6 ms·

Does Airtel block TLS 1.3 with the encrypted SNI extension enabled? https://blog.cloudflare.com/encrypted-sni/ https://blog.cloudflare.com/encrypted-sni/

justDankin 6y ago
I haven't been able to test that yet, neither am aware of any research which answers that question. IMO the only way to do that would be to either (i) block the IP (high collateral blocking) or (ii) block TLS 1.3 itself (GFC does this). A major blocker in answering this is finding a potentially blocked website that also supports TLS 1.3
- davidhyde 6y ago
  Agreed and since TLS 1.3 is still work in progress the chances are slim that you will find a blocked website that meets your criteria. Great article, very accessible. Thanks!
  - tialaramex 6y ago
    TLS 1.3 was published as RFC 8446 back in 2018. I know it sometimes seems like this is still 2016 somehow, but it is not.
    - davidhyde 6y ago
      That RFC is marked as "PROPOSED STANDARD" which is why I saw it as work in progress but you're right, that seems to be the end of the road for RFC's (for example RFC 6455 December 2011 (websockets) is also marked as proposed standard but this is what everyone has implemented)
      - tialaramex 6y ago
        The IETF deliberately has no power whatsoever. Whether an IETF standards track proposal in fact becomes a standard everybody implements is entirely up to the implementers. This is in contrast to many standards development organisations (and indeed whether the IETF is even an organisation is open to doubt) which are government functions and can produce de jure standards you're obliged to implement or in the worst case force may be exercised against you by those with a monopoly on its use. As a result IETF standards are only proposed and that is as you say "the end of the road".
        cesarb 6y ago
        > As a result IETF standards are only proposed and that is as you say "the end of the road". Not really, after PROPOSED STANDARD there's INTERNET STANDARD, the STD series. For instance, IPv4/ICMPv4 (RFC 791/792) is STD 5, UDP (RFC 768) is STD 6, TCP (RFC 793) is STD 7, DNS is STD 13, and so on (STD 1 has the full list). However, an IETF standard only reaches that level after it's been in use for a while; according to RFC 2026 (BCP 9), "A specification for which significant implementation and successful operational experience has been obtained may be elevated to the Internet Standard level. An Internet Standard (which may simply be referred to as a Standard) is characterized by a high degree of technical maturity and by a generally held belief that the specified protocol or service provides significant benefit to the Internet community."
        tialaramex 6y ago
        Good point, thanks for correcting that.
  - duskwuff 6y ago
    Cloudflare supports TLS 1.3 and ESNI. A lot of web sites will inherit ESNI support from that.
- detaro 6y ago
  If they block ESNI, it's likely all ESNI requests would be blocked, because they can't tell if its a blocked site or not. (it'd be possible they only apply ESNI-blocking against IPs associated with blocked sites, but that seems unlikely)
  - silon42 6y ago
    This is what would consider doing in my home firewall, because I don't want requests going out to unknown sites.
- tialaramex 6y ago
  This is wrong. The ClientHello message is not encrypted in TLS 1.3, so, the client has to announce any extensions in plaintext. Thus the Great Firewall blocks connections which say they want to do encrypted SNI. TLS 1.3 works fine in China, but if you use TLS 1.3 with the earlier proposed encrypted SNI draft it is blocked. The Great Firewall can't tell which name you actually wanted, but it can tell you're encrypting the SNI and block that. With the currently proposed Encrypted Client Hello with a GREASE-style dummy ECH on all connections (so the "real" Hello is sometimes in an encrypted block and sometimes that encrypted block was just noise), China would still be able to choose to block all ECH-enabled connections since their presence is detectable. This would break everything, but China can choose to do that. What happens next is a policy question. If you want to sneak past nation state snooping you need something else, that's not what TLS is for. The TOR project does not directly offer this either, but they can help you find out how to connect to TOR in a sneaky way if that's necessary for you.
  - walrus01 6y ago
    > If you want to sneak past nation state snooping you need something else things generally along the same lines as obfsproxy, and traffic level steganography and obfuscation/mixing.
airtelblock 6y ago
Setting esni to enabled in Firefox partially works. But Airtel really, really wants to run scripts and show ads on blocked pages. Duckduckgo - https://i.postimg.cc/SqkRhpRC/Mozilla-Firefox-29-09-20-w-PA.png https://i.postimg.cc/SqkRhpRC/Mozilla-Firefox-29-09-20-w-PA.... Pirate Bay - https://i.postimg.cc/qMmwMXVY/t-29-09-20-9-Dv.png https://i.postimg.cc/qMmwMXVY/t-29-09-20-9-Dv.png
- dannyw 6y ago
  DuckDuckGo is blocked in India??
  - vinay_ys 6y ago
    Nope
  - uname_amiy 6y ago
    Yes, ISPs are blocking DDG. Airtel(ISP) is blocking DDG but HTTPS version is accessible. https://imgur.com/a/y7wnOjD https://imgur.com/a/y7wnOjD
    - smolder 6y ago
      What reason could they have for blocking DDG? Is it easier to find pirated content there than on Google or something? That's my best guess. I can't imagine they'd block on behalf of a competitor or something.
      - justDankin 6y ago
        You never know. Could be a mistake where they were trying to block a certain path due to some search result of copyright infringement, but ended up banning the domain itself. One can only guess. Reddit and Github have previously been temporarily banned in India due to similar "mistakes"
      - pjc50 6y ago
        I suspect it's political censorship/surveillance of some sort. Some suggest it's collateral damage from the ban on Chinese apps. https://www.themobileindian.com/news/duckduckgo-blocked-by-multiple-service-providers-in-india-31958 https://www.themobileindian.com/news/duckduckgo-blocked-by-m... Whether that's a mistake or they've made an enemy of some sort is not clear. India is a democratic country but not an especially free one.

justDankin 6y ago

I haven't been able to test that yet, neither am aware of any research which answers that question. IMO the only way to do that would be to either (i) block the IP (high collateral blocking) or (ii) block TLS 1.3 itself (GFC does this). A major blocker in answering this is finding a potentially blocked website that also supports TLS 1.3

davidhyde 6y ago
Agreed and since TLS 1.3 is still work in progress the chances are slim that you will find a blocked website that meets your criteria. Great article, very accessible. Thanks!
- tialaramex 6y ago
  TLS 1.3 was published as RFC 8446 back in 2018. I know it sometimes seems like this is still 2016 somehow, but it is not.
  - davidhyde 6y ago
    That RFC is marked as "PROPOSED STANDARD" which is why I saw it as work in progress but you're right, that seems to be the end of the road for RFC's (for example RFC 6455 December 2011 (websockets) is also marked as proposed standard but this is what everyone has implemented)
    - tialaramex 6y ago
      The IETF deliberately has no power whatsoever. Whether an IETF standards track proposal in fact becomes a standard everybody implements is entirely up to the implementers. This is in contrast to many standards development organisations (and indeed whether the IETF is even an organisation is open to doubt) which are government functions and can produce de jure standards you're obliged to implement or in the worst case force may be exercised against you by those with a monopoly on its use. As a result IETF standards are only proposed and that is as you say "the end of the road".
      - cesarb 6y ago
        > As a result IETF standards are only proposed and that is as you say "the end of the road". Not really, after PROPOSED STANDARD there's INTERNET STANDARD, the STD series. For instance, IPv4/ICMPv4 (RFC 791/792) is STD 5, UDP (RFC 768) is STD 6, TCP (RFC 793) is STD 7, DNS is STD 13, and so on (STD 1 has the full list). However, an IETF standard only reaches that level after it's been in use for a while; according to RFC 2026 (BCP 9), "A specification for which significant implementation and successful operational experience has been obtained may be elevated to the Internet Standard level. An Internet Standard (which may simply be referred to as a Standard) is characterized by a high degree of technical maturity and by a generally held belief that the specified protocol or service provides significant benefit to the Internet community."
        tialaramex 6y ago
        Good point, thanks for correcting that.
- duskwuff 6y ago
  Cloudflare supports TLS 1.3 and ESNI. A lot of web sites will inherit ESNI support from that.
detaro 6y ago
If they block ESNI, it's likely all ESNI requests would be blocked, because they can't tell if its a blocked site or not. (it'd be possible they only apply ESNI-blocking against IPs associated with blocked sites, but that seems unlikely)
- silon42 6y ago
  This is what would consider doing in my home firewall, because I don't want requests going out to unknown sites.
tialaramex 6y ago
This is wrong. The ClientHello message is not encrypted in TLS 1.3, so, the client has to announce any extensions in plaintext. Thus the Great Firewall blocks connections which say they want to do encrypted SNI. TLS 1.3 works fine in China, but if you use TLS 1.3 with the earlier proposed encrypted SNI draft it is blocked. The Great Firewall can't tell which name you actually wanted, but it can tell you're encrypting the SNI and block that. With the currently proposed Encrypted Client Hello with a GREASE-style dummy ECH on all connections (so the "real" Hello is sometimes in an encrypted block and sometimes that encrypted block was just noise), China would still be able to choose to block all ECH-enabled connections since their presence is detectable. This would break everything, but China can choose to do that. What happens next is a policy question. If you want to sneak past nation state snooping you need something else, that's not what TLS is for. The TOR project does not directly offer this either, but they can help you find out how to connect to TOR in a sneaky way if that's necessary for you.
- walrus01 6y ago
  > If you want to sneak past nation state snooping you need something else things generally along the same lines as obfsproxy, and traffic level steganography and obfuscation/mixing.

airtelblock 6y ago

Setting esni to enabled in Firefox partially works. But Airtel really, really wants to run scripts and show ads on blocked pages. Duckduckgo - https://i.postimg.cc/SqkRhpRC/Mozilla-Firefox-29-09-20-w-PA.png https://i.postimg.cc/SqkRhpRC/Mozilla-Firefox-29-09-20-w-PA.... Pirate Bay - https://i.postimg.cc/qMmwMXVY/t-29-09-20-9-Dv.png https://i.postimg.cc/qMmwMXVY/t-29-09-20-9-Dv.png

dannyw 6y ago
DuckDuckGo is blocked in India??
- vinay_ys 6y ago
  Nope
- uname_amiy 6y ago
  Yes, ISPs are blocking DDG. Airtel(ISP) is blocking DDG but HTTPS version is accessible. https://imgur.com/a/y7wnOjD https://imgur.com/a/y7wnOjD
  - smolder 6y ago
    What reason could they have for blocking DDG? Is it easier to find pirated content there than on Google or something? That's my best guess. I can't imagine they'd block on behalf of a competitor or something.
    - justDankin 6y ago
      You never know. Could be a mistake where they were trying to block a certain path due to some search result of copyright infringement, but ended up banning the domain itself. One can only guess. Reddit and Github have previously been temporarily banned in India due to similar "mistakes"
    - pjc50 6y ago
      I suspect it's political censorship/surveillance of some sort. Some suggest it's collateral damage from the ban on Chinese apps. https://www.themobileindian.com/news/duckduckgo-blocked-by-multiple-service-providers-in-india-31958 https://www.themobileindian.com/news/duckduckgo-blocked-by-m... Whether that's a mistake or they've made an enemy of some sort is not clear. India is a democratic country but not an especially free one.