and does not store any user related information.
- amitheonlyone 6y ago
  Do i have to keep it installed or is it a one-off thing
  - justDankin 6y ago
    You can delete it after running. Each run on an (ISP, state) combination gives a new test point. Thanks!
    - Santosh83 6y ago
      Off-topic but I'm noticing that every comment of yours on this post shows up as greyed-out and 'dead' immediately after you post, within minutes. There's not enough time for people to downvote and in any case none of your comments are downvote-worthy. I've been 'vouching' for your comments so others can read them. Maybe something @dang can look into?
      - justDankin 6y ago
        I'm new to HN(3 months, low karma). Maybe that's the reason? Not sure what would be the correct way to "fix" this Thanks for vouching!
        detaro 6y ago
        email the mods through the contact link in the footer. Probably some spam filter gone haywire.
walrus01 6y ago
The Indian government has a long and varied track record of messing with the Internet: https://en.wikipedia.org/wiki/Internet_censorship_in_India https://en.wikipedia.org/wiki/Internet_censorship_in_India
- signal11 6y ago
  Wow. From that page > India leads the world, in the list of Internet Shutdowns. In 2018, as reported by Access Now, out of 196 documented Internet Shutdowns globally, India accounted for 134 of them.[124] The reasons for the shutdowns range from protests and political unrest to elections and exams.
  - walrus01 6y ago
    As an ISP or telecom, when large groups of men with guns and uniforms come to your offices and order you to turn off all the routers, you don't have much choice. https://en.wikipedia.org/wiki/2019%E2%80%932020_Jammu_and_Kashmir_lockdown https://en.wikipedia.org/wiki/2019%E2%80%932020_Jammu_and_Ka... https://www.washingtonpost.com/world/asia_pacific/indias-internet-shutdown-in-kashmir-is-now-the-longest-ever-in-a-democracy/2019/12/15/bb0693ea-1dfc-11ea-977a-15a6710ed6da_story.html https://www.washingtonpost.com/world/asia_pacific/indias-int...
oa335 6y ago
India has severely restricted internet access in majority-Muslim Jammu and Kashmir for over a year. https://www.medianama.com/2020/09/223-2g-continues-jammu-kashmir/ https://www.medianama.com/2020/09/223-2g-continues-jammu-kas...

210 points by ZnZirconium 6y ago

> In the absence of a publicly available official list of blocked hostnames This is the icing on the cake right here. It's just awful that not only do websites get censored largely arbitrarily, there is no insight into the process and what is even blocked–the fact that someone had to literally check sites to see if they are being blocked (via a variety of different methods largely indistinguishable from a malicious actor :/) is just a truly horrible state to be in.

wtmt 6y ago
Yes, it’s frustrating to see the lack of transparency and the sheer futility in some cases to find who issued an order for what purpose in which jurisdiction affecting which ISPs. DuckDuckGo was blocked a couple of o this ago. The nebulous words “national security”, without any context, are used as the justification for blocking many sites.
- throwaway8941 6y ago
  At least Indian authorities seem to be relatively open about the censorship. Here in Kazakhstan they simply block everything they want, taking down many "innocent" sites as collateral damage, and write it off as "temporary networking problems" and "works for me, what are you talking about?". For the past week I've had numerous problems connecting to TLS directly, without using a VPN. I still update my system directly from a mirror to avoid wasting limited data on a remote VM, that's how I discovered it personally. I worry they're trying to implement something nefarious behind the scenes, again.

aravindet 6y ago

Does anyone have insight into why College Humor (referenced in the article) is blocked in India? This seems unusual and I wonder what (if any) reasons were provided.

dylz 6y ago
Probably some toilet humour that the censors didn't like.
wtmt 6y ago
You have to understand that reasons aren’t provided for blocking, because the blocking orders may come from different authorities and may not be disclosed due to “national security” reasons. All that we can glean from a site being blocked is that someone influential (not necessarily from an arm of the government) got offended by the site and used some means to get it blocked. One can construct a list of hundreds of URLs and get a blocking order, with a few innocent ones slipped in between. Nobody will investigate the claims, and nobody can contest the claims before it’s ordered, but the order for blocking will be issued.
as1mov 6y ago
Another peculiar one being blocked (at least on Airtel) is Newgrounds. Not really sure what was going on when they decided to ban it.
- jeroenhd 6y ago
  Newgrounds is full of porn. It's probably blocked for the same reason pornhub is.
  - hawkoy 6y ago
    > In July 2015 the Supreme Court of India refused to allow the blocking of pornographic websites and said that watching pornography indoors in the privacy of one's own home was not a crime.[13] In August 2015 the Government of India issued an order to Indian ISPs to block at least 857 websites that it considered to be pornographic.[14] In 2015 the Department of Telecommunications (DoT) had asked internet service providers to take down 857 websites in a bid to control cyber crime, but after receiving criticism from the authorities it partially rescinded the ban. The ban from the government came after a lawyer filed a petition in the Supreme Court arguing that online pornography encourages sex crimes and rapes.[15] > In February 2016 the Supreme Court asked the Indian Government to suggest ways of banning all forms of child pornography.[16] > In October 2018 the government directed Internet service providers to block 827 websites that host pornographic content following an order by the Uttarakhand High Court. The court cited the rape of a 10th standard girl from Dehradun by four of her seniors. The four accused told police that they raped the girl after watching pornography on the Internet.[17] https://en.m.wikipedia.org/wiki/Pornography_in_India#Legality https://en.m.wikipedia.org/wiki/Pornography_in_India#Legalit...

ignoramous 6y ago

And here's the latest in SNI and ESNI censorship bypass: https://geneva.cs.umd.edu/posts/china-censors-esni/esni/ https://geneva.cs.umd.edu/posts/china-censors-esni/esni/ https://getintra.org/ https://getintra.org/ which is a DoH client for Android bypasses Indian censorship, btw. Ref: https://twitter.com/vinifortuna/status/1304189371688660992 https://twitter.com/vinifortuna/status/1304189371688660992

kwesthaus 6y ago
Fascinating, thank you for sharing. I'm impressed they were able to find so many ways to essentially confuse the GFW as to the current state of the connection. Looks like any company which wants to do business in China will just avoid implementing ESNI for the foreseeable future.
notRobot 6y ago
Apparently the 1.1.1.1 DoH app bypasses censoring in India too, from what I've read elsewhere on HN.
- ignoramous 6y ago
  I wouldn't be surprised if 1.1.1.1 for Android was a Intra fork.

sreeramb93 6y ago

Will TLS 1.3 and ESNI support circumvent this?

djsumdog 6y ago
I'm wondering this too. The article claims some of the connection are proxied. However if it's a big site that uses a set range if incoming IPs, I feel like blocking could still happen at the TCP level (and maybe catch a bunch of other unrelated sites if it's on a shared hosting solution).
deleted 6y ago
[deleted]
salamander9 6y ago
Have used ESNI to successfully circumvent this in the past.
deleted 6y ago
[deleted]
gsich 6y ago
In most cases: no. ESNI is still a draft and most sites are identifiable by IP only.
justDankin 6y ago
Pretty much yes, unless ISPs start blocking IPs as well. We haven't seen this in India (at least yet)
- topranks 6y ago
  That also gets tricky for them, when say IPs are from Cloudflare, AWS or other cloud-scalers and CDNs. Nations will struggle to block the IP ranges for big players like that without blocking a lot of stuff they don’t intend to.

wtmt 6y ago

This is a great, detailed report. I use one of these providers and see somewhat similar results (I do not use my ISPs DNS, but another one with DoH). Am I right in concluding that these blocking methodologies can be thwarted to a greater extent by the user using Tor (or a VPN outside the country) and/or the websites in question using ESNI (and the user also using a non-ISP DoH provider that doesn’t have legal presence in the country, since the DNS providers will be the next target for these ill defined blocking orders)?

ignoramous 6y ago
You don't really need tor or any other VPN for that matter, https://getintra.org/ https://getintra.org/ a DoH client for Android works just fine [0] [0] https://twitter.com/vinifortuna/status/1304189371688660992 https://twitter.com/vinifortuna/status/1304189371688660992
- wtmt 6y ago
  As stated in my comment, I am using a DoH provider outside the country, but see similar blocking results as the article. Handling DNS alone isn’t going to work all the time, which is what the article detailed out.
  - ignoramous 6y ago
    Did you try https://getintra.org/ https://getintra.org/ (hint: it isnt your typical DoH client)? You're in for a surprise. Source: Work extensively on an Intra fork.
    - captn3m0 6y ago
      I read through https://support.getintra.org/s/article/How-Intra-works https://support.getintra.org/s/article/How-Intra-works and it sounds exactly like any other DoH client with a denylist.
      - ignoramous 6y ago

httgp 6y ago

It isn’t clear from the article, but how do we circumvent this? Would a VPN work?

djsumdog 6y ago
Judging from the details, a Proxy/VPN to another nation should work.
- pacificleo12 6y ago
  Noob question : How is that effective if "SNI travels on the network in cleartext"
  - alexmingoia 6y ago
    SNI is part of the HTTPS request, which would travel through the encrypted VPN channel. All network traffic would travel through your VPN, which is encrypted. The other end of the VPN channel is in another country which doesn’t block the website. Your computer <—-encrypted channel to VPN in other country—-> https communication to blocked website What a country could do but we haven’t seen before, is block all VPN protocol traffic, effectively banning VPNs. This would be disruptive to business or politicians using VPN for privacy, so it’s not as politically feasible.
  - Sophistifunk 6y ago
    That's cleartext within your TCP/IP connection. If you use a VPN, that connection itself is encrypted.
ignoramous 6y ago
You can use https://getintra.org/ https://getintra.org/ and its numerous forks to overcome censorship as implemented by Indian ISPs today. Then there is Tor on Android https://guardianproject.info/apps/orbot/ https://guardianproject.info/apps/orbot/ and VPN services like https://getlantern.com/ https://getlantern.com/ and https://psiphon.ca/ https://psiphon.ca/ that exclusively focus on anti-censorship measures. Check their privacy policies before committing to use them.

djsumdog 6y ago

I remember visiting India as a kid with my family, and one of my cousins telling me about an America TV series that was banned. I didn't think much of it at the time, but as I've grown older, I've really come to appreciate the freedom of speech we have in America. I just wrote a post about it: https://battlepenguin.com/politics/why-i-no-longer-hate-america/#the-freedom-to-speak https://battlepenguin.com/politics/why-i-no-longer-hate-amer... India is literally the largest democratic country by population in the world. Despite its issues, it has a functioning democracy, yet its freedom of speech is limited. I've lived in a few different countries, and one thing that still amazes me is that America still has some of the strongest court prescient when it comes to speech laws. We have restrictions of course, like all countries do, but I've never seen the US ranked high on the free speech indexes I've seen. My own research leads me to believe the US and Japan stand out as the two nations with some of the strongest free speech laws (although Japan's have some challenging issues with copyright and fair use).

wozniacki 6y ago
What good is all of this semblance of free speech when the communication and print platforms of our age that enable the transmission of vast portions of our speech essentially dictate what they will carry and what they wont. Unless you publish a physical book of course and then promote it and distribute it yourself or on a much smaller scale, you post pamphlets on utility poles or other such low tech-low reach media, a FB or a Twitter or a Tik Tok can take down even your "missing pet" posts, because your pet breed offends some people in some manner. They reserve the right to do so. Of course you wont find them doing that, but the fact that they have to power to do so, in itself should be disconcerting. I don't know what you're getting at ( in this post ; I havent read your blog post yet ) but America currently is one of the most restrictive places on earth to express your thoughts and then hope to have them transmitted fairly to a wide swath of people, both geographically and ideologically. America still has some of the strongest court prescient when it comes to speech laws Also, I don't know what that means.
- lotsofpulp 6y ago
  >I don't know what you're getting at ( in this post ; I havent read your blog post yet ) America currently is one of the most restrictive places on earth to express your thoughts and then hope to have them transmitted fairly to a wide swath of people, both geographically and ideologically. I'm in America, and I can access plenty of racist, sexist, government propaganda, anti government propaganda, anti religion, pro religion, anti police, pro police, violence, pornography, and so much more with the click of a button. If I wanted to, I can also upload any of these thoughts myself to someone else's computer (or use my own computer) and then post links to it to any number of online forums or chat groups where people would have access to them just by clicking on a link.

indiablock 6y ago

I run a tech company that got randomly blocked in India. There's no way it wasn't some kind of mistake. It's been months and there's no way to find out why and there's no documented method to resolve the problem. While looking into this, it turns out it happens all the time and many websites have been blocked for years. If you're big enough then maybe you can get unblocked. Or you might just be SOL. Some examples: https://www.alexa.com/ https://www.alexa.com/ has been blocked for over 1 year (https://www.reddit.com/r/india/comments/b084so/why_alexacom_is_blocked_in_india/ https://www.reddit.com/r/india/comments/b084so/why_alexacom_...) (wtf?) Trinet.com, an HR tech+services company is blocked in India (wtf?) Adobe-owned behance.net is blocked in India. (why?) reddit.com or parts of it are frequently blocked/unblocked https://thenextweb.com/apps/2019/03/14/isps-are-reportedly-blocking-reddit-in-india/ https://thenextweb.com/apps/2019/03/14/isps-are-reportedly-b... 9gag and collegehumor have been blocked for over 5 years (https://www.news18.com/news/buzz/comedy-websites-colleghumor-and-9gag-tv-are-a-part-of-the-857-websites-to-be-banned-because-of-indecent-content-1029567.html https://www.news18.com/news/buzz/comedy-websites-colleghumor...). At least there's some reason here. Three environmentalist websites were blocked (and eventually unblocked): https://scroll.in/latest/967589/centre-run-agency-blocks-website-of-environmental-collective-after-it-criticises-draft-law https://scroll.in/latest/967589/centre-run-agency-blocks-web... The NYTimes was blocked for a while: https://gadgets.ndtv.com/internet/news/new-york-times-access-restored-in-india-following-outage-in-many-cities-2258619 https://gadgets.ndtv.com/internet/news/new-york-times-access... In 2014, India blocked Github for a while: https://qz.com/india/319866/a-threat-from-isis-prompts-india-to-block-github-and-a-handful-of-other-sites https://qz.com/india/319866/a-threat-from-isis-prompts-india... India is known for filtering websites belonging to NGOs, feminist groups, and others https://indianexpress.com/article/india/india-tops-list-of-websites-blocked-its-telcos-filter-the-most-netsweeper-5150620/ https://indianexpress.com/article/india/india-tops-list-of-w... As far as I can tell, if there's some random bureaucrat that doesn't like you, your website is going to get blocked. Equally likely, the process is so poor that you might get blocked for no reason at all.

xplune 6y ago
Which ISP are you using? Because alexa.com, trinet.com, behance.net, NYTimes are working for me.

kul_ 6y ago

Isnt' SNI based on the 'Host' header?! This is a news for me that SNI is not encrypted in TLS. Its a problem with the protocol not the ISPs then.

Polylactic_acid 6y ago
Encrypted SNI has been in talks for a long time now. It was meant to be out now but it was shot down at the last minute. And yes, its the last thing that allows a MitM to work out which site you are on if its hosted on a shared hosting platform. Likely this is the reason its hard to get approved.
cmeacham98 6y ago
To determine which certificate to use the web server needs the client to send it the domain. To send the domain securely the client needs to know the public key of the certificate the server is using. This chicken and egg problem has gone unresolved for a long time, and only now are there efforts to fix it (see the work on esni).

deleted 6y ago

[deleted]

square_usual 6y ago

Using firefox 81 on Jio broadband, one of the ISPs mentioned, and I was able to access www.womenonweb.org, one of the websites they mention was blocked. Maybe that's because of firefox's DoH?

AmIDev 6y ago
Yes. Firefox DoH, or using 1.1.1.1 is generally enough to bypass most blocks in India

kburman 6y ago

For anyone in India, just use a DoH client and you would be good to go. I use greentunnel and it works fine.

Santosh83 6y ago
Is something like greentunnel necessary. I'm in India and I've found that Firefox with its builtin DoH connection to Cloudflare seems to bypass all govt blocks I've personally come across. Haven't tested specifically for this though... just normal browsing experience.
- bgdam 6y ago
  Try using your setup to access a blocked website on a Jio connection. You'll find why greentunnel is required :)
bgdam 6y ago
Greentunnel is not just a DoH client. Greentunnel also breaks up your packets in such a manner that prevents SNI sniffing, which is what makes it able to prevent blocking by Jio.
- ignoramous 6y ago
  > Greentunnel also breaks up your packets in such a manner that prevents SNI sniffing... Yep, here's the code that does the trick: https://github.com/SadeghHayeri/GreenTunnel/blob/master/src/handlers/https.js#L45-L56 https://github.com/SadeghHayeri/GreenTunnel/blob/master/src/...
  - inshadows 6y ago
    Hmmm... No thanks. "dependencies": { "app-data-folder": "^1.0.0", "chalk": "^2.4.2", "clear": "^0.1.0", "consola": "^2.11.0", "debug": "^4.1.1", "dns-over-http": "^0.1.2", "dns-over-tls": "0.0.6", "esm": "^3.2.22", "is-docker": "^2.0.0", "lru-cache": "^5.1.1", "node-localstorage": "^2.1.5", "ora": "^3.2.0", "std-env": "^2.2.1", "universal-analytics": "^0.4.20", "update-notifier": "^2.5.0", "validator": "^10.11.0", "winreg": "^1.2.4", "yargs": "^13.2.2" },

known 6y ago

I use https://www.torproject.org/download/ https://www.torproject.org/download/ to access blocked urls;

known 6y ago

collegehumor.com pornhub.com are not blocked in https://www.torproject.org/download/ https://www.torproject.org/download/

vkaku 6y ago

I think that censorship in India is a losing end, and it does not help anyone, not the government, not the ISPs, not the media lobbies. They should just expose more endpoints, like the way TPB got over the problem, and keep these ISPs at bay. This is just my opinion.

justDankin 6y ago

I'm one of the authors of the post, we're trying to extend this work by crowdsourcing censorship measurements from different vantage points in India. We've compiled these tests into an android app, please consider running it if you live in India and would like to contribute to the research :) https://play.google.com/store/apps/details?id=com.censorwatch.netprobesapp https://play.google.com/store/apps/details?id=com.censorwatc... It's completely anonymous, doesn't require any permissions, and does not store any user related information.

amitheonlyone 6y ago
Do i have to keep it installed or is it a one-off thing
- justDankin 6y ago
  You can delete it after running. Each run on an (ISP, state) combination gives a new test point. Thanks!
  - Santosh83 6y ago
    Off-topic but I'm noticing that every comment of yours on this post shows up as greyed-out and 'dead' immediately after you post, within minutes. There's not enough time for people to downvote and in any case none of your comments are downvote-worthy. I've been 'vouching' for your comments so others can read them. Maybe something @dang can look into?
    - justDankin 6y ago
      I'm new to HN(3 months, low karma). Maybe that's the reason? Not sure what would be the correct way to "fix" this Thanks for vouching!
      - detaro 6y ago
        email the mods through the contact link in the footer. Probably some spam filter gone haywire.

walrus01 6y ago

The Indian government has a long and varied track record of messing with the Internet: https://en.wikipedia.org/wiki/Internet_censorship_in_India https://en.wikipedia.org/wiki/Internet_censorship_in_India

signal11 6y ago
Wow. From that page > India leads the world, in the list of Internet Shutdowns. In 2018, as reported by Access Now, out of 196 documented Internet Shutdowns globally, India accounted for 134 of them.[124] The reasons for the shutdowns range from protests and political unrest to elections and exams.
- walrus01 6y ago
  As an ISP or telecom, when large groups of men with guns and uniforms come to your offices and order you to turn off all the routers, you don't have much choice. https://en.wikipedia.org/wiki/2019%E2%80%932020_Jammu_and_Kashmir_lockdown https://en.wikipedia.org/wiki/2019%E2%80%932020_Jammu_and_Ka... https://www.washingtonpost.com/world/asia_pacific/indias-internet-shutdown-in-kashmir-is-now-the-longest-ever-in-a-democracy/2019/12/15/bb0693ea-1dfc-11ea-977a-15a6710ed6da_story.html https://www.washingtonpost.com/world/asia_pacific/indias-int...

oa335 6y ago

India has severely restricted internet access in majority-Muslim Jammu and Kashmir for over a year. https://www.medianama.com/2020/09/223-2g-continues-jammu-kashmir/ https://www.medianama.com/2020/09/223-2g-continues-jammu-kas...