https://daniel.haxx.se/blog/2022/05/02/considered-18/ daniel.haxx.se daniel.haxx.se Search Primary Menu Skip to content * About * Contact Search for: [ ] [Search] [children] Haxx, Network, Web Considered "18+" May 2, 2022 Daniel Stenberg 10 Comments Vodafone UK has taken it on themselves to make the world better by marking this website (daniel.haxx.se) "adult content". I suppose in order to protect the children. It was first reported to me on May 2, with this screenshot from a Vodafone customer: [vodafone-uk-daniel-haxx-se] And later followed up with some more details from another user in this screenshot [vodafone-uk-daniel-haxx-se-2] Customers can opt out of this "protection" and then apparently Vodafone will no longer block my site. How I was graciously given more logs (my copy) showing DNS resolves and curl command line invokes. It shows that this filter is for this specific host name only, not for the entire haxx.se domain. It also shows that the DNS resolves are unaffected as they returned the expected Fastly IP addresses just fine. I suspect they have equipment that inspects outgoing traffic that catches this TLS connection based on the SNI field. As the log shows, they then make their server do a TLS handshake in which they respond with a certificate that has daniel.haxx.se in the CN field. The curl verbose output shows this: * SSL connection using TLSv1.2 / ECDHE-ECDSA-CHACHA20-POLY1305 * ALPN, server did not agree to a protocol * Server certificate: * subject: CN=daniel.haxx.se * start date: Dec 16 13:07:49 2016 GMT * expire date: Dec 16 13:07:49 2026 GMT * issuer: C=ES; ST=Madrid; L=Madrid; O=Allot; OU=Allot; CN=allot.com/emailAddress=info@allot.com * SSL certificate verify result: self signed certificate in certificate chain (19), continuing anyway. > HEAD / HTTP/1.1 > Host: daniel.haxx.se > User-Agent: curl/7.79.1 > Accept: */* > The allot.com clue is the technology they use for this filtering. To quote their website, you can "protect citizens" with it. [Screenshot-2022-05-02-at-10-58-14-URL-Traffic-F] I am not unique, clearly this has also hit other website owners. I have no idea if there is any way to appeal against this classification or something, but if you are a Vodafone UK customer, I would be happy if you did and maybe linked me to a public issue about it. Update I was pointed to the page where you can request to unblock specific sites so I have done that now (at 12:00 May 2). Update on May 3 My unblock request for daniel.haxx.se is apparently "on hold" according to the web site. I got an email from an anonymous (self-proclaimed) insider who says he works at Allot, the company doing this filtering for Vodafone. In this email, he says Most likely, Vodafone is using their parental control a threat protection module which works based on a DNS resolving. and then After the business logic decides to block the website, it tells the DNS server to reply with a custom IP to a server that always shows a block page, because how HTTPS works, there is no way to trick it, either with Self-signed certificate, or using a signed certificate for a different domain, hence the warning. What is weird here is that this explanation does not quite match what I have seen the logs provided to me. They showed this filtering clearly not being DNS based - since the DNS resolves got the exact same IP address a non-filtered resolver does. Someone on Vodafone UK could of course easily test this by simply using a different DNS server, like 1.1.1.1 or 8.8.8.8. Discussed on hacker news. NetworkTLS Post navigation Previous PostUncurledNext Postnow on HTTP/3 10 thoughts on "Considered "18+"" 1. [58a] Claudio says: May 2, 2022 at 16:07 Long ago I used vodafone but really, they seemed to block random things as "18+" with no discernible excuse. Once I was away from home and trying to look up a nearby restaurant, but that was blocked. Children better be used to starve I guess. Reply 1. [111] Kay says: May 3, 2022 at 16:14 That's probably because the restaurant advertises alcohol prominently enough or frequently enough for their software to get triggered as classifying it 18+. Reply 2. [238] Actually says: May 3, 2022 at 16:40 Probably tripped some regexp rule about consecutive x's equating to => "xxx", etc. Reply 1. [dbf] Daniel Stenberg says: May 3, 2022 at 17:08 If that would have been the case, then other hosts under the same domain would've been blocked too, and they aren't... Reply 1. [78d] Sergey Salnikov says: May 3, 2022 at 20:38 I wouldn't be surprised if some parts of your domain were whitelisted. After all, the unlucky admins forced to deal with this atrocity probably used curl to test it. 3. [481] Alex says: May 3, 2022 at 18:05 Or it may be because curl allows to forge really dirty HTTP requests Reply 4. [94e] Lauren Kelly says: May 3, 2022 at 18:51 Looking at the block page it redirects to, it contains "CAT= [hackers|computing]" in the query params. Do they just block all 'hacker' blogs? Oh dear... Reply 5. [41c] kybernetikos says: May 3, 2022 at 19:37 So are they fraudulently claiming to be you with that certificate? Reply 1. [dbf] Daniel Stenberg says: May 3, 2022 at 23:07 Yes, they try to "impersonate" my site with that MITM thing. Presumably to show an error/blocked message. It fails of course because the certificate is signed by a CA that most browsers won't trust. Reply 6. [0e2] ieb says: May 3, 2022 at 21:44 Vodafone have some pretty iffy practices all round Reply Leave a Reply Cancel reply Your email address will not be published. Required fields are marked * [ ] [ ] [ ] [ ] [ ] [ ] [ ] Comment * [ ] Name * [ ] Email * [ ] Website [ ] Time limit is exhausted. Please reload CAPTCHA. 9 - [ ] = six [Post Comment] [ ] [ ] [ ] [ ] [ ] [ ] [ ] D[ ] This site uses Akismet to reduce spam. Learn how your comment data is processed. Recent Posts * now on HTTP/3 May 2, 2022 * Considered "18+" May 2, 2022 * Uncurled April 30, 2022 * curl 7.83.0 headers bonanza April 27, 2022 * curl up 2022 San Francisco April 20, 2022 * msh3 as the third h3 backend April 10, 2022 Recent Comments * Daniel Stenberg on Considered "18+" * ieb on Considered "18+" * Sergey Salnikov on Considered "18+" * kybernetikos on Considered "18+" * Lauren Kelly on Considered "18+" * Alex on Considered "18+" * Daniel Stenberg on Considered "18+" * Actually on Considered "18+" * Kay on Considered "18+" * Claudio on Considered "18+" tech, open source and networking Daniel Stenberg [final-12-1000x1000-1] Swedish open source developer and curl maintainer. Sponsor me: on GitHub Follow me: @bagder Keep up: RSS-feed May 2022 M T W T F S S 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 << Apr Proudly powered by WordPress