4 ms·

AFAIK QUIC traffic is impossible to attack using MITM techniques. So I wonder how the GFW handles it. Do they block it entirely or still filter it somehow?

jeroenhd 1y ago
You don't need QUIC, TLS and other encrypted channels have the same protection. It's not hard to identify those channels and block them. A connection used to interact with websites has completely different traffic patterns compared to a user sending all of their traffic over one specific connection. Add to that the fact that large video streaming services such as YouTube, where you may see large quantities of data being exchanged over persistent connections, are already blocked in China, and your VPN becomes quite obvious without seeing even a byte of plaintext. Of course for common protocols like QUIC they have their own custom solution (linked in a sibling comment), but the point is that even with encrypted SNI you will need dedicated anti-GFW protocols to stand a chance against censorship. No protocol that works well for most consumers is going to protect against the analysis a dedicated firewall with decent funding can come up with.
immibis 1y ago
Typically they rely on metadata like the IP you're connecting to, or downgrade attacks. Until every server supports QUIC they can just pretend the server doesn't support QUIC. You might think IP checks are safe because everything's on Cloudflare and they can't block Cloudflare, but you'd be wrong. Even Spain blocks Cloudflare (yes, entirely) during football games.
xyzzy123 1y ago
According to https://gfw.report/publications/usenixsecurity25/en/#3 https://gfw.report/publications/usenixsecurity25/en/#3 they sniff the SNI out of the handshake like for TLS.
- 3abiton 1y ago
  Is that a new technique? Shouldn't this be mitigated?
  - lucb1e 1y ago
    ...parsing SNI to find the server name is like the second-oldest trick in the book, after reverse DNS from the 80s? Maybe I'm not understanding the question
  - pabs3 1y ago
    Encrypted Client Hello is the mitigation to that, IIRC it hasn't rolled out yet, and if it does then the GFW would probably just block connections that use it.
    - Agraillo 1y ago
      ECH is on by default for Cloudflare’s free plans, and paying customers can adjust the setting. That’s why CF already has an interesting history with the Russian authorities [1] (The discussion is short but has a lot of interesting details) [1] https://news.ycombinator.com/item?id=44392221 https://news.ycombinator.com/item?id=44392221
jonathanlydall 1y ago
Why would QUIC be any more or less MITM attackable than say HTTP1.1 or 2? AFAIK, the only thing that stops an MITM attack (where they respond as if they’re the remote server and then relay to the real remote server) are certificates. If an authority requires you trust their root certificate so they can spy on you, QUIC will not make any difference.
nabla9 1y ago
That's not true. QUIC's encrypted traffic does not protect against MITM.
- viraptor 1y ago
  QUIC uses TLS1.2 (or higher), so the guarantees are the same as for HTTPS streams. That means it protects the data streams against MitM.
  - lazide 1y ago
    Not if they have a root cert.
    - Thorrez 1y ago
      If China uses a root cert to issue bogus certs, that'll get caught by certificate transparency. Assuming people use browsers that enforce certificate transparency.
      - eptcyka 1y ago
        Kazakhstan literally forced their own cert for lots of popular sites for a while, expecting users to click the through and accept them. It was made illegal to not accept government certificates.
        esafak 1y ago
        https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_attack https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_a...
        Thorrez 1y ago
        Was Kazakhstan successful? esafak's link seems to imply it wasn't very successful. Anyways, my point wasn't that a government can't MITM using a root cert. My point is that the government can't do so secretly. The whole world will know if they try.

jeroenhd 1y ago

You don't need QUIC, TLS and other encrypted channels have the same protection. It's not hard to identify those channels and block them. A connection used to interact with websites has completely different traffic patterns compared to a user sending all of their traffic over one specific connection. Add to that the fact that large video streaming services such as YouTube, where you may see large quantities of data being exchanged over persistent connections, are already blocked in China, and your VPN becomes quite obvious without seeing even a byte of plaintext. Of course for common protocols like QUIC they have their own custom solution (linked in a sibling comment), but the point is that even with encrypted SNI you will need dedicated anti-GFW protocols to stand a chance against censorship. No protocol that works well for most consumers is going to protect against the analysis a dedicated firewall with decent funding can come up with.

immibis 1y ago

Typically they rely on metadata like the IP you're connecting to, or downgrade attacks. Until every server supports QUIC they can just pretend the server doesn't support QUIC. You might think IP checks are safe because everything's on Cloudflare and they can't block Cloudflare, but you'd be wrong. Even Spain blocks Cloudflare (yes, entirely) during football games.

xyzzy123 1y ago

According to https://gfw.report/publications/usenixsecurity25/en/#3 https://gfw.report/publications/usenixsecurity25/en/#3 they sniff the SNI out of the handshake like for TLS.

3abiton 1y ago
Is that a new technique? Shouldn't this be mitigated?
- lucb1e 1y ago
  ...parsing SNI to find the server name is like the second-oldest trick in the book, after reverse DNS from the 80s? Maybe I'm not understanding the question
- pabs3 1y ago
  Encrypted Client Hello is the mitigation to that, IIRC it hasn't rolled out yet, and if it does then the GFW would probably just block connections that use it.
  - Agraillo 1y ago
    ECH is on by default for Cloudflare’s free plans, and paying customers can adjust the setting. That’s why CF already has an interesting history with the Russian authorities [1] (The discussion is short but has a lot of interesting details) [1] https://news.ycombinator.com/item?id=44392221 https://news.ycombinator.com/item?id=44392221

jonathanlydall 1y ago

Why would QUIC be any more or less MITM attackable than say HTTP1.1 or 2? AFAIK, the only thing that stops an MITM attack (where they respond as if they’re the remote server and then relay to the real remote server) are certificates. If an authority requires you trust their root certificate so they can spy on you, QUIC will not make any difference.

nabla9 1y ago

That's not true. QUIC's encrypted traffic does not protect against MITM.

viraptor 1y ago
QUIC uses TLS1.2 (or higher), so the guarantees are the same as for HTTPS streams. That means it protects the data streams against MitM.
- lazide 1y ago
  Not if they have a root cert.
  - Thorrez 1y ago
    If China uses a root cert to issue bogus certs, that'll get caught by certificate transparency. Assuming people use browsers that enforce certificate transparency.
    - eptcyka 1y ago
      Kazakhstan literally forced their own cert for lots of popular sites for a while, expecting users to click the through and accept them. It was made illegal to not accept government certificates.
      - esafak 1y ago
        https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_attack https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_a...
      - Thorrez 1y ago
        Was Kazakhstan successful? esafak's link seems to imply it wasn't very successful. Anyways, my point wasn't that a government can't MITM using a root cert. My point is that the government can't do so secretly. The whole world will know if they try.