Hacker News Reader

Comment by Someone1234 | Hacker News Reader

Use DNS over HTTP. Firefox is very easily configurable (network.trr.bootstrapAddress, network.trr.mode, etc) so that if you pick the right bootstrap provider and DNS over HTTP provider you'll never send an unencrypted DNS query (including no SNIs) and it will fail completely rather than reverting to your OS's DNS Client if it cannot be resolved via the DNS over HTTP channel you define.

Because the S3 buckets are virtual-hosted they share IPs so there is deniability if you can hide the DNS/SNI.

View on HN

Yes but https SNI still exists.

TLS v1.3 finally addresses this, https://blog.cloudflare.com/encrypted-sni/

I expect this will only work until the government in question is sufficiently angered that they just outright block the entire AWS infrastructure. Or whoever else supports ESNI.

But the only reason domain fronting works in the first place is because people think that large web hosting providers are too large to block.

If a hypothetical tyrantical government was willing to block all of Amazon S3 this change doesn't affect anything.

If it impacted Amazon’s (or whoever is targeted) bottom line then I would expect they would be open to dropping domain fronting support. But I admit I don’t know this for sure - time will tell.

China has blocked GitHub and Akamai before. https://www.latimes.com/business/technology/la-fi-tn-great-f...

But the alternative, which is to just not force this virtual host change in the first place, similarly might have gotten AWS blocked from those countries anyway

We need this in Chrome, badly.

TLS 1.3 was completed, published as RFC 8446 but eSNI is still a work in progress.

You need TLS 1.3 because in prior versions the certificate is transmitted plaintext, but eSNI itself is not part of TLS 1.3 and is still actively being worked on as https://datatracker.ietf.org/doc/draft-ietf-tls-esni/

This isn't a general-case solution (because you can no longer just give someone a link), but, can't you send "s3.amazonaws.com" or really any other bucket name in the SNI and give the full bucket name in the Host header inside the encrypted channel? Or does S3 block SNI/Host mismatches?

They will possibly block mismatches (I believe they do for cloudfront etc. now), but also if the point of moving to sub domains is sharding, there's no guarantee the bucket you want is behind the faked hostname you connected to.

This currently works, but considering their crackdown on domain fronting last year, I don't expect it to work for much longer.

Did you mean use DNS over HTTPS?

Reply on news.ycombinator.com