Hacker News Reader

Comment by httgp | Hacker News Reader

It isn’t clear from the article, but how do we circumvent this? Would a VPN work?

You can use https://getintra.org/ and its numerous forks to overcome censorship as implemented by Indian ISPs today.

Then there is Tor on Android https://guardianproject.info/apps/orbot/ and VPN services like https://getlantern.com/ and https://psiphon.ca/ that exclusively focus on anti-censorship measures. Check their privacy policies before committing to use them.

TLS1.3 + ESNI is a robust solution, Firefox has the option of enabling it.

Cloudflare has a great page which allows to check this https://www.cloudflare.com/en-gb/ssl/encrypted-sni/

A couple of problems:

1. ESNI isn't a standard yet. So, support in mainstream web-clients is lacking.

2. Unfortunately, TLS v1.3 is blocked in countries with stringent censorship already.

Wait what?? TLS 1.3 is blocked by some countries? As more and more of the Web, especially CDNs move to TLS 1.3, won't these countries be effectively crippling the Net for their citizens?

Also ESNI needs server support I believe and very few servers support it. Right now it is effective only for sites fronted by Cloudflare if I'm not mistaken, and while that isn't a small number still its by no means the wider Net.

China is now blocking all encrypted HTTPS traffic that uses TLS 1.3 and ESNI

https://www.zdnet.com/article/china-is-now-blocking-all-encr...

I would not be surprised if some countries started blocking all the known DoH resolvers as well.

Shadowsocks has reliably worked for a long time in China, a country with arguably the best DPI capabilities on Earth.

Tor's pluggable transports also have been at this stuff for a long time.

The internet is for everyone.

Just use tor browser. Its fast enough to be usable now.

Judging from the details, a Proxy/VPN to another nation should work.

Noob question : How is that effective if "SNI travels on the network in cleartext"

SNI is part of the HTTPS request, which would travel through the encrypted VPN channel. All network traffic would travel through your VPN, which is encrypted. The other end of the VPN channel is in another country which doesn’t block the website.

Your computer <—-encrypted channel to VPN in other country—-> https communication to blocked website

What a country could do but we haven’t seen before, is block all VPN protocol traffic, effectively banning VPNs. This would be disruptive to business or politicians using VPN for privacy, so it’s not as politically feasible.

That's cleartext within your TCP/IP connection. If you use a VPN, that connection itself is encrypted.

Reply on news.ycombinator.com