4 ms·
Does anyone know how this works in Iran? All the way from the decision making to the question of: who do you call? What commands do they execute? I would naivel
by javajosh 4y ago
Does anyone know how this works in Iran? All the way from the decision making to the question of: who do you call? What commands do they execute? I would naively start with physical ingress points and add routing rules that stop traffic to service IP blocks (obtained by examining DNS records). Depending on how DNS is deployed (like, is there a national law to only use government run name servers?) you could freeze DNS records from updating.
That would be MY back-of-the-envelope approach to doing internet censorship in a totalitarian dictatorship. But I'm not convinced it's the best way.
- martinald 4y agoI imagine SNI too - which is in cleartext. There is encrypted SNI but I don't know how far that is along in terms of deployment. But really for a company like FB you could just blackhole their entire IP range(s) and/or AS (AS32934?) which would take everything offline very quickly.
- LinuxBender 4y agoCloudflare supports ESNI. AFAIK none of the mainstream browsers support ESNI by default. I believe the latest build of Firefox [1] may have an option in about:config to enable it. One could check if a website supports ESNI with [2] ESNICheck. Support for ESNI is still subject to change. [3] [1] - https://blog.cloudflare.com/encrypt-that-sni-firefox-edition/ https://blog.cloudflare.com/encrypt-that-sni-firefox-edition... [2] - https://esnicheck.com/ https://esnicheck.com/ [3] - https://serverfault.com/questions/976377/how-can-i-set-up-encrypted-sni-on-my-own-servers https://serverfault.com/questions/976377/how-can-i-set-up-en...
- XorNot 4y agoESNI is useless. Nobody cares that it's secret - they care that they don't know what you're doing. It removes plausible deniability, which means no more domain fronting bypasses. It's not enough to be "secure", you need to be able to hide in plain sight.