3 ms·
Well, if you're using something like 1.1.1.1 for your DoH, you don't really need to inspect SNI, I don't think that there're other domains on that IP address.
by vbezhenar 4y ago
Well, if you're using something like 1.1.1.1 for your DoH, you don't really need to inspect SNI, I don't think that there're other domains on that IP address.
Yes, blocking stuff is the ultimate way and you can't really deal with that. You can just block any ECH (former ESNI) traffic as well.
Encrypting domain is a way to prevent someone learning things about your traffic. It's not a way to stop blocking. I'd say it's a way to provoke more blocking.
It might sound strange, but to reduce blocking you should remove encryption altogether. Usually censors apply censorship on a specific web pages. So if you're browsing wikipedia without encryption, censors can block that specific article, but rest will be available to you. With encryption the entire wikipedia should be blocked just to restrict access to a single article.
BTW you can remove encryption but keep authentication. TLS (at least previous versions) allowed for that. Theoretically it'd allow censors to apply their censorships, but it'd prevent them from changing content. I think that in the future people will think more about that concept.
- dane-pgp 4y agoSo you suggest that we give up all privacy (including the privacy of all our online passwords), and lose access to every page that a government censor might take issue to, just to prevent the hypothetical problem of the government over-blocking pages that it doesn't strictly need to? Actually I think that over-blocking would be good, as it would encourage more people to use Tor and VPNs, it would encourage more negative public opinion against the government spies/censors, and it would act as a form of economic sanctions against the regime because their citizens would get less value from the internet than they would without the over-blocking.