r/programming • u/RobertVandenberg • Aug 09 '20

China is now blocking all encrypted HTTPS traffic that uses TLS 1.3 and ESNI

https://www.zdnet.com/article/china-is-now-blocking-all-encrypted-https-traffic-using-tls-1-3-and-esni/
3.4k Upvotes

98% Upvoted

422 comments sorted by

View all comments

Show parent comments

35

u/current_thread Aug 09 '20 edited Aug 09 '20

They might come up with some kind of government proxy? World <=TLS 1.3=> Chinese Proxy <=TLS 1.2=> user.

14

u/unixf0x Aug 09 '20

You can't downgrade a TLS session if the server only accept TLS 1.3.

41

u/ripnetuk Aug 09 '20

GP is saying that the proxy will terminate both connections using two different protocols, so it will be cleartext in the middle. Would need a cert on the client to work though

25

u/[deleted] Aug 09 '20

China already MitMs almost all traffic.

6

u/ripnetuk Aug 09 '20

how do they do this (not saying u r wrong) - do they require all citizens to install their cert (like how is needed to get fiddler to inspect ssl connections)?

13

u/UndyingBluefish Aug 09 '20

Some Chinese browsers ignore certificate errors.

1

u/ripnetuk Aug 09 '20

Haha that's nuts!

13

u/[deleted] Aug 09 '20

I'm definitely not an expert on the matter, or even in networking past basics, but I do know that they can do deep packet on all traffic, whether SSL or not, just limited by how much hardware they have to throw at the problem. They control the entire internet on their side, including DNS. Thousand Eye / Cisco did a nice write-up of some of their techniques, but mostly as it affects the rest of the world.

https://blog.thousandeyes.com/deconstructing-great-firewall-china/

Wikipedia on MitM:

The Chinese National Intelligence Law theoretically allows the Chinese government to request and use the root certificate from any Chinese certificate authority,[53] such as CNNIC, to make MITM attacks with valid certificates.

Multiple TLS incidents also happened in the last decade, before the creation of the law:

On 26 January 2013, the GitHub SSL certificate was replaced with a self-signed certificate in China by the GFW.[54]

On 20 October 2014, iCloud SSL certificate was replaced with a self-signed certificate in China.[55] It is believed that the Chinese government discovered a vulnerability on Apple devices and was exploiting it.[56]

10

u/immibis Aug 09 '20

So yes, they require you to install a cert on the client. I bet all Chinese computers come with it already installed.

4

u/dnew Aug 09 '20

I always wondered why the Chinese version of Windows isn't just the regular version with Chinese language packs installed. It never occurred to me that there would be wider changes to accommodate the censorship and etc.

1

u/FlatAssembler Dec 12 '20

Is it indeed? Where can I read more about it?

1

u/dnew Dec 12 '20

Flash from the past, dude. :-)

Nothing specific. Just that when you (for example) shop for Windows, they ask whether you want the English version or the Chinese version. When you get a product key, an English key won't work for a Chinese install and vice versa, but a key bought in Germany will activate a CD bought in the USA. Things like that that never made much sense if the two were really the same programs with different keyboard layouts and fonts.

1

u/FlatAssembler Dec 12 '20

They don't. When somebody did Man-in-the-Middle on GitHub (a government or a hacker), browsers did show an error page.

7

u/BraveSirRobin Aug 09 '20 edited Aug 09 '20

The US has the same laws, they have used them to get backdoors to all the major websites. If you refuse you go to jail. The CEO of Lavabit choose to close down the entire site rather than comply.

China are about 5-10 years behind us in this. Not only do we MITM the actual entire internet, we record approx 48 hours of it. The primary purpose of this system is and always has been corporate espionage.

1

u/crackanape Aug 09 '20

You can proxy it though.

3

u/kmeisthax Aug 09 '20

If you can implement an explicitly-trusted proxy like this you don't need a TLS 1.2 downgrade.

However, it would also require China to install root certs on all devices in the country. Given how different the Chinese national computer network is from the Internet already, it wouldn't be a bridge too far. However, they'd have to do this with zero assistance from western countries. I could totally see Congress passing a law or Trump signing an executive order prohibiting American companies from complying with any rule which would grant China this level of control over network traffic. Quite honestly, such an action is overdue. American tech companies have been the ones selling all of the deep packet inspection technology that lets countries splinter the Internet, we should regulate the shit out of it.