5 ms·

I'm curious, how does this work? It's a HTTPS site, so it's basically a MITM attack, which is not technically possible, is that right? Are you required to insta

I'm curious, how does this work? It's a HTTPS site, so it's basically a MITM attack, which is not technically possible, is that right? Are you required to install some certification from gov?

Delk 5y ago
Maybe they block entire domains, not individual pages? That wouldn't be affected by HTTPS at all.
gombosg 5y ago
The initial TLS handshake contains the hostname in plaintext, also DNS queries can be sniffed. On the other hand, MITM would be like changing a certificate in an attempt to alter traffic, this case is simple traffic blocking by doing packet inspection. (Which is also not nice obviously)
tanduv 5y ago
Depends on the ISP, but some have even done deep packet inspection - https://iamkush.me/sni-airtel/ https://iamkush.me/sni-airtel/
- Anunayj 5y ago
  But if SNI based blocking is the case, it should give ERR_CONNECTION_RESET, here the page appeared with apparently a (cloudflare issued) Valid SSL Certificate with the given text. Isn't that supposed to not happen? This is what curling the output gave me earlier: https://pastebin.com/Ae5DMn04 https://pastebin.com/Ae5DMn04 , Now the site has mysteriously started working. This should only be possible if the request is being intercepted somewhere between Cloudflare's server (which might have a unicast location in India) and the actual server that might be happening over HTTP, which is a serious issue! This would also explain why it works sometimes and fails the other times. But that won't explain why it shows my ISP in the blocked message. To further support this theory, Wireshark showed nothing weird in the TLS exchange, So it either suggests my ISP has cracked encryption (unlikely) or the link between cloudflare middleboxes and the "Internet" should be treated as insecure.
  - deleted 5y ago
    [deleted]

5 ms·

I'm curious, how does this work? It's a HTTPS site, so it's basically a MITM attack, which is not technically possible, is that right? Are you required to insta

by blahgeek 5y ago

I'm curious, how does this work? It's a HTTPS site, so it's basically a MITM attack, which is not technically possible, is that right? Are you required to install some certification from gov?

Delk 5y ago
Maybe they block entire domains, not individual pages? That wouldn't be affected by HTTPS at all.
gombosg 5y ago
The initial TLS handshake contains the hostname in plaintext, also DNS queries can be sniffed. On the other hand, MITM would be like changing a certificate in an attempt to alter traffic, this case is simple traffic blocking by doing packet inspection. (Which is also not nice obviously)
tanduv 5y ago
Depends on the ISP, but some have even done deep packet inspection - https://iamkush.me/sni-airtel/ https://iamkush.me/sni-airtel/
- Anunayj 5y ago
  But if SNI based blocking is the case, it should give ERR_CONNECTION_RESET, here the page appeared with apparently a (cloudflare issued) Valid SSL Certificate with the given text. Isn't that supposed to not happen? This is what curling the output gave me earlier: https://pastebin.com/Ae5DMn04 https://pastebin.com/Ae5DMn04 , Now the site has mysteriously started working. This should only be possible if the request is being intercepted somewhere between Cloudflare's server (which might have a unicast location in India) and the actual server that might be happening over HTTP, which is a serious issue! This would also explain why it works sometimes and fails the other times. But that won't explain why it shows my ISP in the blocked message. To further support this theory, Wireshark showed nothing weird in the TLS exchange, So it either suggests my ISP has cracked encryption (unlikely) or the link between cloudflare middleboxes and the "Internet" should be treated as insecure.
  - deleted 5y ago
    [deleted]