Re:Thousands of Russians protest against internet restrictions
by lambdadmitry on Monday March 11, 2019 @05:37AM
(#19357709)
I bet the next thing Russian (and many other oppressive ones) will try is forcing government-issued root certs on client devices with mandatory mitm. Sure, some devices might not be capable of importing new root certs, but for sufficiently dictatorial regime it's not a problem.
Re:Thousands of Russians protest against internet restrictions
by ignoramous on Monday March 11, 2019 @03:29PM
(#19362008)
Strict CertifcatePinning can thankfully prevent this from working [0] as intended, although on the flip-side it also introduces a significant problem for deep-packet inspection for malware/intrusion detection and privacy enthusiasts who would like to re-map certain kinds of traffic on the client-side [1].
That's a tough stance for a government to take. I guess using proxies, VPNs (w IPSec), and overlay networks like Tor and i2p would be made illegal too?
DNS based blocking is easy to get around: It is known to not work effectively. Content based blocking can be done away with TLS. And... IP based blocking wouldn't scale [0], one would think, and def isn't reliable because of ElasticIPs offered by Cloud Providers like AWS, like you point out.
This might push them to take desperate measures like force ISPs to stop peering with the internet backbone altogether (or worse, nationalise ISPs), which might set a dangerous precedent for other powerful countries to follow.
This doesn't sound good, at all.
[0] With 5G/WiMax around the corner looking increasingly likely that it'd be exclusively on IPv6 ...