News for hackers. Stuff that matters.

A comment on We will not ‘walk out’ of UK, nor comply with any request to bypass encryption. Parent comment

Re:We will not ‘walk out’ of UK, nor comply with any request... by kalium-xyz on Tuesday February 28, 2023 @07:52AM (#34968712)
I donno about the UKs system but with South Korea they just check the host in the request header and block by that.
[ Parent | on HN ]
Re:We will not ‘walk out’ of UK, nor comply with any request... by jakewins on Tuesday February 28, 2023 @07:59AM (#34968768)
How can they do that, the HTTP headers are encrypted by TLS?
[ Parent | on HN ]
Re:We will not ‘walk out’ of UK, nor comply with any request... by Nextgrid on Tuesday February 28, 2023 @08:00AM (#34968776)
Until encrypted SNI/encrypted client hello is a thing, the hostname is still sent in the clear.

Also, it can still be DNS blocked - just because you use Cloudflare's DNS doesn't mean they can't rewrite the responses as they still transit unencrypted. You'd have to use DNS-over-HTTPS or DNS-over-TLS to work around that.

[ Parent | on HN ]
Re:We will not ‘walk out’ of UK, nor comply with any request... by 1vuio0pswjnm7 on Tuesday February 28, 2023 @08:10AM (#34968851)
If it's TLS1.2, certificates containing CNs and/or SANs are sent in the clear too.
[ Parent | on HN ]
Re:We will not ‘walk out’ of UK, nor comply with any request... by foepys on Tuesday February 28, 2023 @08:06AM (#34968825)
Luckily, ESNI is being supported by an increasing number of implementations.
[ Parent | on HN ]
Re:We will not ‘walk out’ of UK, nor comply with any request... by neilalexander on Tuesday February 28, 2023 @04:05PM (#34974825)
I believe China's answer to ESNI is just to block all traffic that attempts to handshake with ESNI, so it still won't necessarily get you anywhere.
[ Parent | on HN ]
Re:We will not ‘walk out’ of UK, nor comply with any request... by foepys on Tuesday February 28, 2023 @04:16PM (#34974971)
Once everything is using ESNI this isn't a problem anymore. It's the lack of implementation that is currently the problem.
[ Parent | on HN ]
Re:We will not ‘walk out’ of UK, nor comply with any request... by robertlagrant on Tuesday February 28, 2023 @08:01AM (#34968783)
Maybe it's actually SNI.
[ Parent | on HN ]
Re:We will not ‘walk out’ of UK, nor comply with any request... by ShowalkKama on Tuesday February 28, 2023 @08:01AM (#34968784)
not op, no idea how they do it but they COULD look at the SNI in the client hello
[ Parent | on HN ]