News for hackers. Stuff that matters.

A comment on China is now blocking all encrypted HTTPS traffic using TLS 1.3 and ESNI.

Re:China is now blocking all encrypted HTTPS traffic using T... by 1MachineElf on Saturday August 08, 2020 @09:49PM (#24096645)
Up until now, I thought "The Great Firewall" was limited to layer 2, layer 3, and just layer-7 DNS controls.

The capability described in this article sounds more like a full layer-7 MITM.

That's terrifying. Is any HTTPS secure within mainlan China's networks?

Or am I misunderstanding, and it's just the government websites that are blocking incoming TLS 1.3 connections?

[ Parent | on HN ]
Re:China is now blocking all encrypted HTTPS traffic using T... by dylz on Sunday August 09, 2020 @01:52AM (#24097548)
GFW has been all layer for a long time, including actively re-probing and connecting back to a server from random (really, virtually any CN IP space).

HTTPS is somewhat secure, but subject to MITM. Most Chinese forks of browsers ignore certificate errors and allow everything through.

[ Parent | on HN ]
Re:China is now blocking all encrypted HTTPS traffic using T... by unicodepepper on Tuesday August 11, 2020 @04:31AM (#24118371)
Would I be safe from this type of MITM attack if my browser respects SSL warnings? (and I don't bypass them)
[ Parent | on HN ]
Re:China is now blocking all encrypted HTTPS traffic using T... by aaomidi on Tuesday August 11, 2020 @11:30AM (#24121373)
Generally yes.

But remember with SNI they know exactly what website you're visiting.

[ Parent | on HN ]
Re:China is now blocking all encrypted HTTPS traffic using T... by Legogris on Saturday August 08, 2020 @11:25PM (#24097015)
Some further explanation here: https://geneva.cs.umd.edu/posts/china-censors-esni/esni/

Looks like it's L4?

[ Parent | on HN ]
Re:China is now blocking all encrypted HTTPS traffic using T... by msmith on Sunday August 09, 2020 @10:21AM (#24099809)
That link was fascinating to me. For as long as I remember, there have been tools to evade network intrusion detection systems and stateful firewalls, but I never thought about how the same techniques can be used to evade censorship.
[ Parent | on HN ]