5 ms·

For anyone else wondering what domain fronting is: > Domain fronting is a technique for Internet censorship circumvention that uses different domain names in d

For anyone else wondering what domain fronting is: > Domain fronting is a technique for Internet censorship circumvention that uses different domain names in different communication layers of an HTTPS connection to discreetly connect to a different target domain than is discernable to third parties monitoring the requests and connections. https://en.wikipedia.org/wiki/Domain_fronting https://en.wikipedia.org/wiki/Domain_fronting Cool, so we are bowing down further to oppressive regimes now.

_8j50 4y ago
That definition is incomplete. Threat actors also abuse this to hide their command and control infrastructure.
- lzooz 4y ago
  Threat actors use knives to stab people - we have to stop selling those.
  - deleted 4y ago
    [deleted]
  - xeromal 4y ago
    There's an argument to be made for that. See, the UK.
    - chitowneats 4y ago
      Sure. Might be hard for people to do certain manual labor jobs without access to sharp objects. I'm sure they'll figure it out. We'll have to ban rocks next though.
      - oneplane 4y ago
        It's pretty hard to stab people with rocks, especially multiple people.
        notadev 4y ago
        But pretty easy to cause blunt force trauma to the head
        hedora 4y ago
        Generations of Native Americans beg to differ.
        oneplane 4y ago
        The native-american generations population probably doesn't intersect with the population of teenage knife-wielding attackers in london, which is what we're talking about. Then again, if you want to argue stone-age semantics: we can't ban anything and should just resort to continuous murder since rule-based society is too hard.
        exedore6 4y ago
        We just need to watch out for teenagers learning flint-knapping.
  - tialaramex 4y ago
    In the UK if you're under age and you decided to buy a knife you will have a lot of difficulty unless it's a little folding (but non-locking) pocket knife, like the small Swiss Army type utility knives. Indeed legally as old as 17 you can't even buy a steak knife in England although you can in Scotland. Once you've bought a knife, it will usually be illegal to carry it in public unless you have a good reason, and "self defence" is not a good reason. Some particular knives, which have no apparent purpose except as weapons, are just illegal automatically except in some cases if you're a museum. In particular almost all swords (if they have a working blade) are in this category, and most things designed as concealed weapons (e.g. blade hidden in an umbrella, combs that are actually knives, push daggers)
    - rovr138 4y ago
      I'm not trying to be an asshole, but we don't get much info from UK here besides things like the Queen dying, so I have to ask, Does it work? I mean, are instances of kids <=17 year olds with knifes down? What about shivs and other things? The reason I'm asking is because as a kid, if I had been told to not do something, I'd just find a way to do it. Not to use it, but to find loopholes and just say, _so what?, I can do x_
      - voakbasda 4y ago
        It absolutely does not work. Violence finds a way.
        metiscus 4y ago
        The mind is humanity's most lethal weapon. With the "right" mindset the entire universe can become a weapon. Efforts to reduce violence tend to focus on the presence of concrete weapons (because this is easier to quantify and measure etc) with much less focus on violent ideation and the root causes of the various forms of interpersonal violence. Reducing violence is a tricky thing because to a large extent it seems to me to be a symptom of broader and nearly intractable societal malaise. Not that it isn't worth removing nuclear weapons from circulation but the returns diminish quicker than most public policy folks seem to want to admit.
  - _8j50 4y ago
    Talk about a strawman. Knives have utiltiy which is a feature. Domain fronting is a bug not a supported feature.
  - brookst 4y ago
    You’re mixing up definition and policy. If airlines banned knives and someone posted a definition of “knife” that suggested they are only used for eating food, it would be perfectly reasonable for a reply to point out that there are dangerous uses which might have led to the bad, and that it’s disingenuous to suggest that the ban was obviously motivated by a desire to make eating difficult. It’s still fair to debate the balance of use and the merits of the ban, but IMO it is not reasonable to be upset over a more complete definition and context.
hsdropout 4y ago
I really enjoyed this explanation https://hackernoon.com/domain-fronting-101-what-is-domain-fronting-and-how-does-it-work-es2v37pr https://hackernoon.com/domain-fronting-101-what-is-domain-fr...
weberer 4y ago
They've been waging this war for a couple years now. I guess they finally got to every cloud provider. Some related reading: "Amazon and Google bow to Russian censors in Telegram battle" https://www.fastcompany.com/40568177/amazon-and-google-bow-to-russian-censors-in-telegram-battle https://www.fastcompany.com/40568177/amazon-and-google-bow-t... "U.S. Cloud Providers Face Backlash From China’s Censors" https://www.wsj.com/articles/u-s-cloud-providers-face-backlash-from-chinas-censors-1426541126 https://www.wsj.com/articles/u-s-cloud-providers-face-backla... https://archive.ph/qhFQ5 https://archive.ph/qhFQ5 >China’s Internet censors have strengthened content screening in recent months, creating difficulties for businesses and disrupting more commonly used firewall-circumvention software called virtual private networks, which connect users to the Web through a proxy server overseas. President Xi Jinping has ordered tighter control of online content that may undermine the ruling Communist Party, with bloggers facing jail for spreading what the government says are false rumors.
- deepsun 4y ago
  I still see Cloudflare.
- ftyhbhyjnjk 4y ago
FiloSottile 4y ago
It's been many years, and I am still angry and disappointed by Cloudflare's decision to block domain fronting and drop Lantern as a customer. Lantern was one of the most effective Great Firewall bypass proxies at the time, and Cloudflare was expanding in China. (I was at Cloudflare at the time, but I don't have private information on the deliberation. I strongly considered quitting over it, maybe I should have, but I was junior back then.) The CEO even came on HN to try to frame it as an abuse mitigation, accusing Lantern of exploiting Cloudflare and arguing that they were not a customer. That was obviously false because you need to have a Cloudflare zone configured for domain fronting to work. They were a customer as much as the targeted hate websites they strenuously defend. https://news.ycombinator.com/item?id=9234367 https://news.ycombinator.com/item?id=9234367 Companies show their color in selecting who they will stand up for.
- jgrahamc 4y ago
  The insinuation is that somehow we had to stop domain fronting because “China”. That’s false. What actually happened was we started to get reports from customers that we were serving content from unrelated sites under their domains. Wasn’t happening a lot but for a reverse proxy that’s terrifying and about as bad as it can get. And what made it even weirder was that the domain fronting was connecting to other proxy servers outside Cloudflare and so we literally had situation where a Cloudflare customer's website suddenly served up google.com (not a customer). The issue was domain fronting where SNI didn’t match Host causing us to handle the traffic incorrectly sometimes (infrequently but not zero). Since standard use of the Internet doesn’t need SNI and Host to not match we blocked the use of domain fronting very fast to ensure the integrity of our service. Lantern was domain fronting tickling this bug and causing our customers trouble. Hence we dropped domain fronting. I remember this well because I actually debugged it myself and reported the problem in Jira. You weren’t involved and inventing a story about “China” is dead wrong.
  - FiloSottile 4y ago
    As I said above, I was not involved in the deliberation, so I don't know the reason domain fronting was blocked. I clearly remember it being an explicit decision though, not a bug mitigation, and Matthew's explanation on HN makes no mention of a technical issue. I do remember one terrifying bug that Lantern was tickling which caused responses to cross streams, and I was involved in debugging that, but it was not due to the Host/SNI mismatch. It just happened around the same time that domain fronting was blocked. (I am going to respect my confidentiality agreement here, but if you want I can share what I remember here or in private.)
Avamander 4y ago
We have ECH (previously known as ESNI) now, is that not just domain fronting in a new form?
- theCrowing 4y ago
  Only for the legal stuff... so you will still get complaining comments.
- cesarb 4y ago
  No, because with ECH/ESNI the hostname in both layers (the TLS connection and the HTTP Host header) still matches. The only difference is that the hostname on the both layers is no longer visible on the wire, while without ECH/ESNI the hostname on one layer (the HTTP Host header) is hidden but the hostname in the other layer (the TLS connection) is visible. And you could still do domain fronting even with ECH/ESNI (making the hostname on each layer differ), though it would be kind of pointless.
deleted 4y ago
[deleted]
pmontra 4y ago
I was wondering that, thanks. What I'm wondering now is why one should use that instead of a proxy server that maps some.domain.com to something.else.com

_8j50 4y ago

That definition is incomplete. Threat actors also abuse this to hide their command and control infrastructure.

lzooz 4y ago
Threat actors use knives to stab people - we have to stop selling those.
- deleted 4y ago
  [deleted]
- xeromal 4y ago
  There's an argument to be made for that. See, the UK.
  - chitowneats 4y ago
    Sure. Might be hard for people to do certain manual labor jobs without access to sharp objects. I'm sure they'll figure it out. We'll have to ban rocks next though.
    - oneplane 4y ago
      It's pretty hard to stab people with rocks, especially multiple people.
      - notadev 4y ago
        But pretty easy to cause blunt force trauma to the head
      - hedora 4y ago
        Generations of Native Americans beg to differ.
        oneplane 4y ago
        The native-american generations population probably doesn't intersect with the population of teenage knife-wielding attackers in london, which is what we're talking about. Then again, if you want to argue stone-age semantics: we can't ban anything and should just resort to continuous murder since rule-based society is too hard.
        exedore6 4y ago
        We just need to watch out for teenagers learning flint-knapping.
- tialaramex 4y ago
  In the UK if you're under age and you decided to buy a knife you will have a lot of difficulty unless it's a little folding (but non-locking) pocket knife, like the small Swiss Army type utility knives. Indeed legally as old as 17 you can't even buy a steak knife in England although you can in Scotland. Once you've bought a knife, it will usually be illegal to carry it in public unless you have a good reason, and "self defence" is not a good reason. Some particular knives, which have no apparent purpose except as weapons, are just illegal automatically except in some cases if you're a museum. In particular almost all swords (if they have a working blade) are in this category, and most things designed as concealed weapons (e.g. blade hidden in an umbrella, combs that are actually knives, push daggers)
  - rovr138 4y ago
    I'm not trying to be an asshole, but we don't get much info from UK here besides things like the Queen dying, so I have to ask, Does it work? I mean, are instances of kids <=17 year olds with knifes down? What about shivs and other things? The reason I'm asking is because as a kid, if I had been told to not do something, I'd just find a way to do it. Not to use it, but to find loopholes and just say, _so what?, I can do x_
    - voakbasda 4y ago
      It absolutely does not work. Violence finds a way.
      - metiscus 4y ago
        The mind is humanity's most lethal weapon. With the "right" mindset the entire universe can become a weapon. Efforts to reduce violence tend to focus on the presence of concrete weapons (because this is easier to quantify and measure etc) with much less focus on violent ideation and the root causes of the various forms of interpersonal violence. Reducing violence is a tricky thing because to a large extent it seems to me to be a symptom of broader and nearly intractable societal malaise. Not that it isn't worth removing nuclear weapons from circulation but the returns diminish quicker than most public policy folks seem to want to admit.
- _8j50 4y ago
  Talk about a strawman. Knives have utiltiy which is a feature. Domain fronting is a bug not a supported feature.
- brookst 4y ago
  You’re mixing up definition and policy. If airlines banned knives and someone posted a definition of “knife” that suggested they are only used for eating food, it would be perfectly reasonable for a reply to point out that there are dangerous uses which might have led to the bad, and that it’s disingenuous to suggest that the ban was obviously motivated by a desire to make eating difficult. It’s still fair to debate the balance of use and the merits of the ban, but IMO it is not reasonable to be upset over a more complete definition and context.

hsdropout 4y ago

I really enjoyed this explanation https://hackernoon.com/domain-fronting-101-what-is-domain-fronting-and-how-does-it-work-es2v37pr https://hackernoon.com/domain-fronting-101-what-is-domain-fr...

weberer 4y ago

They've been waging this war for a couple years now. I guess they finally got to every cloud provider. Some related reading: "Amazon and Google bow to Russian censors in Telegram battle" https://www.fastcompany.com/40568177/amazon-and-google-bow-to-russian-censors-in-telegram-battle https://www.fastcompany.com/40568177/amazon-and-google-bow-t... "U.S. Cloud Providers Face Backlash From China’s Censors" https://www.wsj.com/articles/u-s-cloud-providers-face-backlash-from-chinas-censors-1426541126 https://www.wsj.com/articles/u-s-cloud-providers-face-backla... https://archive.ph/qhFQ5 https://archive.ph/qhFQ5 >China’s Internet censors have strengthened content screening in recent months, creating difficulties for businesses and disrupting more commonly used firewall-circumvention software called virtual private networks, which connect users to the Web through a proxy server overseas. President Xi Jinping has ordered tighter control of online content that may undermine the ruling Communist Party, with bloggers facing jail for spreading what the government says are false rumors.

deepsun 4y ago
I still see Cloudflare.
ftyhbhyjnjk 4y ago

FiloSottile 4y ago

It's been many years, and I am still angry and disappointed by Cloudflare's decision to block domain fronting and drop Lantern as a customer. Lantern was one of the most effective Great Firewall bypass proxies at the time, and Cloudflare was expanding in China. (I was at Cloudflare at the time, but I don't have private information on the deliberation. I strongly considered quitting over it, maybe I should have, but I was junior back then.) The CEO even came on HN to try to frame it as an abuse mitigation, accusing Lantern of exploiting Cloudflare and arguing that they were not a customer. That was obviously false because you need to have a Cloudflare zone configured for domain fronting to work. They were a customer as much as the targeted hate websites they strenuously defend. https://news.ycombinator.com/item?id=9234367 https://news.ycombinator.com/item?id=9234367 Companies show their color in selecting who they will stand up for.

jgrahamc 4y ago
The insinuation is that somehow we had to stop domain fronting because “China”. That’s false. What actually happened was we started to get reports from customers that we were serving content from unrelated sites under their domains. Wasn’t happening a lot but for a reverse proxy that’s terrifying and about as bad as it can get. And what made it even weirder was that the domain fronting was connecting to other proxy servers outside Cloudflare and so we literally had situation where a Cloudflare customer's website suddenly served up google.com (not a customer). The issue was domain fronting where SNI didn’t match Host causing us to handle the traffic incorrectly sometimes (infrequently but not zero). Since standard use of the Internet doesn’t need SNI and Host to not match we blocked the use of domain fronting very fast to ensure the integrity of our service. Lantern was domain fronting tickling this bug and causing our customers trouble. Hence we dropped domain fronting. I remember this well because I actually debugged it myself and reported the problem in Jira. You weren’t involved and inventing a story about “China” is dead wrong.
- FiloSottile 4y ago
  As I said above, I was not involved in the deliberation, so I don't know the reason domain fronting was blocked. I clearly remember it being an explicit decision though, not a bug mitigation, and Matthew's explanation on HN makes no mention of a technical issue. I do remember one terrifying bug that Lantern was tickling which caused responses to cross streams, and I was involved in debugging that, but it was not due to the Host/SNI mismatch. It just happened around the same time that domain fronting was blocked. (I am going to respect my confidentiality agreement here, but if you want I can share what I remember here or in private.)

Avamander 4y ago

We have ECH (previously known as ESNI) now, is that not just domain fronting in a new form?

theCrowing 4y ago
Only for the legal stuff... so you will still get complaining comments.
cesarb 4y ago
No, because with ECH/ESNI the hostname in both layers (the TLS connection and the HTTP Host header) still matches. The only difference is that the hostname on the both layers is no longer visible on the wire, while without ECH/ESNI the hostname on one layer (the HTTP Host header) is hidden but the hostname in the other layer (the TLS connection) is visible. And you could still do domain fronting even with ECH/ESNI (making the hostname on each layer differ), though it would be kind of pointless.

deleted 4y ago

[deleted]

pmontra 4y ago

I was wondering that, thanks. What I'm wondering now is why one should use that instead of a proxy server that maps some.domain.com to something.else.com