4 ms·
I donno about the UKs system but with South Korea they just check the host in the request header and block by that.
by kalium-xyz 4y ago
I donno about the UKs system but with South Korea they just check the host in the request header and block by that.
- jakewins 4y agoHow can they do that, the HTTP headers are encrypted by TLS?
- ShowalkKama 4y agonot op, no idea how they do it but they COULD look at the SNI in the client hello
- Nextgrid 4y agoUntil encrypted SNI/encrypted client hello is a thing, the hostname is still sent in the clear. Also, it can still be DNS blocked - just because you use Cloudflare's DNS doesn't mean they can't rewrite the responses as they still transit unencrypted. You'd have to use DNS-over-HTTPS or DNS-over-TLS to work around that.
- foepys 4y agoLuckily, ESNI is being supported by an increasing number of implementations.
- neilalexander 4y agoI believe China's answer to ESNI is just to block all traffic that attempts to handshake with ESNI, so it still won't necessarily get you anywhere.
- foepys 4y agoOnce everything is using ESNI this isn't a problem anymore. It's the lack of implementation that is currently the problem.
- 1vuio0pswjnm7 4y agoIf it's TLS1.2, certificates containing CNs and/or SANs are sent in the clear too.
- robertlagrant 4y agoMaybe it's actually SNI.