Investigating TLS Blocking in India
ooni.org
ooni.org
We've compiled these tests into an android app, please consider running it if you live in India and would like to contribute to the research :) https://play.google.com/store/apps/details?id=com.censorwatc...
It's completely anonymous, doesn't require any permissions, and does not store any user related information.
Thanks!
Thanks for vouching!
From what I can see, there is no way to bypass the SNI filters without using a proxy/VPN of some sort. Do let me know you have any tips for it.
P.S. Our previous paper talks about censorship in India, albeit the data is from just one vantage point https://arxiv.org/abs/1912.08590
As for circumvention, TLS 1.3 + ESNI + DoH should do the trick. Firefox has the capability to enable these options
This is the icing on the cake right here. It's just awful that not only do websites get censored largely arbitrarily, there is no insight into the process and what is even blocked–the fact that someone had to literally check sites to see if they are being blocked (via a variety of different methods largely indistinguishable from a malicious actor :/) is just a truly horrible state to be in.
DuckDuckGo was blocked a couple of o this ago. The nebulous words “national security”, without any context, are used as the justification for blocking many sites.
For the past week I've had numerous problems connecting to TLS directly, without using a VPN. I still update my system directly from a mirror to avoid wasting limited data on a remote VM, that's how I discovered it personally. I worry they're trying to implement something nefarious behind the scenes, again.
https://getintra.org/ which is a DoH client for Android bypasses Indian censorship, btw. Ref: https://twitter.com/vinifortuna/status/1304189371688660992
> India leads the world, in the list of Internet Shutdowns. In 2018, as reported by Access Now, out of 196 documented Internet Shutdowns globally, India accounted for 134 of them.[124] The reasons for the shutdowns range from protests and political unrest to elections and exams.
https://en.wikipedia.org/wiki/2019%E2%80%932020_Jammu_and_Ka...
https://www.washingtonpost.com/world/asia_pacific/indias-int...
One can construct a list of hundreds of URLs and get a blocking order, with a few innocent ones slipped in between. Nobody will investigate the claims, and nobody can contest the claims before it’s ordered, but the order for blocking will be issued.
> In February 2016 the Supreme Court asked the Indian Government to suggest ways of banning all forms of child pornography.[16]
> In October 2018 the government directed Internet service providers to block 827 websites that host pornographic content following an order by the Uttarakhand High Court. The court cited the rape of a 10th standard girl from Dehradun by four of her seniors. The four accused told police that they raped the girl after watching pornography on the Internet.[17]
https://en.m.wikipedia.org/wiki/Pornography_in_India#Legalit...
Am I right in concluding that these blocking methodologies can be thwarted to a greater extent by the user using Tor (or a VPN outside the country) and/or the websites in question using ESNI (and the user also using a non-ISP DoH provider that doesn’t have legal presence in the country, since the DNS providers will be the next target for these ill defined blocking orders)?
[0] https://twitter.com/vinifortuna/status/1304189371688660992
Source: Work extensively on an Intra fork.
Intra merely captures DNS traffic on port 53 and tunnels it to any DoH endpoint. It circumvents SNI censorship because it essentially sees all TCP and UDP traffic and can manipulate it on-device, and it does so in a way that bypasses most (but not all) censorship implementations.
ESNI, of the new trick of using ESNI plus a fake plaintext SNI, is definitely a more robust approach.
They should just expose more endpoints, like the way TPB got over the problem, and keep these ISPs at bay. This is just my opinion.
While looking into this, it turns out it happens all the time and many websites have been blocked for years. If you're big enough then maybe you can get unblocked. Or you might just be SOL.
Some examples:
https://www.alexa.com/ has been blocked for over 1 year (https://www.reddit.com/r/india/comments/b084so/why_alexacom_...) (wtf?)
Trinet.com, an HR tech+services company is blocked in India (wtf?)
Adobe-owned behance.net is blocked in India. (why?)
reddit.com or parts of it are frequently blocked/unblocked https://thenextweb.com/apps/2019/03/14/isps-are-reportedly-b...
9gag and collegehumor have been blocked for over 5 years (https://www.news18.com/news/buzz/comedy-websites-colleghumor...). At least there's some reason here.
Three environmentalist websites were blocked (and eventually unblocked): https://scroll.in/latest/967589/centre-run-agency-blocks-web...
The NYTimes was blocked for a while: https://gadgets.ndtv.com/internet/news/new-york-times-access...
In 2014, India blocked Github for a while: https://qz.com/india/319866/a-threat-from-isis-prompts-india...
India is known for filtering websites belonging to NGOs, feminist groups, and others https://indianexpress.com/article/india/india-tops-list-of-w...
As far as I can tell, if there's some random bureaucrat that doesn't like you, your website is going to get blocked. Equally likely, the process is so poor that you might get blocked for no reason at all.
Somewhat recent report of Alexa.com being blocked (July 2020): https://twitter.com/anandakrsn/status/1284763939427905536?s=...
Report of Behance being blocked on Aug, 2020: https://twitter.com/prabhjotjolly/status/1295623006358650880...
As the article explains, the blocking is very inconsistent.
The article also links to a github repo with some of the blocked hostnames they recently detected: https://github.com/kush789/How-India-Censors-The-Web-Data/bl...
You can see that the list includes alexa.com and behance. It also includes lots of others like craigslist.co.in, ABC.net.au, bleacherreport.com. From personal experience, I know that these are just a tiny subset of legitimate websites that have been blocked (and perhaps later unblocked) for seemingly no reason and have no clear recourse.
Source: I have broadband connection and sim from the same telecom and have noticed same issues in distant family houses.
Your computer <—-encrypted channel to VPN in other country—-> https communication to blocked website
What a country could do but we haven’t seen before, is block all VPN protocol traffic, effectively banning VPNs. This would be disruptive to business or politicians using VPN for privacy, so it’s not as politically feasible.
Then there is Tor on Android https://guardianproject.info/apps/orbot/ and VPN services like https://getlantern.com/ and https://psiphon.ca/ that exclusively focus on anti-censorship measures. Check their privacy policies before committing to use them.
Tor's pluggable transports also have been at this stuff for a long time.
The internet is for everyone.
Cloudflare has a great page which allows to check this https://www.cloudflare.com/en-gb/ssl/encrypted-sni/
1. ESNI isn't a standard yet. So, support in mainstream web-clients is lacking.
2. Unfortunately, TLS v1.3 is blocked in countries with stringent censorship already.
Also ESNI needs server support I believe and very few servers support it. Right now it is effective only for sites fronted by Cloudflare if I'm not mistaken, and while that isn't a small number still its by no means the wider Net.
https://www.zdnet.com/article/china-is-now-blocking-all-encr...
Nations will struggle to block the IP ranges for big players like that without blocking a lot of stuff they don’t intend to.
I use greentunnel and it works fine.
Yep, here's the code that does the trick: https://github.com/SadeghHayeri/GreenTunnel/blob/master/src/...
"dependencies": {
"app-data-folder": "^1.0.0",
"chalk": "^2.4.2",
"clear": "^0.1.0",
"consola": "^2.11.0",
"debug": "^4.1.1",
"dns-over-http": "^0.1.2",
"dns-over-tls": "0.0.6",
"esm": "^3.2.22",
"is-docker": "^2.0.0",
"lru-cache": "^5.1.1",
"node-localstorage": "^2.1.5",
"ora": "^3.2.0",
"std-env": "^2.2.1",
"universal-analytics": "^0.4.20",
"update-notifier": "^2.5.0",
"validator": "^10.11.0",
"winreg": "^1.2.4",
"yargs": "^13.2.2"
},ISPs have been looking at the cleartext hostname in the TLS handshake to block these connections
As someone correctly pointed out, greentunnel does much more than DoH.
Seriously can't expect the average Joe to know about stuff like greentunnel. And that's concerning...
To send the domain securely the client needs to know the public key of the certificate the server is using.
This chicken and egg problem has gone unresolved for a long time, and only now are there efforts to fix it (see the work on esni).
https://battlepenguin.com/politics/why-i-no-longer-hate-amer...
India is literally the largest democratic country by population in the world. Despite its issues, it has a functioning democracy, yet its freedom of speech is limited.
I've lived in a few different countries, and one thing that still amazes me is that America still has some of the strongest court prescient when it comes to speech laws. We have restrictions of course, like all countries do, but I've never seen the US ranked high on the free speech indexes I've seen. My own research leads me to believe the US and Japan stand out as the two nations with some of the strongest free speech laws (although Japan's have some challenging issues with copyright and fair use).
Unless you publish a physical book of course and then promote it and distribute it yourself or on a much smaller scale, you post pamphlets on utility poles or other such low tech-low reach media, a FB or a Twitter or a Tik Tok can take down even your "missing pet" posts, because your pet breed offends some people in some manner. They reserve the right to do so. Of course you wont find them doing that, but the fact that they have to power to do so, in itself should be disconcerting.
I don't know what you're getting at ( in this post ; I havent read your blog post yet ) but America currently is one of the most restrictive places on earth to express your thoughts and then hope to have them transmitted fairly to a wide swath of people, both geographically and ideologically.
America still has some of the strongest court
prescient when it comes to speech laws
Also, I don't know what that means.I'm in America, and I can access plenty of racist, sexist, government propaganda, anti government propaganda, anti religion, pro religion, anti police, pro police, violence, pornography, and so much more with the click of a button. If I wanted to, I can also upload any of these thoughts myself to someone else's computer (or use my own computer) and then post links to it to any number of online forums or chat groups where people would have access to them just by clicking on a link.
The point is that the content is hard to reach and nearly inaccessible to wide swaths of the population if the forces that be, deem that content troubling, to the people in their walled gardens and the ideological bubbles, they operate in.
This way, you can effectively screen and curate what views and slants reach the masses and manufacture consensus around an issue easily. You and me and the tech-inclined can find easy workarounds but that is besides the point.
Thats a huge problem.
Reporters without borders is probably one of the best sources to evaluate the quality of Freedom of Press worldwide.
But for some people arguing that not all is great with their freedom in the US challenges a part of their identity. And that makes rational discussion at least difficult.
As an example: Growing up near the Iron Curtain (on the western side) I believed for a long time, that we were the universally free side, while there was no freedom in the east.
During the last 10 years or so I realized that there were freedoms on the other side I didn't know of. And have never had in this so called free society.
I came to realize that there are different freedoms and that every society has different limits to these freedoms. Sometimes even within one country there are different limits to the same freedom for different social groups. Take Germany for example. The freedom to receive a good to great education depends massively on the affluency of one's family. There is nearly no chance of social movement for the poor. Or take the freedom to tell your boss what a bad idea it is to increase dividends for shareholders by 10% while letting people go (with the official reason being told is, that the company is struggling) and telling the rest, that there is no mt enough earnings to warrant a raise. I know people who were fired because of this.
Or take the outcry at Google when someone at Google published an internal mail with right wing leaning (if I remember correctly).
I am very much left leaning, but I would not challenge some parts of the ideological agendas being pushed at my workplace because I fear being ostracized.
So to make a long argument short I think freedom isn't an absolute. And the ideology behind it is often part of someone's identity. That makes rational discussion difficult.
> During the last 10 years or so I realized that there were freedoms on the other side I didn't know of. And have never had in this so called free society.
Mind sharing some examples?
Also the freedom of social upwards movement was way greater in eastern Germany than in western Germany. Also the freedom of a better educational system (propaganda was massive in both systems none the less).
One of my favourite interviews is with Berlin[2] where he talks about why positive liberty is so dangerous.
[1] https://www.youtube.com/watch?v=pfhQhdA-zss Tom Richey with an intro [2] https://www.youtube.com/watch?v=TIP9IjJcZr4 Isiah Berlin interview on the ABC on freedom
For some reason, many people seem cling to a nebulous idea of 'government,' that is more a wish fulfillment mechanism than concrete enforcer entity, can provide positive rights without impinging on the more basic negative rights.
The only thing that comes to mind for me here is the Damore memo, except 1) he didn't publish it, and 2) it was very left-leaning. It was about how to actually achieve the company's diversity goals, there were just some parts of it based on actual research that went against accepted narratives.
Was there some other leaked email I'd not seen?
Some of the countries ranked higher(in rank = lower number) are not even so safe to be in. How can you consider liberty among a place people can't even freely go where they want to report?
Here is some stuff to read up on this http://www.rightsrisks.org/banner/india-medias-crackdown-dur...
Without respect for the individual and individual rights, Indian society will not progress. Sitting on your high horse and making judgements about how the poor and uneducated (or any other group) aren’t ready for free speech is not the way.
Reality, I fear is fairly dystopic and I can keep posting such news articles all day which show India's slide into Authoritarianism.
Journalists and editors have been openly killed in Sri Lanka for opinion pieces that dared to tarnish the government.
Perhaps these rankings would have been believable 5 years ago, but today, they are not. The United States is also rated much too low here, which also stinks of political motivation. While we do have a President that can't seem to help but open his mouth to release stupidity and toxicity, the US has the strongest legal protections of speech and press in the world, and the only government action against journalists that might shift this belief is the ongoing case with Julian Assange, too recent to have been reflected in these rankings.
There is, to my knowledge, only one country which has Constitutionally protected free speech and it's the United States. There are censorship laws on the books in most other countries, either in fact, or in actuality. Germany for instance censors many types of speech. You may have some argument that this is a good thing, but nonetheless it shouldn't rank higher on any unbiased free speech index than the US, and yet here is one in which it is more than 30 positions higher ranked.
I don't get that statement. For example, there are a lot of banned TV series in "America" (I assume USA?), too. Not even going to mention all that other censorship there ... I didn't read your article yet, though. Just in case you clarify on that statement there.
That a nip slip in 2004 generated news around all the country and intensified fines on "indecency" is just plain ridiculous. That level of censorship is very difficult to justify when other countries are much more comfortable showing nudity.
So, the USA is not in a bad place when come to censorship. But, it has a long way to improve.
You say the USA has a cultural aversion to nudity. But it also legally produces a vast quantity of legal pornography, and the web hosting companies for the world's largest online paid and advertising-supported pornography operations are all in the USA.
And provided that things like ID age checking, consent and record-keeping are all followed, nobody is kicking in their doors and arresting the operators.
There is no "full censorship" of nudity in the USA.
USA was top country regarding free speech in maybe 1980s but now, it needs to change it's policies to be one.
That does not mean citizens need to tolerate whatever you say. For example, a commenter on HN might break the rules and get banned by dang. Dang isn’t violating their constitutional rights, because dang/HN isn’t the government. [1]
Similarly, trump the private citizen was free to block people on Twitter. Trump the President was directed by courts to unblock a person because their ability to participate in public discourse had been curtailed by a government official. [2] When Trump is no longer president, he will be free to block anyone once more.
I understand where you’re coming from - you felt that back in the day you were free to say whatever you liked without fear of repercussions from private citizens. I agree but this could be because of a couple of changes
- we store everything that’s said. A passing comment from 10 years ago isn’t stored, but a tweet is.
- society changes what is acceptable to say. There were restrictions at that time as well (the n word could get you fired) but now society also frowns upon a broader range of transgressions.
This is fine, society is entitled to change its mind. 25 years ago only 25% of Americans were supportive of gay rights. Today it’s 67%. [3] You can see how a homophobic slur would be acceptable at that time but not in 2020.
[1] - or are they?! X-Files theme plays
[2] https://www.reuters.com/article/us-trump-twitter/u-s-asks-su...
[3] https://news.gallup.com/poll/311672/support-sex-marriage-mat...
At what point does that stop being useful, as corporations gain power over the government?
Some used to worry that private malls replacing public venues for people congregating caused an erosion of rights. Now the Internet is mostly private malls. Anyone can self host a blog, still, but most spend their virtual lives in the "online private malls".
If the problem is that you can't build an audience it's not because your freedom of speech is being restricted, it's because no one wants to listen to you.
For the kinds of things people in America get fired, in European countries they get arrested for that.
This argument that only the direct legal limitations is enforced is very naive and a much more modern take because social media companies have largely ignored the cultural and ethical implications. Yet plenty of people, organizations, policies, and general common sense have embraced free speech voluntarily (ie, companies refusing to try to control their employees speech and views pushed outside of the workplace).
Ummm what? America bans films and TV series too.
https://en.wikipedia.org/wiki/List_of_films_banned_in_the_Un...