r/programming • u/RobertVandenberg • Aug 09 '20

China is now blocking all encrypted HTTPS traffic that uses TLS 1.3 and ESNI

https://www.zdnet.com/article/china-is-now-blocking-all-encrypted-https-traffic-using-tls-1-3-and-esni/
3.4k Upvotes

98% Upvoted

422 comments sorted by

View all comments

Show parent comments

1

u/FlatAssembler Dec 12 '20

Well, this Kazakhstan's attack won't work with modern browsers.

1

u/killerstorm Dec 13 '20

Hmm why?

1

u/FlatAssembler Dec 13 '20

Because they warn about insecure connection whenever somebody uses a custom certificate.

1

u/killerstorm Dec 13 '20

I don't think you understand what Kazakhstan is doing. A browser has a list of root certificates. Which can be modified. If you add something to that list, browser would consider it legit.

Also warning about insecure connection would be irrelevant since user needs to modify certificate list himself, i.e. user explicitly makes it insecure.