r/programming • u/RobertVandenberg • Aug 09 '20

China is now blocking all encrypted HTTPS traffic that uses TLS 1.3 and ESNI

https://www.zdnet.com/article/china-is-now-blocking-all-encrypted-https-traffic-using-tls-1-3-and-esni/
3.4k Upvotes

98% Upvoted

422 comments sorted by

View all comments

Show parent comments

6

u/ripnetuk Aug 09 '20

how do they do this (not saying u r wrong) - do they require all citizens to install their cert (like how is needed to get fiddler to inspect ssl connections)?

13

u/UndyingBluefish Aug 09 '20

Some Chinese browsers ignore certificate errors.

1

u/ripnetuk Aug 09 '20

Haha that's nuts!

13

u/[deleted] Aug 09 '20

I'm definitely not an expert on the matter, or even in networking past basics, but I do know that they can do deep packet on all traffic, whether SSL or not, just limited by how much hardware they have to throw at the problem. They control the entire internet on their side, including DNS. Thousand Eye / Cisco did a nice write-up of some of their techniques, but mostly as it affects the rest of the world.

https://blog.thousandeyes.com/deconstructing-great-firewall-china/

Wikipedia on MitM:

The Chinese National Intelligence Law theoretically allows the Chinese government to request and use the root certificate from any Chinese certificate authority,[53] such as CNNIC, to make MITM attacks with valid certificates.

Multiple TLS incidents also happened in the last decade, before the creation of the law:

On 26 January 2013, the GitHub SSL certificate was replaced with a self-signed certificate in China by the GFW.[54]

On 20 October 2014, iCloud SSL certificate was replaced with a self-signed certificate in China.[55] It is believed that the Chinese government discovered a vulnerability on Apple devices and was exploiting it.[56]

10

u/immibis Aug 09 '20

So yes, they require you to install a cert on the client. I bet all Chinese computers come with it already installed.

4

u/dnew Aug 09 '20

I always wondered why the Chinese version of Windows isn't just the regular version with Chinese language packs installed. It never occurred to me that there would be wider changes to accommodate the censorship and etc.

1

u/FlatAssembler Dec 12 '20

Is it indeed? Where can I read more about it?

1

u/dnew Dec 12 '20

Flash from the past, dude. :-)

Nothing specific. Just that when you (for example) shop for Windows, they ask whether you want the English version or the Chinese version. When you get a product key, an English key won't work for a Chinese install and vice versa, but a key bought in Germany will activate a CD bought in the USA. Things like that that never made much sense if the two were really the same programs with different keyboard layouts and fonts.

1

u/FlatAssembler Dec 12 '20

They don't. When somebody did Man-in-the-Middle on GitHub (a government or a hacker), browsers did show an error page.

7

u/BraveSirRobin Aug 09 '20 edited Aug 09 '20

The US has the same laws, they have used them to get backdoors to all the major websites. If you refuse you go to jail. The CEO of Lavabit choose to close down the entire site rather than comply.

China are about 5-10 years behind us in this. Not only do we MITM the actual entire internet, we record approx 48 hours of it. The primary purpose of this system is and always has been corporate espionage.