Re:Porn restrictions are leading to a VPN boom
by acchow on Monday April 08, 2024 @01:02AM
(#39966356)
But the SNI hostname will only include everything left of the TLD. So that is the TLD, the domain name, and the subdomain. It excludes the rest of the URL.
If you have installed a root cert to allow the government to MITM, then there isn't really anything you can do...
Re:Porn restrictions are leading to a VPN boom
by slt2021 on Monday April 08, 2024 @12:04PM
(#39971067)
SNI is enough to classify traffic for enforcement purposes.
dont forget that if certain SNI is detected, your ISP/government may try to force downgrade TLS or replace server-hello with their own cert - meaning you will need to install government certificate to browse certain websites and 99% of users will do that to get access
https://en.wikipedia.org/wiki/Server_Name_Indication
Server Name Indication payload is not encrypted, thus the hostname of the server the client tries to connect to is visible to a passive eavesdropper. This protocol weakness was exploited by security software for network filtering and monitoring[4][5][6] and governments to implement censorship.[7] Presently, there are multiple technologies attempting to hide Server Name Indication.
Also some countries may mandate users to install and trust government's CA certificate which is then used to MITM HTTPS traffic
https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_a...