4 ms·

Well, that sucks. What's worse is it is wankers in the "infosec" industry that pushed MS to do this (or at least, are taking credit for it).

_8j50 4y ago
If you want to hide your domain name you can use eSNI. Keep in mind another name for censorship is moderation, it isn't just signal that uses it bad guys also abuse it and it was not a feature explicitly built to avoid censorship but more like a bug people were abusing.
- saddlerustle 4y ago
  It’s too late. Whole countries block all eSNI requests, so it’s always going to fail open.
  - coldsauce 4y ago
    Yeah, I believe China doesn't even allow TLSv1.3
    - tialaramex 4y ago
      Not allowing TLS 1.3 means nothing (no modern web sites) works. Modern browsers and servers both speak TLS 1.3 and if they can't they give up. Some things don't work in China, but China wouldn't have a thriving economy if nothing was working. So no, they did not block TLS 1.3 although it's interesting how this rumour seems to have self-popularised. China blocks certain popular sites, but it does not block whole protocols or protocol versions. This is actually a small triumph for the people responsible for RFC 8446. With previous iterations of TLS it was always discovered shortly after release that idiots broke stuff and so a "fallback" was necessary to allow you to speak the previous version. Such fallback is dangerous because an adversary can thus forcibly downgrade you to an older protocol, and thus attack old protocols even if the new protocol is safe. How is it done? That is, how does TLS 1.3 avoid downgrade attacks? When a TLS 1.3 server finds itself talking to somebody over TLS 1.2 (for example maybe a rather archaic web browser is connecting) it scribbles over some of the bytes labelled "random" in its Hello message. It scribbles 44 4F 57 4E 47 52 44 01. Which in ASCII spells "DOWNGRD". Those bytes don't mean anything special in TLS 1.2, they're just a strange coincidence. But if you're a TLS 1.3 client, seeing those bytes means a Downgrade attack was attempted. So you immediately give up, you are being attacked. So you might think well, a bad guy could just change those bytes blind right? Nope. The "random" field is used by both parties to choose parameters they're going to verify in a moment to check everything is safe. If you can change the bytes the values will be different and the connection fails anyway.
      - _8j50 4y ago
        They can ban tls 1.3 internally and do tls1.3 post intercept to the server.
      - psyfi 4y ago
        > Some things don't work in China, but China wouldn't have a thriving economy if nothing was working. Any company who does not want to lose a market of ~18% of global population will make sure it complies (example: Apple). We need to think about real life here and not just technical implementation
  - _8j50 4y ago
    Well then hopefully tech people will soon wrap their head around the fact that political problems are best solved politically. You can't write tech that overrides the authority of governments but you can override or change governments.
    - denton-scratch 4y ago
      > You can't write tech that overrides the authority of governments Really? Tor springs to mind.
      - _8j50 4y ago
        Same. What's your point? VPNs also bypass government blocks. It's a cat and mouse game, they block vpns and guards as they see fit when they have a good reason to. Look at tor, if a country tls decrypts everything and blocks connections that can't be decrypted can it still bypass their blocks? Just because not every government is doing it does not mean Tor can't be blocked. Hell, countries allow-list connections to allowed sites if they want. Breaking their laws may make you feel edgy but that sort of "revolution exporting" many in other countries consider it a form of neo-colonialism where you undermine their sovreignity and self-determination.
        denton-scratch 4y ago
        You're right; ultimately, if you have total power, you can just block the internet.
        mindslight 4y ago
        > many in other countries consider it a form of neo-colonialism where you undermine their sovreignity and self-determination. Only if by "their" you mean the ruling class, and by "self-determination" you mean their ability to control others. You can't really say their opinions represent the will of the people, especially when it's the people themselves ultimately choosing to engage in "illegal" activities. And sure, "the will of the people" bakes in two very western individual/collectivist values. But as I get older I'm learning to not play the relativism card as much. We should certainly be critical of our culture - but to the point of making it better, not handicapping its spread. Plus there's still a very easy answer for the poor oppressed tyrant who doesn't like freedom of communication - shut down all Internet connections.
- gruez 4y ago
  >Keep in mind another name for censorship is moderation No it's not, see https://news.ycombinator.com/item?id=33446064 https://news.ycombinator.com/item?id=33446064 On most social media sites they're implemented the same way (ie. posts deleted/hidden from other users), but the objectives are totally different.
  - _8j50 4y ago
    Let me rephrase then: what one calls censorship another might call moderation. The difference is authority to remove of hide content, if you have it then it is moderation. So, to be controversial for the sake or discussion then, Russia blocking Signal is moderation within the realm of their authority as is Iran blocking content they don't like or the US gov seizing domains. Either way, domain fronting was never an explicit feature anyone supported.
    - sieabahlpark 4y ago
    - 8note 4y ago
      I'd see them being different in terms of moderation acting as an allow list, and censorship acting as a deny list. They also have different targets - moderation is about a forum, while censorship is about an idea
deleted 4y ago
[deleted]
factsarelolz 4y ago
Could you explain to me how "nibbleshifter" would use the "feature" for good? What are you losing here "nibbleshifter"? Why do you put infosec in scare quotes? Why are they "wankers"? Why scare quote and name call a legitimate profession? Because you have qualms?
- nibbleshifter 4y ago
  Evading censorship in less democratic countries, for a start. I've had to do this quite a number of times on my travels - and its even more important for people in the human rights field. Tor's "meek" pluggable transport uses domain fronting for this purpose. I work in the so called "infosec" field, and about half the field are myopic wankers who would readily sacrifice privacy wholesale to gain an ounce of so called security. Think: the kind of people who also want to cripple eSNI or DoH in the name of "network monitoring".
  - factsarelolz 4y ago
    > even more important for people in the human rights field. Historically these people and even journalists are targeted by Nation States utilizing Israeli made offense tools like Pegasus. Domain fronting would not help in these cases to avoid censorship, maybe but you are attempting to circumvent a Nation State with almost unlimited money and resources the target would never be able to have. Does it suck that domain fronting is gone? Yes. Is it a good thing it's gone? Yes. The fact is the people that used domain fronting for your use case is heavily heavily outweighed by malicious actors. One could argue that domain fronting and guns are the same. Why should I have my gun taken away when I am using it for legal purposes? Just because bad people use a gun for bad things I shouldn't be scrutinized for my legal use. I shouldn't have access taken away due to bad actors leveraging them for ill gotten gains.
BeFlatXIII 4y ago
They probably threw in some pablum about "fake news" as well.

_8j50 4y ago

If you want to hide your domain name you can use eSNI. Keep in mind another name for censorship is moderation, it isn't just signal that uses it bad guys also abuse it and it was not a feature explicitly built to avoid censorship but more like a bug people were abusing.

saddlerustle 4y ago
It’s too late. Whole countries block all eSNI requests, so it’s always going to fail open.
- coldsauce 4y ago
  Yeah, I believe China doesn't even allow TLSv1.3
  - tialaramex 4y ago
    Not allowing TLS 1.3 means nothing (no modern web sites) works. Modern browsers and servers both speak TLS 1.3 and if they can't they give up. Some things don't work in China, but China wouldn't have a thriving economy if nothing was working. So no, they did not block TLS 1.3 although it's interesting how this rumour seems to have self-popularised. China blocks certain popular sites, but it does not block whole protocols or protocol versions. This is actually a small triumph for the people responsible for RFC 8446. With previous iterations of TLS it was always discovered shortly after release that idiots broke stuff and so a "fallback" was necessary to allow you to speak the previous version. Such fallback is dangerous because an adversary can thus forcibly downgrade you to an older protocol, and thus attack old protocols even if the new protocol is safe. How is it done? That is, how does TLS 1.3 avoid downgrade attacks? When a TLS 1.3 server finds itself talking to somebody over TLS 1.2 (for example maybe a rather archaic web browser is connecting) it scribbles over some of the bytes labelled "random" in its Hello message. It scribbles 44 4F 57 4E 47 52 44 01. Which in ASCII spells "DOWNGRD". Those bytes don't mean anything special in TLS 1.2, they're just a strange coincidence. But if you're a TLS 1.3 client, seeing those bytes means a Downgrade attack was attempted. So you immediately give up, you are being attacked. So you might think well, a bad guy could just change those bytes blind right? Nope. The "random" field is used by both parties to choose parameters they're going to verify in a moment to check everything is safe. If you can change the bytes the values will be different and the connection fails anyway.
    - _8j50 4y ago
      They can ban tls 1.3 internally and do tls1.3 post intercept to the server.
    - psyfi 4y ago
      > Some things don't work in China, but China wouldn't have a thriving economy if nothing was working. Any company who does not want to lose a market of ~18% of global population will make sure it complies (example: Apple). We need to think about real life here and not just technical implementation
- _8j50 4y ago
  Well then hopefully tech people will soon wrap their head around the fact that political problems are best solved politically. You can't write tech that overrides the authority of governments but you can override or change governments.
  - denton-scratch 4y ago
    > You can't write tech that overrides the authority of governments Really? Tor springs to mind.
    - _8j50 4y ago
      Same. What's your point? VPNs also bypass government blocks. It's a cat and mouse game, they block vpns and guards as they see fit when they have a good reason to. Look at tor, if a country tls decrypts everything and blocks connections that can't be decrypted can it still bypass their blocks? Just because not every government is doing it does not mean Tor can't be blocked. Hell, countries allow-list connections to allowed sites if they want. Breaking their laws may make you feel edgy but that sort of "revolution exporting" many in other countries consider it a form of neo-colonialism where you undermine their sovreignity and self-determination.
      - denton-scratch 4y ago
        You're right; ultimately, if you have total power, you can just block the internet.
      - mindslight 4y ago
        > many in other countries consider it a form of neo-colonialism where you undermine their sovreignity and self-determination. Only if by "their" you mean the ruling class, and by "self-determination" you mean their ability to control others. You can't really say their opinions represent the will of the people, especially when it's the people themselves ultimately choosing to engage in "illegal" activities. And sure, "the will of the people" bakes in two very western individual/collectivist values. But as I get older I'm learning to not play the relativism card as much. We should certainly be critical of our culture - but to the point of making it better, not handicapping its spread. Plus there's still a very easy answer for the poor oppressed tyrant who doesn't like freedom of communication - shut down all Internet connections.
gruez 4y ago
>Keep in mind another name for censorship is moderation No it's not, see https://news.ycombinator.com/item?id=33446064 https://news.ycombinator.com/item?id=33446064 On most social media sites they're implemented the same way (ie. posts deleted/hidden from other users), but the objectives are totally different.
- _8j50 4y ago
  Let me rephrase then: what one calls censorship another might call moderation. The difference is authority to remove of hide content, if you have it then it is moderation. So, to be controversial for the sake or discussion then, Russia blocking Signal is moderation within the realm of their authority as is Iran blocking content they don't like or the US gov seizing domains. Either way, domain fronting was never an explicit feature anyone supported.
  - sieabahlpark 4y ago
  - 8note 4y ago
    I'd see them being different in terms of moderation acting as an allow list, and censorship acting as a deny list. They also have different targets - moderation is about a forum, while censorship is about an idea

deleted 4y ago

[deleted]

factsarelolz 4y ago

Could you explain to me how "nibbleshifter" would use the "feature" for good? What are you losing here "nibbleshifter"? Why do you put infosec in scare quotes? Why are they "wankers"? Why scare quote and name call a legitimate profession? Because you have qualms?

nibbleshifter 4y ago
Evading censorship in less democratic countries, for a start. I've had to do this quite a number of times on my travels - and its even more important for people in the human rights field. Tor's "meek" pluggable transport uses domain fronting for this purpose. I work in the so called "infosec" field, and about half the field are myopic wankers who would readily sacrifice privacy wholesale to gain an ounce of so called security. Think: the kind of people who also want to cripple eSNI or DoH in the name of "network monitoring".
- factsarelolz 4y ago
  > even more important for people in the human rights field. Historically these people and even journalists are targeted by Nation States utilizing Israeli made offense tools like Pegasus. Domain fronting would not help in these cases to avoid censorship, maybe but you are attempting to circumvent a Nation State with almost unlimited money and resources the target would never be able to have. Does it suck that domain fronting is gone? Yes. Is it a good thing it's gone? Yes. The fact is the people that used domain fronting for your use case is heavily heavily outweighed by malicious actors. One could argue that domain fronting and guns are the same. Why should I have my gun taken away when I am using it for legal purposes? Just because bad people use a gun for bad things I shouldn't be scrutinized for my legal use. I shouldn't have access taken away due to bad actors leveraging them for ill gotten gains.

BeFlatXIII 4y ago

They probably threw in some pablum about "fake news" as well.