Hacker News Reader

Comment by wtmt | Hacker News Reader

This is a great, detailed report. I use one of these providers and see somewhat similar results (I do not use my ISPs DNS, but another one with DoH).

Am I right in concluding that these blocking methodologies can be thwarted to a greater extent by the user using Tor (or a VPN outside the country) and/or the websites in question using ESNI (and the user also using a non-ISP DoH provider that doesn’t have legal presence in the country, since the DNS providers will be the next target for these ill defined blocking orders)?

View on HN

You don't really need tor or any other VPN for that matter, https://getintra.org/ a DoH client for Android works just fine [0]

[0] https://twitter.com/vinifortuna/status/1304189371688660992

As stated in my comment, I am using a DoH provider outside the country, but see similar blocking results as the article. Handling DNS alone isn’t going to work all the time, which is what the article detailed out.

Did you try https://getintra.org/ (hint: it isnt your typical DoH client)? You're in for a surprise.

Source: Work extensively on an Intra fork.

I read through https://support.getintra.org/s/article/How-Intra-works and it sounds exactly like any other DoH client with a denylist.

They leave out details: Read the tweet thread I linked to.

Intra also sets up a VPN connection, right?

Yes, but not in the traditional sense, like, say ProtonVPN.com or Psiphon.ca or Latern.io do.

Intra merely captures DNS traffic on port 53 and tunnels it to any DoH endpoint. It circumvents SNI censorship because it essentially sees all TCP and UDP traffic and can manipulate it on-device, and it does so in a way that bypasses most (but not all) censorship implementations.

So it's not VPN but uses Android's VPN API.

DoH client won’t stop SNI blocking, of which this report found a lot.

ESNI, of the new trick of using ESNI plus a fake plaintext SNI, is definitely a more robust approach.

A DoH client cannot prevent SNI blocking (I never claimed otherwise) but Intra does employ other client-side tricks to do so. God, did anyone read the referenced tweet? The down-votes are icing on the cake. And this is supposedly "hacker news". Sigh.

Reply on news.ycombinator.com