News for hackers. Stuff that matters.

A comment on Show HN: dingo - a Google DNS-over-HTTPS caching proxy in Go. Parent comment

Re:Show HN: dingo - a Google DNS-over-HTTPS caching proxy in Go by textmode on Friday September 16, 2016 @10:19PM (#12518773)
"It can even \"spoof\" the TLS SNI string to avoid HTTPS firewalls..."

Are you confirming SNI is being used for censorship?

[ Parent | on HN ]
Re:Show HN: dingo - a Google DNS-over-HTTPS caching proxy in Go by clinta on Saturday September 17, 2016 @09:10AM (#12520335)
Plenty of content blockers support blocking domains based on SNI. Here's just a couple of examples from a quick google search.

https://wiki.untangle.com/index.php/Web_Filter#HTTPS_Options

http://www.watchguard.com/help/docs/wsm/xtm_11/en-us/content...

[ Parent | on HN ]
Re:Show HN: dingo - a Google DNS-over-HTTPS caching proxy in Go by NetStrikeForce on Wednesday September 21, 2016 @08:55AM (#12547707)
If someone is doing DPI their best bet to know where are you connecting to is to look at the host in SNI, but if you're in a corporate environment with an explicit proxy, your computer would be sending a "CONNECT hostname.tld" in plain text anyway :)
[ Parent | on HN ]