News for hackers. Stuff that matters.

A comment on GreenTunnel: anti-censorship utility designed to bypass deep packet inspection. Parent comment

Re:GreenTunnel: anti-censorship utility designed to bypass d... by snvzz on Sunday March 22, 2020 @04:11PM (#22658187)
>DoH also means breaking stuff like pihole and other ad filtering.

No, it doesn't.

e.g. I run DoH behind my home's dns cache server.

>its also kind of pointless if the state knows youre using it outside of a tunnel...they can just watch your next packets to see where you decided to go.

This is where HTTPS and eSNI further help.

[ Parent | on HN ]
Re:GreenTunnel: anti-censorship utility designed to bypass d... by ignoramous on Sunday March 22, 2020 @05:00PM (#22658612)
> e.g. I run DoH behind my home's dns cache server.

I think GP is referring to the fact that apps can now bypass network / os wide dns stub / recursive resolvers undetected with DoH.

> This is where HTTPS and eSNI further help.

I believe TLS v1.3 specifically has anti-censorship and anti-surveillance properties baked in: https://blog.cloudflare.com/rfc-8446-aka-tls-1-3/

[ Parent | on HN ]
Re:GreenTunnel: anti-censorship utility designed to bypass d... by kohtatsu on Sunday March 22, 2020 @09:21PM (#22660420)
They could have had their own resolver before, or even hard coded IPs.

Using software that doesn't respect you is the problem.

[ Parent | on HN ]
Re:GreenTunnel: anti-censorship utility designed to bypass d... by seized on Sunday March 22, 2020 @09:30PM (#22660450)
Firewalls can redirect port 53 to another IP. That prevents things from hard coding to a specific IP.

https://forum.opnsense.org/index.php?topic=9245.0

[ Parent | on HN ]
Re:GreenTunnel: anti-censorship utility designed to bypass d... by kohtatsu on Sunday March 22, 2020 @11:04PM (#22660884)
Euh, it prevents a custom resolver sure, but hard-coded IPs bypass the need for DNS completely.
[ Parent | on HN ]