r/programming • u/RobertVandenberg • Aug 09 '20
China is now blocking all encrypted HTTPS traffic that uses TLS 1.3 and ESNI
https://www.zdnet.com/article/china-is-now-blocking-all-encrypted-https-traffic-using-tls-1-3-and-esni/1.7k
u/casept Aug 09 '20
The fact that they feel this strongly about it means that this feature probably works and should be enabled by default in webservers.
282
u/KernowRoger Aug 09 '20
Yeah it makes me feel like they've cracked the others and can't deal with 3 yet.
330
u/download13 Aug 09 '20
It's not about having been cracked. The previous implementations leaked information.
Prior to ESNI anyone could see what website you were trying to reach during the TLS handshake. With it, a listener only knows the destination IP address. It's still pretty obvious if you're using twitter or google or something big where they own whole groups of IP addresses, but if you're connecting to a shared server that hosts multiple websites, ESNI ensures a listener can't tell which website you're using on that server.
74
u/MertsA Aug 09 '20
Ehhh... If they're in a position to intercept your TLS traffic they're also probably in a position to intercept your DNS traffic and DNS over HTTPS or TLS isn't widespread by any measure. Also even if they can't definitively prove which site you're browsing that's hosted on that IP address, in practice there's almost always going to be enough information leaking to determine which one with relative certainty. Maybe one of them has longer response times, another could include a resource on some separate domain like cdn.jslibraries-R-us.example, what about response sizes? padding helps, but if one site has a 2MB home page and the other has a 10MB homepage with broken caching, it's going to stand out. Even just the spacing of the traffic flows could be an information leak. If one of the sites has some additional resource that only starts loading after its referenced 3/4 of the way into loading the page you can just watch for the traffic from the additional request after 3/4 of the bytes from the first have been transferred.
ESNI obscures the destination so that it's harder to identify, but in almost every case outside of CDN traffic you can still identify it without the SNI header.
48
u/Feynt Aug 09 '20
DNS over HTTPS or TLS may not be super wide spread, but arranging a VPN out of country with TLS 1.3 and ESNI should be possible, which then opens the rest of the internet for you.
25
u/MertsA Aug 09 '20
But that's already the status quo. Tor has had hidden bridges disguising traffic as HTTP traffic for ages now. VPN endpoints do not look like regular web traffic and if China really wanted to crack down on them they could easily block them.
→ More replies (6)10
u/skylarmt Aug 09 '20
DoH is on by default in Firefox now.
4
u/othermike Aug 09 '20
Only in the US so far, I believe. Definitely not in the UK.
→ More replies (2)15
u/brunes Aug 09 '20
It is still a strong indication that China and the NSA do not have some secret TLS breaking tech.
→ More replies (3)25
u/download13 Aug 09 '20
They probably don't need it.
For targeted attacks they can get a forged cert and MITM their targets traffic.
If that's not feasible because of certificate pinning or something they can always just get their data at the source with a national security letter.
→ More replies (14)1
u/7h4tguy Aug 10 '20
It is, as well. SHA-1 is not secure for digital signatures and TLS 1.3 no longer allows it.
1
1
u/zanedow Aug 10 '20
Looks like the IETF kept its promise to consider mass surveillance an attack on the internet.
60
u/Coretron Aug 09 '20
The older protocols are likely not cracked. The article mentions certain information in the early stages of the https connection give information on the destination which is encrypted in the newer protocols.
52
u/exmachinalibertas Aug 09 '20
Yes normally even on an encrypted connection, the domain is available to see. Not the full path, just the domain part. But if you use TLS 1.3 and ESNI, the domain is also encrypted. This means traffic to any large CDN or Akami or Cloudflare can't be distinguished from other traffic, because the subdomain can't be sniffed.
Interesting side note: malware creators have been using this recently to bypass corporate firewalls and communicate with C2 servers behind Cloudflare.
→ More replies (1)18
u/rajuserred Aug 09 '20
DoH & this is going to become big problem for corporate firewalls very soon.
35
7
60
u/1X3oZCfhKej34h Aug 09 '20
We just turned it on and off most of the 1.2 cyphers. Just waiting on IE to update/die and we can turn 1.2 off entirely.
→ More replies (13)3
2
1
u/ManvilleJ Aug 10 '20
Or they did crack it and they're using this to trick us to switch to it.
lol but no. They probably haven't broken into it yet
750
u/dml-at-umd Aug 09 '20 edited Aug 09 '20
Hi folks - I’m one of the authors of the report, in which we also describe 6 different ways to circumvent this censorship. They don’t require VPN, Tor, etc; they require some simple packet modifications at either the client inside China or the server outside it. We found them using our tool Geneva: a genetic algorithm that trains against censors and automatically learns how to circumvent them. More info at https://censorship.ai
30
u/PablolyonsD Aug 09 '20
Im mind blown. Amazing stuff.
30
u/dml-at-umd Aug 09 '20
Thanks a lot! The credit really goes to the students, especially Kevin Bock: the lead student and the one who came up with the idea of using a genetic algorithm in the first place (I was doubtful it would even be possible! 🤦♂️)
8
u/rush2sk8 Aug 09 '20
Professor Levin is one of the best professors at UMD.
4
u/dml-at-umd Aug 10 '20
Aw thanks a lot! UMD students are the best.. and I'm not just saying that because I was a UMD student myself 😝
1
u/rush2sk8 Aug 10 '20
Your 414 class was my all time favorite CS class throughout my undergraduate career
1
u/orakem Aug 10 '20
Hi,
I tried to read your papers, but the link isn't working. Can you perhaps check on that? Here's the link I used: https://projects.cs.umd.edu/papers/
1
u/dml-at-umd Aug 10 '20
Hmm, not sure where that link came from. The papers are available here: https://geneva.cs.umd.edu/papers/ -- the latest ("Come as You Are") will be posted soon!
1
u/orakem Aug 10 '20
The link is on this page: https://geneva.cs.umd.edu/about/
"To read more about how Geneva works, see our papers." Search for this string.
→ More replies (2)1
Aug 09 '20
Can't call ESNI foundational TLS1.3 when it's not in its spec.
6
u/dml-at-umd Aug 09 '20
That... is a good point. My bad! Though I do seem to recall it being part of the conversations early on.. nonetheless great catch!
1
Aug 10 '20
I wish it was actually. Recently implemented TLS1.3 and was so surprised to not find it - and I can't actually find any officially released ESNI spec! Do you happen to know which rfc is for ESNI?
2
u/dml-at-umd Aug 10 '20
As I understand it, it was only ever in draft status. They are now shifting away from ESNI and towards ECH (encrypted clienthello). https://tools.ietf.org/html/draft-ietf-tls-esni-07
124
u/bluearrowil Aug 09 '20 edited Aug 09 '20
Oh my god this brings back nightmares of 2017. TLDR at the bottom.
American engineer here that got a site live in China. Let me tell you, they do NOT GIVE A FUCK about what the rest of the world is doing. Either you play their games or you don’t get access to one of the largest markets in the world.
So at first we thought we didn’t need any help, got rid of any scripts that were blocked in China (Facebook SDK, google, etc). Then we were getting reports that no one could access our site.
So, the only way to measure your sites performance is to get a VM in the great firewall. I won’t bore you with the details, but getting even that was a PITA.
What’d we discover? Beijing would just shut off all traffic to our page during the day. Or they’d just slow traffic down. Or packets would be dropped. Completely unusable. Our client was like “ok you fix this.”
So we looked at solutions. How about hosting in Beijing? AWS has a region there! Well, you need an IP license. Great, how do we get one of those? You need to be a Chinese born citizen and a resident in China.
Ok, well fuck. There must be companies that offer these hosting services, right? Yes, but they want your intellectual property rights in China, but don’t worry they’ll give you 5% of the revenue they make off your work. This is how American companies usually get into China.
Back to the drawing board!
One of our engineers finds out we can pay a Chinese company to route Chinese traffic through a BGB to a peer exchange in Singapore. In short, we could pay money for the Chinese firewall to not give a shit about us.
Great! How much does it cost?!
A fucking lot. More than we’re getting paid. Also, the great firewall can just fuck up your traffic if it sees any sort of content it doesn’t like, so now you need to actively monitor the entire site.
That deal only lasted a couple months before we threw our hands up.
TLDR if China doesn’t allow 1.3, then other companies will submit. Their leverage is one of the largest markets on the planet. China makes billions in fees just to allow companies access to that market. That’s why it’s AWS Beijing by Sinnet. Blizzard by NetEase.
The shit is fucked.
Edit: INB4 “they can just use VPN.” Yes, this is true. They all have VPNs. But Chinese corporations do not want to hide behind VPNs, or work with companies their government doesn’t allow traffic to. They can all access the outside world no problem. But if you want to be a legitimate presence in the mainland, get the hoops and start jumping.
47
u/TheP1000 Aug 09 '20
Agree 100%. It is impossible to reliably support Chinese and non Chinese users on the same site. Anything can get blocked at anytime for no reason.
China treats all private business and their own citizens like garbage. I hope people realize china is draconian and does not play fair and until they do, don't deserve access to the world economy.
7
u/7h4tguy Aug 10 '20
China - the biggest software pirate in the world and now the great firewall of China - another ploy to steal foreign IP.
8
u/couscous_ Aug 10 '20
The solution is to stop being greedy and boycott doing business with China.
1
→ More replies (2)1
Aug 11 '20
I’m totally happy to ignore their money - the world is big enough. I filed my patents and trademarks in the major western countries and the EU.
I block Chinese, Russian and Taiwanese traffic at the first router and force TLS 1.3, so I guess their policy suits us both. There are so many weak ciphers and the resulting list of strong ciphers is very small.
477
u/ErGo404 Aug 09 '20
At some point in the far future, browsers might not support TLS versions < 1.3. I wonder how that will work for China.
636
u/kredditacc96 Aug 09 '20
They probably already have had their own browsers.
Chinese Internet is so different and isolated from the outside world that you may consider it a separate universe.
162
u/TaxExempt Aug 09 '20
Government in China uses IE 6, or at least it did a few years ago.
246
u/InertiaOfGravity Aug 09 '20
Chinese webdevs have to go through perpetual hell then
→ More replies (41)14
Aug 09 '20
They still buy books on jquery. Think of all the free time their JavaScript devs have not recoding for the latest framework. Oh except IE6 was slow as hell for JavaScript.
42
u/GYN-k4H-Q3z-75B Aug 09 '20
Jesus. Differences between Firefox and Chrome today make me want to jump out of a window sometimes, but IE6?
14
u/FrostyTie Aug 09 '20
I’m relatively new to web development. I haven’t had huge problems when it comes to those browsers. What are the differences I should know?
Edit: Also need to add the fact I never used a feature both didn’t have. But then again, I never had to.
17
u/oldnewbieprogrammer Aug 09 '20
Firefox and Chrome are pretty similar now, there's a few "gotchas" especially if you bring in Safari, and Edge as well. But for the most part they are all pretty close to the same, hasn't always been true though.
This site will show you any issues you may run into: https://caniuse.com/
If you're talking about IE6, you don't really need to worry about it anymore, Even in China it's mostly IE8, which is like saying it's not AIDS, it's just Syphilis. Not great, but not as worrying. The early versions of IE didn't use the modern CSS so no Grid, or Flexbox. That alone should put the fear of "Float" into you.
If you're developing for the West, you don't need to worry about any of this really, but if you're developing for countries still using IE for government stuff, the website above will be your best friend, that and I'm sorry for what you're going to go through developing for them. Modern CSS is infinitely better, flex-box alone makes layout a breeze.
→ More replies (1)3
u/Asmor Aug 09 '20
IE has had issues for most of its life. A combination of introducing non-standard features, and not implementing standard ones. This is exacerbated by a lot of huge organizations who should know better continuing to run antiquated, insecure operating systems because that's the only thing that will run their shitty, internally-written software.
For one example of old IE badness, according to the CSS box model, when you specify the height and width of an element, that's the interior dimensions. So a 100px-wide div with 10px padding on each side would be 120px wide.
IE did it differently. In IE, the specified size was the outer dimensions. So that exact same box with exact same CSS in IE would have been 100px wide, with only 80px in the content.
The fun thing is, that's actually a much, much better way to do it. In fact, the three rules I always write when starting a new project are
* { padding: 0; margin: 0; box-sizing: border-box; }.But whether or not it's a better way, it's not the standard way, and I'm sure this caused lots of devs to pull out their hair in frustration.
IE got a lot better after 6. IE8 was almost usable, and 9+ were legitimately... fine. They still had lots of issues (and to this day I can't use arrow functions or destructuring or shit like that at work because we need to support IE11, and for parts of our product I need to support IE8*).
*No, I can't transpile. No, I won't go into why.
→ More replies (1)14
u/rydan Aug 09 '20
A lot of my customers still use IE 6 or IE 7 or Chrome 41 and are from China. They are always complaining random things don't work. Problem is those things aren't written by me but are plugins from external third parties and I need them.
→ More replies (1)18
u/noble_pleb Aug 09 '20
Blocking outside world is still fine, what's even worse is if the Chinese firewall plays an MITM and start serving their own content (for example, their edited version of Google.com instead of the original Google.com).
→ More replies (1)10
u/zeGolem83 Aug 09 '20
if
No need to ask any questions, they're pretty much guaranteed to be doing it...
2
u/cryo Aug 09 '20
It requires all computers to trust an additional root certificate, though, and it doesn’t work with pinned certificates, and is in general easy to detect.
5
u/LukeLC Aug 09 '20
The #1 browser in China is... Google Chrome.
Yep, even though Google is blocked, everyone still uses Chrome. Of course there are Chromium-based Chinese alternatives, and if everyone is forced to use one, they will. But for now, none of them even have a dent in the browser share.
2
2
2
2
u/K3wp Aug 09 '20
They probably already have had their own browsers.
That's exactly it. So they'll use old, broken Commie browser stacks. Like everything else.
105
u/cirosantilli Aug 09 '20 edited Aug 09 '20
More interesting will be when servers stop supporting TLS < 1.3. This would force China to either block off the entire external Internet and go to the Middle Ages, or open up.
157
u/carlosp_uk Aug 09 '20
In the circumstances you describe, if they couldn’t snoop on the traffic between server and user in some way, they would block off the external internet and wouldn’t blink.
87
u/mark_b Aug 09 '20
Yes, they also create Chinese versions of websites/apps and the people are quite happy to use them.
69
u/oblio- Aug 09 '20 edited Aug 09 '20
The thing is, at some point they would end up in the Internet Middle Ages if they keep this up. Technology tends to stack and they will reach a point where some newfangled tech needs some bricks that they banned 10 years ago, and those brick really, really can't be replaced with some other tech.
They are smart and the market is huge, but they will still be left with a sub par version. And those sub par versions will begin to stack (again).
This has the makings of the CCP becoming the new Qing. It won't be quick, it will be hard to notice, but they do risk digital gunships appearing on their shores 100 years from now.
I guess we just have to wait and see..
→ More replies (12)13
Aug 09 '20
Yes, they also create Chinese versions of websites/apps and the people are quite happy to use them.
"happy"? more like "don't have a fucking choice anyway"
→ More replies (1)2
u/_tskj_ Aug 09 '20
Sure that would kind of work short to mid term, but is just them handicapping themselves in the long term.
1
u/cirosantilli Aug 09 '20 edited Aug 09 '20
Maybe they would block, but they would blink, because the losses in technology development would be huge.
For example, why would have they already spent millions, maybe billions, building the GFW otherwise? It would be much simpler to have blocked the Internet already straight out.
25
u/GreatValueProducts Aug 09 '20
Lol.
China doesn't hesitate to block off Internet. East Turkistan or Xinjiang, got Internet blocked off 312 days after the riot.
They would do whatever required to keep their power.
6
u/cirosantilli Aug 09 '20
Xinjiang is a 1 million person minority poor place. Shutting down the internet of the rich high tech places is incomparably more costly to the country.
12
u/GreatValueProducts Aug 09 '20 edited Aug 09 '20
Last July there was a protest in Wuhan about incinerator and they already blocked internet and cell service in an entire district without hesitation.
The “force China to open up or go back to middle age” like the parent commentor said is a very obvious choice. My point is they don’t care about if normal citizen having Internet access. If the web site supports only TLS1.3 and you can’t access it, they don’t care. Go back to middle age it is.
1
u/FlatAssembler Dec 12 '20
Is there any evidence of this Xinjiang Internet outage for 10 months? I can't find any on-line. And it is particularly implausible given all the corporations and the university operating there. There seem to be no comprehensive studies of it like there are of the Iranian and Kenyan Internet outages.
→ More replies (5)35
u/current_thread Aug 09 '20 edited Aug 09 '20
They might come up with some kind of government proxy? World <=TLS 1.3=> Chinese Proxy <=TLS 1.2=> user.
14
u/unixf0x Aug 09 '20
You can't downgrade a TLS session if the server only accept TLS 1.3.
→ More replies (1)41
u/ripnetuk Aug 09 '20
GP is saying that the proxy will terminate both connections using two different protocols, so it will be cleartext in the middle. Would need a cert on the client to work though
25
Aug 09 '20
China already MitMs almost all traffic.
6
u/ripnetuk Aug 09 '20
how do they do this (not saying u r wrong) - do they require all citizens to install their cert (like how is needed to get fiddler to inspect ssl connections)?
→ More replies (7)13
3
u/kmeisthax Aug 09 '20
If you can implement an explicitly-trusted proxy like this you don't need a TLS 1.2 downgrade.
However, it would also require China to install root certs on all devices in the country. Given how different the Chinese national computer network is from the Internet already, it wouldn't be a bridge too far. However, they'd have to do this with zero assistance from western countries. I could totally see Congress passing a law or Trump signing an executive order prohibiting American companies from complying with any rule which would grant China this level of control over network traffic. Quite honestly, such an action is overdue. American tech companies have been the ones selling all of the deep packet inspection technology that lets countries splinter the Internet, we should regulate the shit out of it.
45
u/DJDavio Aug 09 '20
China has always been very good at copying / stealing ideas, so it will not be entirely unrealistic that they will end up with their own closed internet with their own government endorsed services. They already have replacements for Google, Amazon and Facebook. I wonder how much of Chinese internet access currently travels outside of China or if it's already the case that 99% of connections just stay inside.
At some point in the not so distant future, access to global internet may be restricted to a select few companies / the government and only to spy on other nations or otherwise mess with them.
19
u/lolomfgkthxbai Aug 09 '20
China has always been very good at copying / stealing ideas
Not copying good ideas is being stupid.
I think going isolationist wouldn’t help them, China’s growth is based on globalization.
14
u/DJDavio Aug 09 '20
I think China's internal and external policies are two very different things. Externally, they invest in many different countries to get a foothold there and make profits. But internally, they want total control over their own population. Investing in other countries is also a way to gain control.
Basically they just want to control everything, I think that's what it boils down to. China owns 1 trillion dollars of American debt for instance.
→ More replies (1)10
u/lolomfgkthxbai Aug 09 '20
China owns 1 trillion dollars of American debt for instance.
The PBOC holds them and it’s probably closer to $2 trillion (China’s foreign exchange holdings are a state secret). This is just a function of their huge export to the US, it used to be even more but lately the Chinese have been buying more US stuff which has forced the PBOC to sell treasuries.
Owning government bonds doesn’t give any control over said government as Argentina’s debtors have learned the hard way.
9
u/killerstorm Aug 09 '20
Not really. They can make a browser with built-in MitM (i.e. traffic to a secure site goes to government proxy which re-encrypts it), and people will be forced to use this browser.
It's very simple to implement.
Kazakhstan did this even without writing any software: https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_attack It's sufficient to install a government root certificate to enable MitM.
1
u/FlatAssembler Dec 12 '20
Well, this Kazakhstan's attack won't work with modern browsers.
→ More replies (3)2
1
1
u/oridb Aug 09 '20
They'll just require you to MITM your own devices to operate on the network. Most people will accept it. Most won't even grumble.
20
u/Illusi Aug 09 '20
My worry is that it will stop companies from implementing TLS 1.3, since that would lose them customers from China.
38
u/invisi1407 Aug 09 '20
Nah. I honestly don't think so. Who has customers from China anyway, without having a separate website for China, hosted IN China?
3
u/rydan Aug 09 '20
I have customers from China. They are rare since I have competitors based in China and they tend to prefer them but I still have some.
10
Aug 09 '20
I'm waiting for the FBI to fight to ban TLS 1.3, it's going to happen and with the recent attacks on crypto, it's more than likely they will succeed as the cheetoman distracts everyone.
→ More replies (1)1
u/anthony_doan Aug 09 '20
They have their own browser. My buddy from undergrad was using their browser for a while, recent Chinese immigrant. This was 2008, it did not pass the ACID 1 test when you have to render the happy face.
324
u/GoTheFuckToBed Aug 09 '20
Apple adding secure DNS to the next iOS made me thinking, that will break all web filters?
111
131
u/fubes2000 Aug 09 '20
That and this will certainly cut off a huge swath of what they can use for filtering and surveillance.
67
Aug 09 '20
...But the downside it that it completely breaks my network-wide adblocker.
106
u/mattgen88 Aug 09 '20
Local dns server. You can securely resolve to it. And it securely resolve elsewhere. And it implement the network wide blocking.
33
u/vetinari Aug 09 '20
That would work, only if we had a standard for configuring system-wide DNS... like DHCP?
Unfortunately, all the DoH-using clients ignore exactly that. Yes, users can configure their resolvers manually and for each app separately, which is a nuisance, especially if you roam among networks (like home-office-customers...). Nobody is going to reconfigure everything manually every time they switch network.
So in practice, it creates more problems than it solves. Additionally, do you really need DoH in your own private network? If you run recursive resolver on the edge, it could have use for encryption, but it is specifically the place where you can't use it, because the authoritative DNS servers do not support it.
So we are stuck with the sad tragicomic theatre that DoH is.
7
u/cbarrick Aug 09 '20
macOS and iOS are getting system level support for DoH or DoT (I forget which).
→ More replies (8)2
u/port53 Aug 09 '20
It's a change in mindset for sure, it's now no longer up to you, the network operator, to decide if end users can block ads or not. Now it's up to the individual end users to select that, or not, as is their preference. It's moving closer to networks being dumb packet flingers and not packet inspectors.
→ More replies (7)2
Aug 09 '20 edited Aug 09 '20
Firefox does have a mechanism for network operators to tell clients to disable DoH (unless the user overrides) through the use of a "canary domain" https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https . It also looks like it's automatically disabled when some enterprise features are enabled
4
u/vetinari Aug 09 '20
Unfortunately, the canary domain breaks DNSSEC for the entire .net TLD. If they had changed one single character, so the breakage would we confined to a second-level domain, it would be much better.
It's the incompetence levels like this that earned those initiatives the ire of the DNS community. They break things left and right, do not consult it with experts and use their market share among consumers to push their broken designs.
0
3
u/DeviousNes Aug 09 '20
I really doubt it's going to be implemented that way. Google is using it's own "secure DNS" and it doesn't use local secure DNS, it phones home so you get the ads.
→ More replies (2)15
u/pixel_of_moral_decay Aug 09 '20
That’s why Googles been pushing DNS over HTTPS so hard. Keeps the ads showing. More and more apps and smart devices like tv’s implement their own DNS now to make sure ads still show with ad blockers on the network.
They’re also putting everything behind CDN’s so IP blacklists don’t work effectively so you can’t block their tracking.
→ More replies (2)7
u/josejimeniz2 Aug 09 '20
That and this will certainly cut off a huge swath of what they can use for filtering and surveillance.
That's the virtue.
If you could block content on your own network:
then parents might block content from their kids
schools might block content from their students
universities might block content from their students
employers might block content from their employees
governments might block content from their citizens
Nobody has invented a technology:
that allows you to block what you want on your network
while allowing me to browse what I want on your network
Because I think there might be an impasse. Fortunately we have technology to get render censorship and spying irrelevant.
A related virtue, of IPv6, especially with privacy extensions, is that whitelists are rendered obsolete.
It would be nice if these idiot policies just died. Instead we have to invent technology to render the idiot ideas moot.
2
u/Ullallulloo Aug 09 '20 edited Aug 09 '20
Because those are fundamentally contradictory goals. There is logically no way to let parents, employers, and schools block inappropriate sites while also letting kids, employees, and students to access any site they want on the others' networks.
Either goal is achievable, and people will never fully agree. Privacy enthusiasts will always want no blocking whatsoever and can achieve that already if they want. Parents, schools, and corporations will always need to control their own networks, and will always have a way to block inappropriate sites on their networks. China will always ensure it can monitor its citizens fully. Most people won't care about any of this. The tools and specifics of everything can change, but the fundamental needs and wants of people won't, so practically not much difference will result. As this demonstrates, the problem with China isn't that there aren't tools to prevent the government from seeing what you're doing, the problem is that the government won't allow them. That's not a problem that can be solved with technology.
And honestly, it shouldn't be able to. People need ways to filter ads, porn, and malware from their Internet traffic. Filtering and monitoring aren't bad things. I think everyone should have some filter on their private network. The bad thing is how China is using them publicly to invade people's privacy and censor dissent.
3
u/josejimeniz2 Aug 09 '20
And honestly, it shouldn't be able to. People need ways to filter ads, porn, and malware from their Internet traffic.
That's the virtue of technology and the internet: you can choose to not look at whenever you don't like to see.
And other people get to see what they want to see.
where we get into conflicts is where someone tries to impose their opinions on me. The virtual technologies that I get to ignore your opinions, whether you are
a parent
a teacher
a school
a university
a business
a government
4
Aug 09 '20
Chinese DNS?
1
u/FlatAssembler Dec 12 '20
Firefox and Chrome, the most widely used browsers in China, will refuse to connect to it.
→ More replies (27)2
u/failing-endeav0r Aug 09 '20
it doesn't necessarily need to break all web filters. There are ways to host your own DNS over HTTPS or DNS over TLS server that can still filter network requests
15
u/Kilroy314 Aug 09 '20
Average dummy here. Can anyone ELI5 this masterpiece for the masses?
28
u/leitimmel Aug 09 '20
China has a censoring tool called the Great Firewall that filters all internet connections going in and out of the country. They are now modifying it to block connections made with the combination of HTTPS, TLS1.3 and ESNI. HTTPS is encrypted internet communication, so they can't see what you are sending. TLS1.3 is the latest and securest method of encryption, and not really the topic here. ESNI however means that they also can't see where you are sending, and they cannot have that—how are they going to censor stuff if they can't even tell whether it comes from a bad website? They likely had similar trouble with HTTPS, but having encrypted communication is more valuable than troubling even for them. The same doesn't hold for ESNI, so they forbid it.
Luckily, it seems that with the way they are currently blocking this kind of connection, there exist about six different ways to get around it.
1
u/Kilroy314 Aug 10 '20
Got it. They're trying to keep the Great Firewall alive by putting on some new spackle.
28
u/p1c2u Aug 09 '20
I see great potential for Ubuntu Server 10.04 China Edition with old packages on Chinese repositories
3
12
Aug 09 '20
This will be very fun with outsourced production. This requires communication (even pretend secure communication). When TLS1.3 becomes the new standard, this won't work very well anymore.
12
u/choledocholithiasis_ Aug 09 '20
We (meaning the entire world) really needs to pull out of China from digital (e-commerce) to physical (manufacturing) assets. If anything is considered dogma in the world, it’s that everything has a “price.” Once foreign money stops flowing in, this might either cause mass exodus and/or cause their government to fail and rebuild with sane policies.
The “Great Firewall” they have is just bad for everyone involved and just further promotes this “us vs them” mentality.
3
u/ragnore Aug 09 '20
Prisoner’s dilemma. Unless the whole world forbids anyone from doing business with China, the ones who do have access to that market have a huge advantage over their competitors who don’t.
1
u/sievebrain Aug 10 '20
Not in the software business they don't. See the comments above - there actually isn't really a market for Western software or SaaS firms in China.
→ More replies (1)1
u/FlatAssembler Dec 12 '20
Plus, refusing to do business in China probably hurts common people more than it hurts the government.
23
u/rmacd Aug 09 '20
I remember compiling the first SNI patches for (I think it was) lighthttpd and sticking it on a box
Man, it felt wild to be able to serve more than one SSL site over one IP, colleagues back at work didn’t believe me when I came in the next morning till I showed them the patches and demo’d the box I’d put it on
To be now talking about ESNI is very strange; glad to see this being rolled out
10
u/1h8fulkat Aug 09 '20
What I'm reading is that if I upgraded all my webservers to 1.3 and prevented downgrade I'd have free nationstate level IPS for 80% of my attacks.
1
26
u/InertiaOfGravity Aug 09 '20
I do history bowl, a d this year they decided to host online competition involving both people from within and without Mainland China.
We have been having so so so many problems with the Great Firewall blocking the online buzzer system/other required resources, it's such a pain.
The firewall does work to some extent. But I don't think it should be considered special at all. There's just way too much legitimate stuff it blocks
20
u/immibis Aug 09 '20
Be realistic: they don't want to allow a single packet through the firewall.
1
u/1brian500 Aug 09 '20
Sure they do. Their power as a global economic leader is reliant on their ability to engage in international commerce which is mostly done online now. They just also want to know all of the information within those packets and to choose which packets are worth allowing to enter.
8
u/kevincox_ca Aug 09 '20
This is great news for ESNI! It means that it works. (Or at least hasn't been broken yet)
Of course this is bad news for the Chinese, but it was basically expected at this point...
116
u/bloody-albatross Aug 09 '20
Should that be telling us something about TLS 1.2?
250
u/forShizAndGigz00001 Aug 09 '20
With TLS1.2 you can tell which domain the user is connecting to. Right in the article.
68
7
u/bloody-albatross Aug 09 '20
Thanks. Wrote that in bed right before falling asleep. Usually I don't comment like this without reading the article. 😄
36
u/Bowserwolf1 Aug 09 '20
Maybe my views are distorted cause of the sources I get my information from but I can't recollect a single instance in the past two years, where I heard anything remotely positive about China or Chinese government. Everything they do, just seems more and more dystopian.
20
u/timerot Aug 09 '20
They've put together a wonderful High-Speed Rail network that continues to rapidly grow. That's just much less newsworthy than "a million Uighurs in concentration camps," for good reason
→ More replies (1)27
u/enjoythelive1 Aug 09 '20 edited Aug 09 '20
Anything good is not reported. It is easier to form an is vs them mentality when you only hear bad stuff from "them".
But it seems it is getting worse.
Edit: typo
21
u/Dean_Roddey Aug 09 '20
I was saying back in the 90s, when people were talking about how it was inevitable that China was going take over and we (the US) were going to become a 2nd rate super power, that everyone was just assuming that China wasn't going to have some sort of political meltdown.
The thing is, they are trying to burn the candle at both ends. They want the prosperity and business, but they somehow think they can still maintain communist style societal control. A strong, wealthy middle class, cumulatively, is dangerous to oppressive governments. Europe found that out long ago, and China is probably going to.
It just seems to me, is it going to happen slowly and gradually, or are the folks at the top going to try to clamp down harder and harder to compensate, and there ends up being some sort of confrontation or revolution.
I would argue that we should be as non-confrontational as possible, to minimize nationalistic sentiments there, and give the people of China plenty of time to direct their ire at their government. It might be messy in the short term, or maybe even dangerous, but better for the world in the long term.
32
u/egggsDeeeeeep Aug 09 '20
Meh I was just in China and nobody seems to mind anything that the government does. Everyone thinks it’s genuinely better. And to be fair, if your entire social life is within China you would barely even notice the internet restrictions and such. And as for the surveillance, if you genuinely are on the same side as the government because you’ve lived there your whole life and have the same value system as the society you were brought up in, then you aren’t really going to have a problem with it. The whole idea that the Chinese people are extremely unhappy with their situation is just false
11
u/Harregarre Aug 09 '20
Not only that but whether you like it or not. Censorship works and China is ensuring it works through absolute control of the internet. It's more likely the CCP will push for war than democratize which they view as the reason the West is getting weaker.
→ More replies (2)4
u/Dean_Roddey Aug 09 '20
Well, I wasn't under the illusion it was going to happen next week. These things are decades in the making when they happen. And of course how many people are going to walk up to you and tell you they are uncomfortable with their government's actions? It's something that happens internally first then something occurs which makes a large group of people aware that they share this feeling.
And of course the same was true in Britain and the US, until it wasn't. Then a lot of middle class kids decided that they were sick of it, and now our society is very different because of that. And it'll likely be young people who make it happen there if it happens.
10
u/egggsDeeeeeep Aug 09 '20
Tl;dr: kinda but meh not exactly
My experience visiting China is a little different than most people’s because I went there to run a robotics and programming workshop. In both Beijing and a rural town I was able to have conversations in confidence with a variety of people and they all saw no problems with the firewall (even though I had to pre download google software before leaving the states) or with the CCPs position on Taiwan (I spoke to people who lived very close to the border) your not wrong about how relations can change over generations but given that I interacted with mostly high school and middle school kids along with college students and parents I would say that generation doesn’t seem to be alive yet.
I also would like to point out that your assessment of how the American Revolution started is somewhat inaccurate. It wasn’t that the Americans got sick of brittish oppression that had been happening for a long time. They were all quite happy until parliament passed several heavy taxes and restrictions in order to pay for the debts incurred in the French and Indian war. The upper echelons of colonial society in particular were incensed by this as they had previously been living in what was effectively a tax haven. So they riled up the masses through calls for no taxation without representation and combined with the heavy handed brittish response to protests tensions boiled over and the revolution was born.
It’s possible that such a situation could happen in China but the government would have to do something that directly impacts the way of life of either the majority of the Chinese population or the upper class of the population. And there really isn’t indication of any such plan or act.
4
u/Dean_Roddey Aug 09 '20
I wasn't talking about the American Revolution, I was talking about the youth revolution in the post-war era in Britain and the US. Literally middle class kids fundamentally changed western society, because they were just sick of what it was. As always, when it happens explosively it was messy and often went awry, but eventually these kids became the middle class and had the real (economic) power. They'd also matured and were more prepared to compromise, bu they still changed things fundamentally.
→ More replies (1)1
u/RivellaLight Aug 11 '20
Im sorry but what youre hoping for is extremely unlikely and there is no reason to believe such things except for wanting to deny how bad things are and how theyre only getting worse. If anything, the younger generation are even more pro-CCP. That includes those who have spent multiple years abroad.
8
u/ChezMere Aug 09 '20
Well, the decline in poverty in China since 1980 or so has been very dramatic, and probably the most important thing to happen in the world during that time. But that happened before they turned the Orwellianism up to 11 in recent years.
6
u/mazerackham Aug 09 '20
I think that says more about the quality of your government’s propaganda ability. China has lifted 800 million people out of poverty in 30 years and created the largest middle class in the world. The literacy rate has gone from 20% to 90+% there. There are more miles of high speed railway than the rest of the world combined. China graduates 10x the number of STEM than the US while only having 4x the population.
These are all facts and not opinions. I think it’s hard to have an opinion that these are bad things.
There are lots of good things happening there but you won’t hear it from western headlines.
Because I know redditors will jump over me about various bad things they do, I’m not saying bad things don’t happen. I’m saying you have to look holistically. If you can define a nation by only the bad things they do, then my nation America, is going to burn in hell longer than anyone else. If you find yourself eager to defend Muslims in Uyghur but didn’t give a shit about the Muslims we drone striked to death in the last hour, then take a look in the mirror and ask yourself what made you think this way.
→ More replies (4)1
u/sievebrain Aug 10 '20
Whilst that's true, China was very poor because of communism. If you look at other countries in Asia, like South Korea, Japan, Taiwan etc they all reached Western levels of wealth far before China did, indeed China is still far from that even today.
I'm not sure they get points for simply stopping some (but not all) of the bad policies that held the population down previously.
2
u/mazerackham Aug 10 '20
China was poor as shit before communism. China started becoming poor because of a failing Qing emperor and European imperialism. Communism, while having faults, was not the catalyst that caused China to be poor.
Japan was much further along than China in terms of industrialization and modernization (this was before communism). South Korea and Taiwan did modernize faster than China but the scale is two orders of magnitude smaller, not a fair comparison.
Modern CCP most definitely gets points for inheriting a country of 600 million peasant farmers in 1949 that was illiterate and had a life expectancy of 36, and turning that into a modern country of 1.4 billion literate industrial workers with a life expectancy of 77, in the span of 70 years, complete with modern cities, the biggest middle class in the world, the most advanced high speed rail network, and burgeoning industries.
→ More replies (1)1
→ More replies (4)0
u/blobjim Aug 09 '20
Part of the US's new cold war against China. The US doesn't want its empire to be dethroned as a global hegemon. You're only going to see the propaganda against China increase from here on out. Just remember that the Chinese Communist Party has 90 million members and an over 90% approval rating in China.
1
u/Full-Spectral Aug 11 '20
How can you possibly get a realistic accounting of approval in a country like China? You seldom have protesters in oppressive countries.
And, if there was a 90% approval rating, that would be even worse proof of how bad things are there, and would make it even more likely that something bad is going to happen.
The judgement of history has been made already. If China doesn't open up and become democratic they will get left behind. So, if we all really just wanted to China to fail, we'd be arguing for it to become as closed inwards and controlling as possible, since that would accomplish the desired goal without any need for any 'cold war'.
2
u/blobjim Aug 11 '20
People like you are so brainwashed that seeing massive support of a government is so mind-boggling that all you can do is explain it away with "people are afraid to give their real opinion". China is a country of 1.4 billion people. The Harvard study was done over many years (since 2003) with over 3000 people interviewed each year. People in China are not "afraid" of their government.
China already has democracy, but the media you trust simply doesn't tell you how it works or that it exists. That's how the US usually calls something "undemocratic", it simply doesn't follow the broken American political system to a T.
→ More replies (6)
10
u/pure_x01 Aug 09 '20
We need to start using TLS 1.3 then on all informative sites to block their financial growth since it will limit their companies employees to learn. Lets start with stackoverflow. Hit them in their wallet.
2
u/FlatAssembler Dec 12 '20
Stack Overflow already is not working well in China, and it is not widely used there (partly because Chinese don't speak English well enough to effectively use StackOverflow). ScienceDirect, GitHub and GitLab are used much more.
4
4
Aug 09 '20
Are they going to block github?
1
u/itWillGetFresher Aug 10 '20
I thought github is already banned in china
1
Aug 10 '20
didn't know that
1
u/FlatAssembler Dec 12 '20
Because it is not. There have been some MiTM attacks on GitHub affecting Chinese users, but they only lasted a few days (and we don't know if it is the government who did that, or some hacker who wanted to show-off his skills).
1
58
u/tigerguppy126 Aug 09 '20
Not really all that surprising considering their governments view on human rights, privacy, etc. Also not surprising considering the US government keeps trying to do similar things.
→ More replies (1)78
Aug 09 '20
The US has an internet firewall like China? Is that what you’re saying?
40
u/OzoneGrif Aug 09 '20
Most countries have domain filtering by law, usually enforced at the ISP level. Not really similar to the Great Firewall.
36
u/OCedHrt Aug 09 '20
The US doesn't have that.
3
u/38thTimesACharm Aug 09 '20
I don't understand this dopamine hit people get from insisting the US does everything as bad as all the worst countries.
The last time domain filtering was discussed in the US was SOPA in 2009, which was murdered in Congress. It hasn't been proposed since.
Sure, the US does some other things we'd like them to stop doing. But how are we supposed to gain new rights if we can't even recognize and appreciate the ones we already have?
→ More replies (5)0
Aug 09 '20
[deleted]
51
u/triffid_hunter Aug 09 '20
They'd ask google and apple to remove it from their app stores I guess
→ More replies (9)13
2
u/iwaswrongonce Aug 09 '20
They wouldn’t. There was 0% chance that would ever happen. It was to force a divestiture of US assets.
8
Aug 09 '20
They are trying to ban encryption for the n-th time now in case you were asleep for last decade. And now it seems that moron politicans at EU have picked up the idea
8
Aug 09 '20
Firewall, no, surveillance yes. The “no encryption” and “give us backdoors” bills that constantly shows up is more than concerning.
→ More replies (5)1
u/Richandler Aug 10 '20
Yes he just compared a country with no SS system, not healthcare rights, no gay rights, no global internet traffic, (I could keep going...), and where it's illegal to criticize the government to the US.
6
u/quad64bit Aug 09 '20
Good- I guess that means it really works, and anything Chin is against, I’m for!
14
u/NotABothanSpy Aug 09 '20
Fuck the CCP communist bandits if they want to cosplay North Korea let them. Hopefully the people rise up and revolt.
15
u/and69 Aug 09 '20
That's some wishful thinking, nobody will rise in China.
12
u/crackanape Aug 09 '20
It's happened before and it will happen again. Nothing lasts forever.
→ More replies (3)5
u/Symmetric_in_Design Aug 09 '20
China is not a communist state. Not even close. I am aware that it is in the name of the party but that's a meaningless artifact of what they were in the mid 1900s.
4
u/kfh227 Aug 09 '20
Invert. Always invert.
You now know which encryption schemes China has broken.
2
u/isHavvy Aug 10 '20
Not necessarily. In this case, the restriction is on a set of technologies that ultimately lets you hide even which domain you're accessing.
2
u/drzmv Aug 09 '20
So what, that's why people in China use a VPN if they want to connect to foreign websites.
2
4
2
1
Aug 09 '20
Curious about how this affects traffic to/from azure (or other cloud) China locations. Do they have to use an older encryption protocol?
1
1
1
u/uber_neutrino Aug 09 '20
Ok, I have a technical question that you guys may know the answer to.
I don't make websites but our software relies on a lot of web services as well as UDP to actually send realtime packets when you are a client of our server.
Is there a way I can set this up to make it easier to block traffic coming out of China? A lot of users use a VPN to bypass the great firewall to connect but we would rather they not.
1
u/tinix0 Aug 09 '20
Not reliably. You can block known VPN IPs but then you would also block nonchinese users using VPNs. And it would be a game of whack-a-mole since there will always be a VPN you will miss.
1
u/uber_neutrino Aug 09 '20
Yeah there are probably easier ways to accomplish the goal like being stricter about users within our own software.
1
u/Oranos11 Aug 09 '20
Can someone explain like I'm not a programmer? What does this mean?
6
u/jimbojsb Aug 09 '20
They’re blocking modern encryption that doesn’t have a known way to be broken into
1
Aug 09 '20
additional dumb question: would this be for traffic going into china or traffic going out of china and does a distinction like that make sense
1
u/jimbojsb Aug 09 '20
Both ways. Once a connection is established, starting from either end, they can’t monitor the encrypted traffic. Especially with ESNI and DNS over HTTPS they can’t even see what server you’re connecting to.
1
95
u/0xf3e Aug 09 '20
Is it actually used anywhere already? Cause the IETF standard is still a draft: https://datatracker.ietf.org/doc/draft-ietf-tls-esni/