4 ms·

I'm confused. The article states that Snowflake uses domain fronting to connect users to forwarding peers. They use Google as an example: > ... domain fronting

by apeace 4y ago

I'm confused. The article states that Snowflake uses domain fronting to connect users to forwarding peers. They use Google as an example: > ... domain fronting lets the client make a request that looks like an ordinary web request for google.com ... To block Snowflake, a network or country would have to block all of Google But Google disabled domain fronting in 2018. Amazon did as well[0]. Cloudflare disabled it in 2015. The article even links to this Wikipedia page[1] on domain fronting, which states that all three of these providers have disabled domain fronting. So... how does it work? [0] https://signal.org/blog/looking-back-on-the-front/ https://signal.org/blog/looking-back-on-the-front/ [1] https://en.wikipedia.org/wiki/Domain_fronting#Disabling https://en.wikipedia.org/wiki/Domain_fronting#Disabling

brianbrush 4y ago
The Tor Project are currently using Fastly as the default for domain fronting in their Snowflake plugin, with cdn.sstatic.net (which serves various assets for Stack Exchange sites) as the front host, and snowflake-broker.torproject.net.global.prod.fastly.net as the target host. Prior to this, they were fronting via Azure, using ajax.aspnetcdn.com as the front for target snowflake-broker.azureedge.net. But they switched to Fastly after Microsoft announced they'd be changing their policy to explicitly block domain fronting: https://www.microsoft.com/security/blog/2021/03/26/securing-our-approach-to-domain-fronting-within-azure https://www.microsoft.com/security/blog/2021/03/26/securing-...
- apeace 4y ago
  Thanks for that info. So it sounds like the article is just inaccurate wrt Google. But that has some pretty big implications. Blocking Stack Exchange is very different from blocking Google. Snowflake and anything else relying on domain fronting are quickly becoming non-viable. I wonder what the next stage in the rat race will be?

by apeace 4y ago

brianbrush 4y ago

The Tor Project are currently using Fastly as the default for domain fronting in their Snowflake plugin, with cdn.sstatic.net (which serves various assets for Stack Exchange sites) as the front host, and snowflake-broker.torproject.net.global.prod.fastly.net as the target host. Prior to this, they were fronting via Azure, using ajax.aspnetcdn.com as the front for target snowflake-broker.azureedge.net. But they switched to Fastly after Microsoft announced they'd be changing their policy to explicitly block domain fronting: https://www.microsoft.com/security/blog/2021/03/26/securing-our-approach-to-domain-fronting-within-azure https://www.microsoft.com/security/blog/2021/03/26/securing-...

apeace 4y ago
Thanks for that info. So it sounds like the article is just inaccurate wrt Google. But that has some pretty big implications. Blocking Stack Exchange is very different from blocking Google. Snowflake and anything else relying on domain fronting are quickly becoming non-viable. I wonder what the next stage in the rat race will be?