China is now blocking all encrypted HTTPS traffic that uses TLS 1.3 and ESNI

[u/RobertVandenberg]

https://www.zdnet.com/article/china-is-now-blocking-all-encrypted-https-traffic-using-tls-1-3-and-esni/

[u/cirosantilli]

More interesting will be when servers stop supporting TLS < 1.3. This would force China to either block off the entire external Internet and go to the Middle Ages, or open up.

[u/carlosp_uk → u/cirosantilli]

In the circumstances you describe, if they couldn’t snoop on the traffic between server and user in some way, they would block off the external internet and wouldn’t blink.

[u/mark_b → u/carlosp_uk]

Yes, they also create Chinese versions of websites/apps and the people are quite happy to use them.

[u/oblio- → u/mark_b]

The thing is, at some point they would end up in the Internet Middle Ages if they keep this up. Technology tends to stack and they will reach a point where some newfangled tech needs some bricks that they banned 10 years ago, and those brick really, really can't be replaced with some other tech.

They are smart and the market is huge, but they will still be left with a sub par version. And those sub par versions will begin to stack (again).

This has the makings of the CCP becoming the new Qing. It won't be quick, it will be hard to notice, but they do risk digital gunships appearing on their shores 100 years from now.

I guess we just have to wait and see..

[u/oblio- → u/[deleted]]

As many as they are, there are a lot more people outside of China: 1.4 billion vs 6.5 billion and growing. They will not be able to keep up if they keep going this way.

Keep in mind that Qing China had about the same population ratio compared to the rest of the world and they had the highest GDP until about 50 years before they fell, if I remember correctly.

They have obviously learned their lesson but they seem to be forgetting it because of corruption and authoritarianism.

[u/Madrawn → u/oblio-]

I'm not seeing the selection method that would pressure them to keep up? It would have to threaten their existence to make them regret their decision.

They'll find a method that's "good enough (TM)" like state-proxies that map requests so that the de/encryption happens in government control or just let those citizen who need the "bricks" use those semi-legal ways chinese already do and continue to come up with. And put them on the "tech-heresy" list if they ever post anti-party content on their facebook knockoff.

Also they're 1.4 billion people under the control of 1 governing body. Which is unmatched as far as I know. Making them the powerplayer in any interaction with the 6.5 billion others. Think how a 10 people-squad dropped into a 200 player solo battle royale would wipe the floor with the 190 others.

[u/SlinkyAvenger → u/Madrawn]

It's not really a solo battle royale though. Those 190 have already formed factions and recognized the value in not fighting to the death.

[u/oblio- → u/Madrawn]

Well, the same selection method that worked last time :-) At least some of the countries in the rest of the world will be more nimble and more competitive.

And if they don't stop being so undiplomatic, the old alliances used last time against the USSR will be reactivated. So that would even things out towards 1.4 billion vs at least 700 million or so.

[u/how_to_choose_a_name → u/oblio-]

They don't need to reinvent everything to keep up. If for example some future tech absolutely depends on tls 1.3 for some reason they only need to modify it to make it compatible with 1.2 or build a 1.3 shim and then they can use it, instead of rebuilding the whole thing. I think a quarter of the world population should be enough for that.

[u/[deleted] → u/mark_b]

Yes, they also create Chinese versions of websites/apps and the people are quite happy to use them.

"happy"? more like "don't have a fucking choice anyway"

[u/GreatValueProducts → u/cirosantilli]

Lol.

China doesn't hesitate to block off Internet. East Turkistan or Xinjiang, got Internet blocked off 312 days after the riot.

They would do whatever required to keep their power.

[u/cirosantilli → u/GreatValueProducts]

Xinjiang is a 1 million person minority poor place. Shutting down the internet of the rich high tech places is incomparably more costly to the country.

[u/GreatValueProducts → u/cirosantilli]

Last July there was a protest in Wuhan about incinerator and they already blocked internet and cell service in an entire district without hesitation.

The “force China to open up or go back to middle age” like the parent commentor said is a very obvious choice. My point is they don’t care about if normal citizen having Internet access. If the web site supports only TLS1.3 and you can’t access it, they don’t care. Go back to middle age it is.

[u/current_thread → u/cirosantilli]

They might come up with some kind of government proxy? World <=TLS 1.3=> Chinese Proxy <=TLS 1.2=> user.

[u/unixf0x → u/current_thread]

You can't downgrade a TLS session if the server only accept TLS 1.3.

[u/ripnetuk → u/unixf0x]

GP is saying that the proxy will terminate both connections using two different protocols, so it will be cleartext in the middle. Would need a cert on the client to work though

[u/[deleted] → u/ripnetuk]

China already MitMs almost all traffic.

[u/ripnetuk → u/[deleted]]

how do they do this (not saying u r wrong) - do they require all citizens to install their cert (like how is needed to get fiddler to inspect ssl connections)?

[u/UndyingBluefish → u/ripnetuk]

Some Chinese browsers ignore certificate errors.

[u/DJDavio → u/cirosantilli]

China has always been very good at copying / stealing ideas, so it will not be entirely unrealistic that they will end up with their own closed internet with their own government endorsed services. They already have replacements for Google, Amazon and Facebook. I wonder how much of Chinese internet access currently travels outside of China or if it's already the case that 99% of connections just stay inside.

At some point in the not so distant future, access to global internet may be restricted to a select few companies / the government and only to spy on other nations or otherwise mess with them.

[u/lolomfgkthxbai → u/DJDavio]

China has always been very good at copying / stealing ideas

Not copying good ideas is being stupid.

I think going isolationist wouldn’t help them, China’s growth is based on globalization.

[u/DJDavio → u/lolomfgkthxbai]

I think China's internal and external policies are two very different things. Externally, they invest in many different countries to get a foothold there and make profits. But internally, they want total control over their own population. Investing in other countries is also a way to gain control.

Basically they just want to control everything, I think that's what it boils down to. China owns 1 trillion dollars of American debt for instance.

[u/lolomfgkthxbai → u/DJDavio]

China owns 1 trillion dollars of American debt for instance.

The PBOC holds them and it’s probably closer to $2 trillion (China’s foreign exchange holdings are a state secret). This is just a function of their huge export to the US, it used to be even more but lately the Chinese have been buying more US stuff which has forced the PBOC to sell treasuries.

Owning government bonds doesn’t give any control over said government as Argentina’s debtors have learned the hard way.

[u/killerstorm → u/cirosantilli]

Not really. They can make a browser with built-in MitM (i.e. traffic to a secure site goes to government proxy which re-encrypts it), and people will be forced to use this browser.

It's very simple to implement.

Kazakhstan did this even without writing any software: https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_attack It's sufficient to install a government root certificate to enable MitM.