Hacker News Reader

We started seeing more sophisticated DPI capabilities after the Feb '14 internet regulations[0] that required ISPs to block by URL and content strings

IMO blocking so many sites so broadly is a sign that their DPI is failing, because their preference seems to be to block as narrowly as possible because of negative economic effects.

[0] http://aa.com.tr/en/turkey/turkey-s-general-assembly-ratifie...

View on HN

With ssl the best they can do is this host level blocking unless they perform mitm attacks.

> unless they perform mitm attacks

Which any state-sponsored actor can easily do, of course.

Please tell me how Turkey is going to MITM Google on a recurring basis, enough to implement filtering.

By using a CA they control to generate a fake certificate for Google like they've already "accidentally" done:

http://arstechnica.com/security/2013/01/turkish-government-a...

Which they can only pull off once before their CA is distrusted. See: how Chinese government CA was restricted to .cn domains only

Reply on news.ycombinator.com