4 ms·
This is a great, detailed report. I use one of these providers and see somewhat similar results (I do not use my ISPs DNS, but another one with DoH). Am I righ
by wtmt 6y ago
This is a great, detailed report. I use one of these providers and see somewhat similar results (I do not use my ISPs DNS, but another one with DoH).
Am I right in concluding that these blocking methodologies can be thwarted to a greater extent by the user using Tor (or a VPN outside the country) and/or the websites in question using ESNI (and the user also using a non-ISP DoH provider that doesn’t have legal presence in the country, since the DNS providers will be the next target for these ill defined blocking orders)?
- ignoramous 6y agoYou don't really need tor or any other VPN for that matter, https://getintra.org/ https://getintra.org/ a DoH client for Android works just fine [0] [0] https://twitter.com/vinifortuna/status/1304189371688660992 https://twitter.com/vinifortuna/status/1304189371688660992
- wtmt 6y agoAs stated in my comment, I am using a DoH provider outside the country, but see similar blocking results as the article. Handling DNS alone isn’t going to work all the time, which is what the article detailed out.
- ignoramous 6y agoDid you try https://getintra.org/ https://getintra.org/ (hint: it isnt your typical DoH client)? You're in for a surprise. Source: Work extensively on an Intra fork.
- captn3m0 6y agoI read through https://support.getintra.org/s/article/How-Intra-works https://support.getintra.org/s/article/How-Intra-works and it sounds exactly like any other DoH client with a denylist.
- ignoramous 6y agoThey leave out details: Read the tweet thread I linked to.
- sbmthakur 6y agoIntra also sets up a VPN connection, right?
- ignoramous 6y agoYes, but not in the traditional sense, like, say ProtonVPN.com or Psiphon.ca or Latern.io do. Intra merely captures DNS traffic on port 53 and tunnels it to any DoH endpoint. It circumvents SNI censorship because it essentially sees all TCP and UDP traffic and can manipulate it on-device, and it does so in a way that bypasses most (but not all) censorship implementations.
- fomine3 6y agoSo it's not VPN but uses Android's VPN API.
- topranks 6y agoDoH client won’t stop SNI blocking, of which this report found a lot. ESNI, of the new trick of using ESNI plus a fake plaintext SNI, is definitely a more robust approach.
- ignoramous 6y agoA DoH client cannot prevent SNI blocking (I never claimed otherwise) but Intra does employ other client-side tricks to do so. God, did anyone read the referenced tweet? The down-votes are icing on the cake. And this is supposedly "hacker news". Sigh.