3 ms·
> This time I looked at Web Blocking, the blocking of domains accessed with HTTP and HTTPS. Anyone knows how this works, especially for HTTPS? I imagine it doe
by 3np 4y ago
> This time I looked at Web Blocking, the blocking of domains accessed with HTTP and HTTPS.
Anyone knows how this works, especially for HTTPS? I imagine it doesn't MiTM TLS so SNI..?
> The disadvantage of DNS is that it blocks one computer at a time. It can not block facebook.com the way Web Blocking does. With DNS you have to block abc.facebook.com and def.facebook.com and anything.you.want.facebook.com individually.
This isn't true. You can block domains with arbitrary rules - what you're looking for here is easy enough in any DNS server I ever worked with. Maybe there is such a limitation with this particular interface but that distinction should be clear.
- jve 4y agoYeah, not sure how this would work over HTTPS without proxy or rogue cert. With proxy, you can use HTTP CONNECT proxy : computer provides domain (SNI) and proxy can make allow/deny decision. If allowed, establishes a blind tunnel where packets flow without further inspection.
- Thorrez 4y agoSNI has nothing to do with proxies. Essentially all HTTPS connections provide SNI, regardless of whether there's a proxy or not. A MITM can sniff the SNI. There's a draft standard to encrypt the SNI. I don't think it's been widely adopted.
- Anunayj 4y agoSNI is part of the Client Hello part of TLS, (it's needed so the server can decide the appropriate SSL certificate to reply with), and since this happens at start of TLS handshake, it's transmitted in plaintext. Many Firewalls (and even my ISP), terminates the connection here if the domain is the blocklist. Since it's part of SSL negotiation, and unrelated to the actual HTTP query, in some cases you can find another (non blocked site) on the same server, send that SNI for TLS handshake, and then do the http request on the correct host to bypass stuff like this. (This technique is called domain fronting [1]). Unfortunately big CDNs like Cloudflare stopped allowing this because it's non-standard. There is a proposal for Encrypted Client Hello (and therefore Encrypted SNI) being worked on right now: draft-ietf-tls-esni-14 [2], till then using VPN/Web proxies are the only effective way of getting around these restrictions. [1] https://en.wikipedia.org/wiki/Domain_fronting https://en.wikipedia.org/wiki/Domain_fronting [2] https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ https://datatracker.ietf.org/doc/draft-ietf-tls-esni/