Hacker News Reader

Comment by chipperyman573 | Hacker News Reader

Still doesn't help with domain censorship. This was discussed in-depth in the other thread from yesterday, but TLDR, it's a lot harder to block https://s3.amazonaws.com/tiananmen-square-facts than https://tiananmen-square-facts.s3.amazonaws.com because DNS lookups are made before HTTPS kicks in.

View on HN

And even if you use encrypted DNS, the domain is still in the clear via SNI. There's an RFC for encrypting SNI, but that's not here yet.

Encrypted SNI seems to be tailor made for this situation. The public portion of the request SNI would just be s3.amazonaws.com but the ESNI extension has the full subdomain name. That (+encrypted dns) solves the privacy issue, while still enabling all the new features and improvements they have planned.

Does encrypted SNI solve the issues that AWS are trying to solve by removing path-style S3 requests? Namely, removing the complexity and single-point-of-failure of having one domain, and making it possible for subdomains to have varying allowed cipher settings? I don't know how encrypted SNI will work, but it surely it must choose the cipher before it sends the domain, so it ought to rule out one of the reasons for the change?

According to https://tools.ietf.org/html/draft-ietf-tls-esni-03 ESNI parameters (e.g. public key) are queried via DNS. In the above case, the browser queries a TXT record for _esni.tiananmen-square-facts.s3.amazonaws.com, in addition to A and/or AAAA records for tiananmen-square-facts.s3.amazonaws.com. It then uses the public and other parameters to encrypt the SNI.

So it simply shifts the problem to DNS. To keep requests confidential from sniffers on your LAN or somewhere along the path, you're expected to use something like DoH.

Aren’t TLS certificates also sent in plaintext?

No longer since TLS 1.3

However, encrypted SNI and DNS-over-HTTPS should provide a better solution to that problem once they're ready, and there's no reason to think Amazon won't adopt encrypted SNI.

It actually helps tremendously, since at the very least now there can be a "black market" for legacy (pre-Sept-2020) buckets, especially those on dedicated accounts that can be provided to organizations spreading facts like this.

> It actually helps tremendously, since at the very least now there can be a "black market" for legacy (pre-Sept-2020) buckets

Err, no, countries will just block the legacy bucket URL style and say that only the bad guys would still be using it.

If they went to that extreme maybe they’d block AWS altogether. Or all SSL traffic!

People didn't seem to remember that the exact thing happened to Google. Picasa, youtube, GCloud, GSuite, and finally Gmail.

Who's next, domain fronting on Microsoft Azure?

That would mean they are blocking all S3 buckets indiscriminately.

Only old S3 buckets that are accessed the old way.

Couldn't they just middle-man the traffic and block specific URLs?

ssl prevents that.

It explicitly does not. It means there are additional barriers to doing it - people would need to accept a bad cert (we already know the overwhelming majority will), or they would need to slip in their own CA that allows them to generate their own valid certs for MITM, but that is eminently doable for the Chinese government inside of China. They can then block all traffic for people that do not use the cert that allows them to decrypt said traffic. It functionally is the exact same thing, and would still allow "legitimate" traffic without problem.

That's not what explicitly means. Ssl explicitly does prevent mitm attacks from intercepting URLs of requests.

The fact you can get around it by ignoring the cert is a bit irrelevant. It's like saying locks don't work because people can break your window.

As noted, you don't have to ignore the cert, and we're talking about state level actors.

And it's not the window. It's like saying locks don't work if the state has a master key, which they do.

They already have their own CA in browsers, so they can easily MITM. That’s why mobile apps will use certificate pinning to verify their server

I thought countries who did this already issued their own certs to be able to analyze traffic. Like China. Maybe I misunderstood.

I don't understand, why would restricting access to an anti-censorship service help fight censorship?

I mean that relative to the previous proposal, this is better. But other commenters make good points that legacy buckets could be blocked.

Why is having a black market good? Is it that there's inherent value in making a market for something people find valuable (even if the seller is some tech person and the buyer is a dissident in a country that probably can't legally send money to San Francisco in the first place), or is it something else?

What could Amazon do that would "help"?

Still let people use the old path system, even on new servers. This is an often-used trick to get around government censorship that will be destroyed with this change.

TBH, though, I'm not sure that would really help that much over time. It's clear there are real benefits for having bucket names in subdomains, such that the majority of new users would pick that format in any case. In that situation, governments may end up just blocking s3.amazon.com in any case because "only old bad guys" continue to use it.

Why S3 must carry the burden of getting around censorship?

If you are talking about China, yeah, Google used to carry that burden. Now GAE, GCloud, Youtube, Gmail are all gone. The whole IP range was blacklisted.

Now what?

Just because something accidentally works does not mean it will last forever.

They don't "must", but it would be very nice of them.

China isn't the only repressive country in the world, there's plenty of people using domain fronting right now in other parts of the world.

I believe their point was that a central authority would have finer grained censorship control with the v2 bucket scheme instead of the old path based scheme.

I don't think they really want to. It's literally the biggest reason for the change (they can work around the load balancing issues) and they do not address it at all in the article.

The Internet is not what it use to be, and it's going to become more and more difficult to deal with censorship.

The Internet treats censorship as a malfunction and routes around it. - John Perry Barlow

Why is it harder, just block s3.amazonaws.com that's it. I don't think countries that block domains care about s3.amazonaws.com.

Reply on news.ycombinator.com