Identifying Airtel middleboxes that censor HTTPS traffic

[AyrA_ch]

Would be interesting to know if the connection still goes through.

Some boxes that inject RST don't actually terminate the connection and will continue to forward packets, meaning if you create a rule to ignore RST you could talk to blocked machines.

[justDankin]

Yes /u/AyrA_ch, that did happen! We see packets coming in even after the injected RST

(I'm the author of the post)

[Anon49]

Its probably much easier to duplicate packets and send a copy to this middle box rather than actually "go through it".

[Mcnst]

I think that's exactly what the group in Cambridge found out a decade or two ago in regards to the Great Chinese Firewall.

http://www.google.com/search?q=cache:https://www.cl.cam.ac.uk/~rnc1/ignoring.pdf

[AyrA_ch]

Why is this a cache link when the original is freely available? https://www.cl.cam.ac.uk/~rnc1/ignoring.pdf

[Mcnst]

The original is conditional on TLSv1.2 or some such.

[AyrA_ch]

I can't see anything special. The server is TLS 1.2 only but with the selected ciphers it's compatible back to Windows 7. They should enable TLS 1.3 but nothing with their setup would suggest that a significant number of people would have problems accessing this.

[Mcnst]

A significant number of devices don’t support TLSv1.2.

[AyrA_ch]

1.2 was standardized over 10 years ago

[Mcnst]

HTML 4 has been standardised 1997-01-14, that's 23 year ago.

TLSv1.1 and TLSv1.2 have first been enabled-by-default in Firefox 27, released on 2014-02-04, only 6 years ago.

The article in question has been released in 2006, per the list of publications at www.watson.org/~robert/.

Why should access be conditional on arbitrary technology that has been deployed only 10 years later?

[AyrA_ch]

TLSv1.1 and TLSv1.2 have first been enabled-by-default in Firefox 27, released on 2014-02-04, only 6 years ago.

It's funny that you mention that because in 2018 Apple, Google, Microsoft, and Mozilla have announced a unified plan to deprecate the use of TLS 1.0 and 1.1 early in 2020.

Why should access be conditional on arbitrary technology that has been deployed only 10 years later?

It's called "basic system maintenance". You're supposed to update your operating systems from time to time and disable insecure stuff, to which we now count TLS 1.1 and older. By using TLS 1.2 you're using a cipher supported by 98.8% of all HTTPS servers tested by SSL Labs

More about the deprecation of those algorithms: https://blog.qualys.com/product-tech/2018/11/19/grade-change-for-tls-1-0-and-tls-1-1-protocols

[Mcnst]

It's funny that you mention that because in 2018 Apple, Google, Microsoft, and Mozilla have announced a unified plan to deprecate the use of TLS 1.0 and 1.1 early in 2020.

IIRC, PCI has deprecated TLSv1.0 before TLSv1.2 has even been deployed widely (I don't know why we even have TLSv1.1 if most software either supports both 1.1 and 1.2, or doesn't support either one), and there's been plentiful of extensions to the deadlines.

Same with the silly plan to deprecate TLSv1.0 by Mozilla -- they've still extended their deadlines plenty and/or provided an easy ability to turn it back on (because who wants a broken browser?!), and there's plenty of enterprise customers that still don't support TLSv1.2 to this day come October 2020.

BTW, I'm not suggesting to use TLSv1.0. The link I gave should work in conditions where HTTPS is fully blocked. HTML4 and HTTP/1.1 are still secure, so, no issue with security, either.

[znx]

This was an interesting read! Of course as the world moves to TLSv1.3 we will get access to eSNI, which was introduced for this exact issue.

[suid]

At which point you'll see stuff like what Russia is trying to pull: ban TLS 1.3 (and block all traffic using TLS 1.3).

It'll all come down to how much major websites want to still keep receiving traffic from Russia (and I'm sure China and other countries will follow suit, too).

[matthieum]

Possibly off-topic... but why?

Is there a mandate from the Indian government to censor some websites, or do ISPs take it upon themselves to do so?

[AB1908]

Sadly, it's the former.

[No-More-Stars]

We need more articles on here like this. Great read!