News for hackers. Stuff that matters.

A comment on Tell HN: Sci-Hub's TLS certificate has started failing. Parent comment

Re:Tell HN: Sci-Hub's TLS certificate has started failing by ethbro on Sunday April 29, 2018 @01:13PM (#16952867)
Correct me if I'm wrong, but the signed server-identifying cert is swapped in TLS before the connection is encrypted, no?

So it's not technically infeasible to have networking gear drop any connection which doesn't chain back to a government-approved root?

[ Parent | on HN ]
Re:Tell HN: Sci-Hub's TLS certificate has started failing by cesarb on Sunday April 29, 2018 @03:13PM (#16953435)
> Correct me if I'm wrong, but the signed server-identifying cert is swapped in TLS before the connection is encrypted, no?

Only on old TLS versions. TLS 1.3 changed it so the server certificate is also encrypted.

[ Parent | on HN ]
Re:Tell HN: Sci-Hub's TLS certificate has started failing by catamorphismic on Tuesday May 01, 2018 @07:21AM (#16966103)
What about SNI?
[ Parent | on HN ]
Re:Tell HN: Sci-Hub's TLS certificate has started failing by userbinator on Sunday April 29, 2018 @01:31PM (#16952961)
So it's not technically infeasible to have networking gear drop any connection which doesn't chain back to a government-approved root?

Yse, and that is a very scary thought. China is doing something similar already.

[ Parent | on HN ]
Re:Tell HN: Sci-Hub's TLS certificate has started failing by ams6110 on Sunday April 29, 2018 @01:51PM (#16953050)
You could use a VPN. If you live in a place like China that blocks VPNs, you are screwed, agreed.
[ Parent | on HN ]