6 ms·
From the article: > Ubiquitous presence of HTTPS allows you to pass your data through very restrictive middle boxes! This is, in fact, why all — or nearly all
by dlenski 3y ago
From the article:
> Ubiquitous presence of HTTPS allows you to pass your data through very restrictive middle boxes!
This is, in fact, why all — or nearly all — proprietary VPN protocols (so-called "SSL VPNs") implement a mode that initiates a tunnel via HTTPS, at least as a fallback if not as the primary mode of operation: precisely in order to have a mode of operation that works with almost any connection to the global Internet.
I'm one of the main developers of https://gitlab.com/openconnect/openconnect https://gitlab.com/openconnect/openconnect, which implements many such protocols, and wrote https://github.com/dlenski/what-vpn https://github.com/dlenski/what-vpn, which sniffs or identifies even more flavors of TLS-based VPN servers.
- deleted 3y ago[deleted]
- smolder 3y agoIt is tragic that we can't seem to use ports for their intended purposes because of crude attempts to limit the utility of a connection.
- iforgotpassword 3y agoExactly this. Continued ossification of the stack. We've practically given up on introducing new protocols on top of IP decades ago because parts of the internet drop everything that's not UDP or TCP. And because NAT. Now we're at the next step where we design protocols not on top of UDP/TCP but on top of HTTPS. You'd think that thanks to TLS this will be the final step but I guess we should never underestimate the idiocy of mankind.
- judge2020 3y agoThankfully with Encrypted Client Hello (formerly eSNI) we should be pretty future-proofed with middleboxes losing more information on where a HTTPS connection is going. The only thing left is the IP address, which is only a guess and is mostly useless if it's going to a CDN - effectively making all sites unblockable if they use akamai/CF/etc.
- 1over137 3y ago>...if they use akamai/CF/etc Well there you go. We went down to 1 port, then down to one protocol, now we'll soon be down to 1 company (akamai/CF/etc).
- judge2020 3y agoWith how many use big CDN providers, I imagine most network admins won't even bother trying to whack-a-mole ban IPs to try to block content - especially since most objectionable content, or at least content specifically made to evade filters, will be behind the CDNs anyways.
- LinuxBender 3y agoHow far away do you think we are in terms of having ECH support in OpenSSL, all the popular web browsers and proxies, etc...?
- sneak 3y agoI don’t think carriers being greedy monopolists is the idiocy of mankind; more like we are idiots for allowing regulatory capture to not only permit but encourage them in this sort of abusive rentseeking.
- candiodari 3y agoOn the other hand HTTPS provides private reliable bidirectional multiplexed communication ... exactly the same as TCP. As long as the initial handshake is https on port 443, you can tunnel tcp through any https proxy. They can't stop it, and if you use 2 layers of encryption, they can't tell what you're doing. AND the client can run in javascript (or wasm these days) And nobody will let companies turn that off, because that would mean ad networks would lose out. Which means none of the free services on the internet would work over such a connection, which means companies would either have to pay to implement their own services or do without those services. Both are inconceivable to managers, so ...
- gsich 3y agoWe can though. Look at games, lots of custom protocols and custom ports. They still work. Shitty corporate networks are not the norm.
- smolder 3y agoI could have qualified "can't" with "reliably" or "consistently", I suppose.
- NavinF 3y agoI think it's more expected than tragic. Old protocols leaked metadata all over the place because their designers isn't know any better. Every single packet used to be tagged with each app's number making it so convenient for every network in between to fuck with your data. Modern protocols reveal nothing until the TLS handshake is complete