Hacker News Reader

Correct me if I'm wrong, but the signed server-identifying cert is swapped in TLS before the connection is encrypted, no?

So it's not technically infeasible to have networking gear drop any connection which doesn't chain back to a government-approved root?

> Correct me if I'm wrong, but the signed server-identifying cert is swapped in TLS before the connection is encrypted, no?

Only on old TLS versions. TLS 1.3 changed it so the server certificate is also encrypted.

What about SNI?

So it's not technically infeasible to have networking gear drop any connection which doesn't chain back to a government-approved root?

Yse, and that is a very scary thought. China is doing something similar already.

You could use a VPN. If you live in a place like China that blocks VPNs, you are screwed, agreed.