Re:TLS 1.3 and Proxies
by vbezhenar on Sunday March 11, 2018 @07:40PM
(#16565332)
Why intercept certificate if you can block IP?
[ Parent
| on HN ]
IPs are often used by many sites: it’s like telling the post office to drop mail to 1234 5th St when that’s an apartment building with hundreds of residents. If you block a major CDN you’ll take out things like Microsoft, Apple, etc. and generate a lot more publicity for your censorship program.
Because Wikipedia has many IPs and they change from time to time.
And best part is when Russians were blocking a blogger's web site based on IP he switched his IP to a bank's web site and thus the bank's IP was blocked automatically :)
Sounds strange that a bank would host its website on a shared Ip address.
They didn't.
To clarify: the blogger set his domain to point to the bank's IP address. The automated domain blocking system resolved his domain and blocked "its IP" without confirming that the IP actually belonged to the targeted site.