3 ms·
Couldn't authoritarian regimes still block a blacklist of SSL certs, since those are sniffable? Or block the public list of bridge addresses?
by etskinner 3y ago
Couldn't authoritarian regimes still block a blacklist of SSL certs, since those are sniffable? Or block the public list of bridge addresses?
- knowaveragejoe 3y agoIf I understand correctly, there is no way for them to differentiate traffic using this vs legitimate HTTPS traffic. In other words, if a large, legitimate website was also serving a webtunnel behind their reverse proxy, the censoring regime would have to block all traffic to that domain, legitimate or not.
- woofcat 3y agoDoubt it would happen but I'd love to see CloudFlare support this for all their domains. Blocking them is blocking 1/3rd of the internet.
- dilyevsky 3y agoCloudflare used to support domain fronting but they stopped doing that. Last i heard fastly still did
- bauruine 3y agoFastly blocked it two weeks ago. https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42435 https://gitlab.torproject.org/tpo/applications/tor-browser/-...
- dilyevsky 3y agoWelp, not surprised given it's bad for their business. Guess hence the timing of this webtunnel thing - afaik tor was using fastly at least for their snowflake thing.
- bauruine 3y agoYou can run a webtunnel bridge behind Cloudflare. It also works behind AWS Cloudfront but that's just way too expensive if you don't get a reasonable rate from them like 99% reduction.
- bauruine 3y agoYes they can block the domain if they find out it's used by a webtunnel bridge. Bridges aren't public that's the whole point of bridges. They are basically unlisted relays.