[HN Gopher] Tell HN: Domain fronting to be blocked on Azure
___________________________________________________________________
Tell HN: Domain fronting to be blocked on Azure
I recently received the following email from Microsoft, with hard
deadlines for banning domain fronting on existing and new Azure CDN
services: "Action required: Azure Front Door/Azure CDN blocking
domain fronting Please take action to stop domain fronting on your
application before 8 November 2023 You're receiving this email
because you currently use Azure Front Door or Azure CDN Standard
from Microsoft (classic). Since 29 April 2022, we've changed the
behavior of Azure Front Door and Azure CDN from Microsoft to align
with our commitment to stop allowing domain fronting behavior on
our platform. With that change, we offered the option to enable
blocking domain fronting for existing or newly created Azure Front
Door, Azure Front Door (classic) and Azure CDN Standard from
Microsoft (classic) resources, through opening a support request.
See details in <Generally available: Controls to block domain
fronting behavior on customer resources | Azure updates | Microsoft
Azure> https://azure.microsoft.com/updates/blocking-domain-
fronting.... To continue our commitment, we're making changes in
two phases to stop allowing domain fronting behavior on our
platform. 1. Beginning 8 November 2022, all the newly created
Azure Front Door, Azure Front Door (classic) or Azure CDN Standard
from Microsoft (classic) resources will block any HTTP request that
exhibits domain fronting behavior. Previously existing Front Door,
Front Door (classic) and CDN from Microsoft (classic) resources
aren't affected by these changes. 2. Beginning 8 November 2023,
all existing Azure Front Door, Azure Front Door (classic) and Azure
CDN Standard from Microsoft (classic) resources will block any HTTP
request that exhibits domain fronting behavior. Recommended action
Between now and 7 November 2023, if you want to block domain
fronting for any existing Azure Front Door or Azure CDN Standard
from Microsoft (classic) resources created before 8 November 2022,
please open a support request. Provide your subscription and Azure
Front Door, Azure Front Door (classic), or Azure CDN Standard from
Microsoft (classic) resource information in the support request.
Once blocking of domain fronting has been enabled, Azure Front
Door, Azure Front Door (classic), and Azure CDN Standard from
Microsoft (classic) resources will block any HTTP requests that
exhibit this behavior. If your application uses a different TLS
SNI extension during the TLS negotiation from the request Host
header, you should prioritize changing this behavior on your
application by 7 November 2023 to ensure they match. Otherwise,
your application or API may be impacted by this change on 8
November 2023. If you have any questions, please open a support
request and provide your subscription details along with your Front
Door or Azure CDN from Microsoft resource information. If you have
any questions, please contact us." Posting it here in case it's of
interest to anyone.
Author : wicroshoff
Score : 133 points
Date : 2022-11-12 12:22 UTC (10 hours ago)
| jiggawatts wrote:
| I suddenly understand why Azure has been dragging their feet on
| implementing TLS v1.3*. They're trying to avoid having to
| implement encrypted client hello, which would make their CDN
| products usable again by groups trying to hide information from
| government censorship and surveillance by mingling it amongst
| ordinary web pages.
|
| *) Or at least one of the reasons, none of which are good.
| bagels wrote:
| For this domain fronting, do you need to control the 'innocuous'
| domain for this to even work? I can't hide my traffic behind
| someone else's domain, can I?
| beauHD wrote:
| The thing about domain fronting, is you have to use a
| heavyweight corporate entity's domain because for a would-be
| censor, blocking those domains would be 'overblocking' and
| their censorship wouldn't really work. It would be like
| blocking a bunch of Amazon, Cloudflare, Google IPs. The
| Internet basically would be unusable, so they have to allow
| these corporate mega-giants in their allowlist.
| counttheforks wrote:
| How does domain fronting negatively affect microsoft? Why do they
| care? Is this all just about making peoples lifes worse?
| toast0 wrote:
| Domain fronting leads to collateral damage in terms of
| blocking. If I really want to block X and X is using domain
| fronting to blend in with traffic on a given CDN, that CDN is
| going to get blocked.
|
| CDN customers that are having their stuff blocked because of
| that are not going to be happy, in general.
| matheusmoreira wrote:
| The goal is to get people to stop wanting to block X in the
| first place. Alternatively, make it so they have to block the
| entire internet along with X.
| mindslight wrote:
| That's _your_ (and my) goal, not corporate America 's or
| totalitarian regimes', which are both different flavors of
| authoritarianism.
| andix wrote:
| That doesn't seem to match up with reality. A lot of
| legislations don't care a lot about collateral damage. They
| just block. And other customers on the shared IP have to
| deal with it (move to another IP).
| skeeter2020 wrote:
| Unfortunately the most common use-case of fronting is phishing
| and other scams that do make our lives worse. There's a legit
| anti-censorship angle but it is not the major use-case.
| zhfliz wrote:
| how would domain fronting help with phishing?
|
| your standard user agent (e.g. browser) will not send
| different values in SNI and HTTP Host header.
|
| this is a deliberate action by the user agent to obscure the
| actual traffic destination.
|
| this can of course be used both for censorship circumvention
| but also misleading corporate traffic inspection when TLS is
| not broken, though it's debatable whether that should work in
| the first place.
| poisonbug wrote:
| The issue isn't with phishing. The issue is with threat
| actors using domain fronting as a network masquerading
| technique when having command and control traffic call back
| to Cobalt Strike servers. You can use domain fronting look
| like it's heading back to legitimate sources such as
| Microsoft, but unless the corporation is doing SSL
| termination on the endpoints, it's impossible to determine
| the exact destination.
|
| Azure originally started on this path in 2021:
| https://www.microsoft.com/en-
| us/security/blog/2021/03/26/sec...
|
| Working in the pentest/red team field, I've seen various
| providers ban consulting companies and red teams from using
| domain fronting -- however, this doesn't stop the threat
| actors.
| vbezhenar wrote:
| I guess that they're afraid for entire Azure to be blocked by
| Russia or Kazakhstan. They can't afford such losses.
| ebfe1 wrote:
| Unfortunately much like every nice thing on the internet, once
| it is being abused, it gets axed... Domain fronting (having
| Host header differ to SNI in TLS) is a powerful way a malware
| author could send payload into organisations.. imagine seeing
| seemingly legitimate traffic to azure.com but end up with
| malwaredomain.com/lulz.exe... Unless organisations are peeking
| into TLS, check Host header, response with MZ file
| header...There is nothing they can do to stop this.
| cryptonym wrote:
| Let's say customer A got a server cert on Azure for
| bank_example.com and customer B got a cert on Azure for
| nsfw_example.com
|
| With domain fronting you may get 'nsfw_example.com' content
| from a TLS connection negotiated with 'bank_example.com'.
|
| This can be a security threat (not able to properly filter
| outbound traffic) and customer A may be unhappy about Azure
| allowing nsfw content to be distributed over a channel secured
| under the name of their bank.
| Denisos wrote:
| yes
| tialaramex wrote:
| Some of the key people behind ECH (Encrypted Client Hello, work
| to hide SNI and other potentially sensitive information from the
| Client Hello in TLS) work for outfits which would be delivering
| basically the same functionality via ECH, such as Cloud companies
| and CDNs. Of course it is possible they don't intend to ever
| deploy this (but then they've wasted months of work which seems
| strange) or that their employers won't allow it (but then they're
| wasting some fraction of productive effort by an employee) but
| it's also possible their explanation is real. Lets see what the
| difference is between ECH and Domain Fronting:
|
| Consider two clients, Alice and Bob, they are both connecting to
| some IP 10.20.30.40 using TLS or QUIC.
|
| Alice wants to access naughty.thing.example and Bob wants to
| access bland.stuff.example. Perhaps Mallory is trying to prevent
| Alice from accessing naughty.thing.example (but they don't mind
| bland.stuff.example) or perhaps Alice just doesn't want Eve to
| know what she's accessing. Mallory and Eve are both on the
| network, able to interpose between Alice and Bob and 10.20.30.40
| and neither Alice nor Bob can easily prevent that.
|
| Under domain fronting, Bob is just honest, he tells the server I
| want bland.stuff.example, and then he uses bland.stuff.example as
| usual and everything works. This means for technical operations
| it's OK if the 10.20.30.40 server cares what Bob said during
| connection. For example maybe once Bob says bland.stuff.example,
| the server spins up an IPC to a Python server which only knows
| about bland.stuff.example and splices Bob's connection to the
| IPC.
|
| Under domain fronting, Alice's situation is tricky. Alice _says_
| she wants bland.stuff.example but she actually uses
| naughty.thing.example and expects that to work. Technical ops
| people who 've arranged that bland.stuff.example connections get
| spliced are faced with bug reports - why didn't
| naughty.thing.example work, 10.20.30.40 was the right server ???
|
| Under ECH, both Alice and Bob are presenting a visible name
| (which might be bland.stuff.example or some other value entirely)
| which Mallory and Eve can easily read, but they're also providing
| an _encrypted_ destination, Alice can encrypt
| naughty.thing.example while Bob encrypts bland.stuff.example+ The
| 10.20.30.40 server can _decrypt_ the name, and thus it knows
| which service Alice and Bob _actually_ intend to access.
|
| + If you thought "What about padding? Those names are different
| lengths" congratulations, you're now at step 1 of a long process
| which is why this was not trivial to design and implement.
| jesprenj wrote:
| How would this work? How is the name encrypted before the
| pubkey is known? I've seen that it uses DNS to fetch another
| pubkey, but there is no encrypted DNS (DNSSEC is signed DNS).
|
| DNS-over-HTTPS is only used in the last-mile --- recursive
| resolver to client, not NS to NS, so the request is still sent
| in plain. Besides, DNS-over-HTTPS still requires ... TLS ...
| teddyh wrote:
| I believe that the new "HTTPS" record in DNS will help with
| that (and other issues):
| https://datatracker.ietf.org/doc/draft-ietf-dnsop-svcb-
| https...
| cimnine wrote:
| As I understand, the public key that is used for authenticity
| is not the same as the one being used for encryption -- at
| least since TLS 1.3, before it depends. The scheme is known
| as forward secrecy. For the encryption, an ephemeral key pair
| is used on both sides. These pairs are only used for the
| Diffie-Helman (or similar) key exchange. Therefore an
| encrypted connection can be established, then SNI can be
| exchanged over the encrypted connection, and then the remote
| can provide the signed nonce together with it's PKI public
| key, with which it establishes trust respective to the SNI.
| [deleted]
| [deleted]
| throwawaaarrgh wrote:
| China is very, very big business for internet companies. They're
| not going to risk that just to protect political dissidents.
| [deleted]
| psim1 wrote:
| Good. For every benevolent use case there are a thousand spammers
| and scammers using this technique for junk and phishing.
| calibas wrote:
| Google removed domain forwarding the day after a certain
| authoritarian government started blocking their cloud services
| back in 2018. Amazon removed domain forwarding a couple weeks
| later.
|
| Much like back in the 1930s, various major corporations are
| sending a clear signal about how much they value human rights
| versus making money. Personally, I buy into the whole argument
| that we can keep capitalism ethical by "voting with our money"
| and it's up to the people to boycott unethical companies. I seem
| to be something of a radical though in today's society.
| nibbleshifter wrote:
| Well, that sucks. What's worse is it is wankers in the "infosec"
| industry that pushed MS to do this (or at least, are taking
| credit for it).
| BeFlatXIII wrote:
| They probably threw in some pablum about "fake news" as well.
| [deleted]
| factsarelolz wrote:
| Could you explain to me how "nibbleshifter" would use the
| "feature" for good?
|
| What are you losing here "nibbleshifter"?
|
| Why do you put infosec in scare quotes? Why are they "wankers"?
| Why scare quote and name call a legitimate profession? Because
| you have qualms?
| nibbleshifter wrote:
| Evading censorship in less democratic countries, for a start.
| I've had to do this quite a number of times on my travels -
| and its even more important for people in the human rights
| field.
|
| Tor's "meek" pluggable transport uses domain fronting for
| this purpose.
|
| I work in the so called "infosec" field, and about half the
| field are myopic wankers who would readily sacrifice privacy
| wholesale to gain an ounce of so called security. Think: the
| kind of people who also want to cripple eSNI or DoH in the
| name of "network monitoring".
| badrabbit wrote:
| If you want to hide your domain name you can use eSNI. Keep in
| mind another name for censorship is moderation, it isn't just
| signal that uses it bad guys also abuse it and it was not a
| feature explicitly built to avoid censorship but more like a
| bug people were abusing.
| saddlerustle wrote:
| It's too late. Whole countries block all eSNI requests, so
| it's always going to fail open.
| coldsauce wrote:
| Yeah, I believe China doesn't even allow TLSv1.3
| tialaramex wrote:
| Not allowing TLS 1.3 means nothing (no modern web sites)
| works. Modern browsers and servers both speak TLS 1.3 and
| if they can't they give up. _Some_ things don 't work in
| China, but China wouldn't have a thriving economy if
| nothing was working. So no, they did not block TLS 1.3
| although it's interesting how this rumour seems to have
| self-popularised. China blocks certain popular sites, but
| it does not block whole protocols or protocol versions.
|
| This is actually a small triumph for the people
| responsible for RFC 8446. With previous iterations of TLS
| it was always discovered shortly after release that
| idiots broke stuff and so a "fallback" was necessary to
| allow you to speak the previous version. Such fallback is
| dangerous because an adversary can thus forcibly
| downgrade you to an older protocol, and thus attack old
| protocols even if the new protocol is safe.
|
| How is it done? That is, how does TLS 1.3 avoid downgrade
| attacks?
|
| When a TLS 1.3 server finds itself talking to somebody
| over TLS 1.2 (for example maybe a rather archaic web
| browser is connecting) it scribbles over some of the
| bytes labelled "random" in its Hello message. It
| scribbles 44 4F 57 4E 47 52 44 01. Which in ASCII spells
| "DOWNGRD".
|
| Those bytes don't mean anything special in TLS 1.2,
| they're just a strange coincidence. But if you're a TLS
| 1.3 client, seeing those bytes means a Downgrade attack
| was attempted. So you immediately give up, you are being
| attacked.
|
| So you might think well, a bad guy could just change
| those bytes blind right? Nope. The "random" field is used
| by both parties to choose parameters they're going to
| verify in a moment to check everything is safe. If you
| can change the bytes the values will be different and the
| connection fails anyway.
| badrabbit wrote:
| They can ban tls 1.3 internally and do tls1.3 post
| intercept to the server.
| badrabbit wrote:
| Well then hopefully tech people will soon wrap their head
| around the fact that political problems are best solved
| politically. You can't write tech that overrides the
| authority of governments but you can override or change
| governments.
| denton-scratch wrote:
| > You can't write tech that overrides the authority of
| governments
|
| Really? Tor springs to mind.
| badrabbit wrote:
| Same. What's your point? VPNs also bypass government
| blocks. It's a cat and mouse game, they block vpns and
| guards as they see fit when they have a good reason to.
| Look at tor, if a country tls decrypts everything and
| blocks connections that can't be decrypted can it still
| bypass their blocks? Just because not every government is
| doing it does not mean Tor can't be blocked. Hell,
| countries allow-list connections to allowed sites if they
| want. Breaking their laws may make you feel edgy but that
| sort of "revolution exporting" many in other countries
| consider it a form of neo-colonialism where you undermine
| their sovreignity and self-determination.
| denton-scratch wrote:
| You're right; ultimately, if you have total power, you
| can just block the internet.
| mindslight wrote:
| > _many in other countries consider it a form of neo-
| colonialism where you undermine their sovreignity and
| self-determination._
|
| Only if by "their" you mean the ruling class, and by
| "self-determination" you mean their ability to control
| others. You can't really say their opinions represent the
| will of the people, especially when it's the people
| themselves ultimately choosing to engage in "illegal"
| activities.
|
| And sure, "the will of the people" bakes in two very
| western individual/collectivist values. But as I get
| older I'm learning to not play the relativism card as
| much. We should certainly be critical of our culture -
| but to the point of making it better, not handicapping
| its spread.
|
| Plus there's still a very easy answer for the poor
| oppressed tyrant who doesn't like freedom of
| communication - shut down all Internet connections.
| gruez wrote:
| >Keep in mind another name for censorship is moderation
|
| No it's not, see
| https://news.ycombinator.com/item?id=33446064
|
| On most social media sites they're implemented the same way
| (ie. posts deleted/hidden from other users), but the
| objectives are totally different.
| badrabbit wrote:
| Let me rephrase then: what one calls censorship another
| might call moderation. The difference is authority to
| remove of hide content, if you have it then it is
| moderation. So, to be controversial for the sake or
| discussion then, Russia blocking Signal is moderation
| within the realm of their authority as is Iran blocking
| content they don't like or the US gov seizing domains.
| Either way, domain fronting was never an explicit feature
| anyone supported.
| sieabahlpark wrote:
| 8note wrote:
| I'd see them being different in terms of moderation
| acting as an allow list, and censorship acting as a deny
| list.
|
| They also have different targets - moderation is about a
| forum, while censorship is about an idea
| buro9 wrote:
| Doesn't domain fronting (by definition) not cover all those who
| reverse proxy (with cache) their S3 bucket and other apps to
| reduce their egress bills?
|
| The only part of the definition that applies is a subjective
| part... "for censorship circumvention".
| msravi wrote:
| > will block any HTTP request that exhibits domain fronting
| behavior.
|
| How does the CDN detect this? The CDN only sees the encrypted
| domain, correct?
| jesprenj wrote:
| No, CDN is a full MiTM on the traffic.
| bombcar wrote:
| And it has to be or it's not a CDN.
| jtokoph wrote:
| This also only really affective with a popular CDN because
| you're leveraging the fact that a government won't want to
| block an entire CDN. You can just do this yourself because your
| IP is just your IP and not shared with anyone important.
| eurasiantiger wrote:
| This seems to be a user-hostile move.
|
| https://en.m.wikipedia.org/wiki/Domain_fronting
|
| "Many large cloud service providers, including Amazon and Google,
| now actively prohibit domain fronting, which has limited it as a
| censorship bypass technique. Pressure from censors in Russia and
| China is thought to have contributed to these prohibitions"
| denysvitali wrote:
| Fixed:
|
| "Many large cloud service providers, including Amazon,
| Microsoft, and Google, actively prohibit domain fronting, which
| has limited it as a censorship bypass technique."
| throwaway0x7E6 wrote:
| sure, it was merely a coincedence that they've started doing
| it after russian minitrue telegram fiasco.
|
| our venerable corporations would _never_ bend to the will of
| foreign dictators.
| 616c wrote:
| Separate of whether the correlation is correct do you or
| anyone have info on the Telegram minitrue issue? I was
| unaware and don't really use Telegram.
| throwaway0x7E6 wrote:
| they've attempted to block it several years ago, likely
| due to its popularity among dissidents and/or refusal to
| cooperate with russian Disinformation Governance Board.
| they've botched it and a lot of unrelated services got
| blocked as well. they gave up and stopped trying.
| 5e92cb50239222b wrote:
| They went one step further after that fiasco -- it's
| heavily used these days to spread pro-Kremlin propaganda
| (definitely automated -- very similar messages get posted
| to thousands of channels pretty much simultaneously0).
| Comment sections on other channels are filled with bots
| (you can see them a mile away -- the nicknames are
| generated using the same pattern, the names don't feel
| right if you intimately know how Russian names are
| supposed to look, and the message style is obvious once
| you get to know it).
|
| 0:
| https://twitter.com/sobollubov/status/1567152744812740610
| lzooz wrote:
| Well if they didn't do this the entire Azure would get banned
| which is even worse.
| remram wrote:
| Banned by whom and why do you think that?
| dilyevsky wrote:
| Spanish isps for example. Did you know that in Spain
| there's a deal between rightholders and isps to block any
| domains/IPs they don't like? See:
| https://torrentfreak.com/spanish-isps-blocked-869-domains-
| su...
|
| I've personally seen domains on a shared provider banned
| without notice even though alleged pirate content was taken
| down within minutes. Very difficult to unban
| sylens wrote:
| It is not just used for censorship. When I was working as a
| pentester and domain fronting was still allowed on AWS, it
| became our method of choice for establishing C2 because it
| camouflaged so well with regular organizational outbound that
| it will bypass any egress filtering and restrictions.
|
| If we were using it on a pentest, you'd best believe there are
| actors using it for far more nefarious purposes.
| hedora wrote:
| Can't they use almost any read-write service for C2 though?
|
| "Because Security" arguments like this are increasingly used
| in place of "think of the children".
| sylens wrote:
| How many read-write services can you use to redirect
| traffic to your C2 infrastructure while almost guaranteeing
| organizations will allow outbound connections to it and not
| look too closely at it?
| easrng wrote:
| Google Docs/Forms/Sheets/etc, anything with an image
| proxy, probably Microsoft's Office Online stuff tho I
| personally haven't used it, webpush connections, the
| possibilities are endless.
| sylens wrote:
| Google and now Microsoft are also blocking domain
| fronting.
|
| The other 'possibilities' are not necessarily guaranteed
| to be allowed for egress traffic out of an organization.
| That's why the cloud providers blocking it is a big deal
| - most orgs WILL allow outbound traffic on more than a
| few ports to these platforms
| jiggawatts wrote:
| DNS...
| mindslight wrote:
| Unless corporate firewalls have advanced to the point
| where they're DNS aware (eg the client queries
| www.microsoft.com and only then is allowed to contact
| those IPs), can one not just direct domain-fronting-style
| traffic to any VPS?
| zimbatm wrote:
| It's not possible to block C2 without also helping censorship
| on the Internet. Whatever mechanism is used to hide one
| traffic is going to be used by the other one, and reversely.
|
| Morally, the question is which one is the most important?
| sylens wrote:
| The question for cloud providers is not which one is
| morally more important, but which one is better for their
| shareholders. It seems like creating a situation where
| organizations move their workloads off your public cloud
| because they have to blacklist your entire domain to stop
| an attack would be bad for their shareholders.
| svnpenn wrote:
| non crappy link:
|
| https://wikipedia.org/wiki/Domain_fronting
| codetrotter wrote:
| For anyone else wondering what domain fronting is:
|
| > Domain fronting is a technique for Internet censorship
| circumvention that uses different domain names in different
| communication layers of an HTTPS connection to discreetly connect
| to a different target domain than is discernable to third parties
| monitoring the requests and connections.
|
| https://en.wikipedia.org/wiki/Domain_fronting
|
| Cool, so we are bowing down further to oppressive regimes now.
| hsdropout wrote:
| I really enjoyed this explanation
|
| https://hackernoon.com/domain-fronting-101-what-is-domain-fr...
| weberer wrote:
| They've been waging this war for a couple years now. I guess
| they finally got to every cloud provider. Some related reading:
|
| "Amazon and Google bow to Russian censors in Telegram battle"
|
| https://www.fastcompany.com/40568177/amazon-and-google-bow-t...
|
| "U.S. Cloud Providers Face Backlash From China's Censors"
|
| https://www.wsj.com/articles/u-s-cloud-providers-face-backla...
|
| https://archive.ph/qhFQ5
|
| >China's Internet censors have strengthened content screening
| in recent months, creating difficulties for businesses and
| disrupting more commonly used firewall-circumvention software
| called virtual private networks, which connect users to the Web
| through a proxy server overseas. President Xi Jinping has
| ordered tighter control of online content that may undermine
| the ruling Communist Party, with bloggers facing jail for
| spreading what the government says are false rumors.
| deepsun wrote:
| I still see Cloudflare.
| ftyhbhyjnjk wrote:
| FiloSottile wrote:
| It's been many years, and I am still angry and disappointed by
| Cloudflare's decision to block domain fronting and drop Lantern
| as a customer. Lantern was one of the most effective Great
| Firewall bypass proxies at the time, and Cloudflare was
| expanding in China. (I was at Cloudflare at the time, but I
| don't have private information on the deliberation. I strongly
| considered quitting over it, maybe I should have, but I was
| junior back then.)
|
| The CEO even came on HN to try to frame it as an abuse
| mitigation, accusing Lantern of exploiting Cloudflare and
| arguing that they were not a customer. That was obviously false
| because you need to have a Cloudflare zone configured for
| domain fronting to work. They were a customer as much as the
| targeted hate websites they strenuously defend.
|
| https://news.ycombinator.com/item?id=9234367
|
| Companies show their color in selecting who they will stand up
| for.
| jgrahamc wrote:
| The insinuation is that somehow we had to stop domain
| fronting because "China". That's false.
|
| What actually happened was we started to get reports from
| customers that we were serving content from unrelated sites
| under their domains. Wasn't happening a lot but for a reverse
| proxy that's terrifying and about as bad as it can get. And
| what made it even weirder was that the domain fronting was
| connecting to other proxy servers outside Cloudflare and so
| we literally had situation where a Cloudflare customer's
| website suddenly served up google.com (not a customer).
|
| The issue was domain fronting where SNI didn't match Host
| causing us to handle the traffic incorrectly sometimes
| (infrequently but not zero). Since standard use of the
| Internet doesn't need SNI and Host to not match we blocked
| the use of domain fronting very fast to ensure the integrity
| of our service. Lantern was domain fronting tickling this bug
| and causing our customers trouble.
|
| Hence we dropped domain fronting.
|
| I remember this well because I actually debugged it myself
| and reported the problem in Jira. You weren't involved and
| inventing a story about "China" is dead wrong.
| mapgrep wrote:
| ...he says, as his company eagerly does business with Xi in
| China.
|
| No organization I am part of will ever do business with you
| if I can stop it.
|
| You fought for Turing but I suppose the Uyghur
| concentration camps mean nothing to you. They are not
| British so how could their lives be worth fighting for when
| there is money to be made (for yourself) without regard to
| morality or any sense of decency.
|
| But good job doing Cloudflare PR.
| FiloSottile wrote:
| As I said above, I was not involved in the deliberation, so
| I don't know the reason domain fronting was blocked. I
| clearly remember it being an explicit decision though, not
| a bug mitigation, and Matthew's explanation on HN makes no
| mention of a technical issue.
|
| I do remember one terrifying bug that Lantern was tickling
| which caused responses to cross streams, and I was involved
| in debugging that, but it was not due to the Host/SNI
| mismatch. It just happened around the same time that domain
| fronting was blocked. (I am going to respect my
| confidentiality agreement here, but if you want I can share
| what I remember here or in private.)
| jgrahamc wrote:
| _I clearly remember it being an explicit decision though,
| not a bug mitigation_
|
| To be clear, that's not correct we did do this to
| mitigate the bug.
|
| We were facing the bug that I described (the cross stream
| thing) showing up when Lantern was used. It was causing
| disruption to our service and customers were writing in.
| We were trying to understand what was happening and
| needed to stop it. One of the things we did to stop it
| was disable domain fronting. As we were seeing the
| customer reports we didn't know if this was an OpenSSL
| bug, something in NGINX, something in our code, but we
| did know that Lantern was somehow causing it and they
| were doing domain fronting which wasn't the standard use
| of our service and so we dropped it.
| FiloSottile wrote:
| Maybe domain fronting was initially disabled as an
| unsuccessful attempt to fix that bug, that's possible and
| as I said I was not involved in that decision. Still, if
| that's the case, there was a policy decision afterwards
| to leave it disabled, because disabling it did not fix
| the bug, as you seem to agree. (Again, not elaborating on
| the bug publicly without permission, but I remember it
| turned out to have nothing to do with the SNI.)
|
| My point is that disabling domain fronting (or leaving it
| disabled after finding the bug's root cause) was a policy
| decision, not something necessary to mitigate the bug or
| prevent it from re-occurring.
| hungryforeggs wrote:
| I think maybe it's not the best approach to air out
| grudges with former employers in public. And apparently
| incorrect ones at that.
| mindslight wrote:
| Could you not make domain fronting only work when the
| inside Host contains a specific component like start-
| frontin.example.com ? Then it will never work for a naive
| browser wanting to reach www.customer.com, but will work
| for non-browser clients deliberately trying to front.
| Avamander wrote:
| We have ECH (previously known as ESNI) now, is that not just
| domain fronting in a new form?
| cesarb wrote:
| No, because with ECH/ESNI the hostname in both layers (the
| TLS connection and the HTTP Host header) still matches. The
| only difference is that the hostname on the both layers is no
| longer visible on the wire, while without ECH/ESNI the
| hostname on one layer (the HTTP Host header) is hidden but
| the hostname in the other layer (the TLS connection) is
| visible. And you could still do domain fronting even with
| ECH/ESNI (making the hostname on each layer differ), though
| it would be kind of pointless.
| theCrowing wrote:
| Only for the legal stuff... so you will still get complaining
| comments.
| badrabbit wrote:
| That definition is incomplete. Threat actors also abuse this to
| hide their command and control infrastructure.
| lzooz wrote:
| Threat actors use knives to stab people - we have to stop
| selling those.
| tialaramex wrote:
| In the UK if you're under age and you decided to buy a
| knife you will have a lot of difficulty unless it's a
| little folding (but non-locking) pocket knife, like the
| small Swiss Army type utility knives. Indeed legally as old
| as 17 you can't even buy a steak knife in England although
| you can in Scotland.
|
| Once you've _bought_ a knife, it will usually be illegal to
| carry it in public unless you have a good reason, and
| "self defence" is not a good reason.
|
| Some particular knives, which have no apparent purpose
| except as weapons, are just illegal automatically except in
| some cases if you're a museum. In particular almost all
| swords (if they have a working blade) are in this category,
| and most things designed as concealed weapons (e.g. blade
| hidden in an umbrella, combs that are actually knives, push
| daggers)
| rovr138 wrote:
| I'm not trying to be an asshole, but we don't get much
| info from UK here besides things like the Queen dying, so
| I have to ask, Does it work?
|
| I mean, are instances of kids <=17 year olds with knifes
| down? What about shivs and other things?
|
| The reason I'm asking is because as a kid, if I had been
| told to not do something, I'd just find a way to do it.
| Not to use it, but to find loopholes and just say, _so
| what?, I can do x_
| bluehatbrit wrote:
| I don't know enough about when various laws were passed
| to say whether the introduction of the laws have had an
| impact. In 2021 the Office for National Statistics
| published a reasarch breifing on the topic with some top
| level numbers [1]. I can say I don't walk around
| expecting people to have a weapon on them, even in some
| of the higher crime areas of my city (Bristol). But
| that's just anecdotal and it'll greatly depend on where
| you live.
|
| [1] https://commonslibrary.parliament.uk/research-
| briefings/sn04...
| voakbasda wrote:
| It absolutely does not work. Violence finds a way.
| metiscus wrote:
| The mind is humanity's most lethal weapon. With the
| "right" mindset the entire universe can become a weapon.
| Efforts to reduce violence tend to focus on the presence
| of concrete weapons (because this is easier to quantify
| and measure etc) with much less focus on violent ideation
| and the root causes of the various forms of interpersonal
| violence.
|
| Reducing violence is a tricky thing because to a large
| extent it seems to me to be a symptom of broader and
| nearly intractable societal malaise. Not that it isn't
| worth removing nuclear weapons from circulation but the
| returns diminish quicker than most public policy folks
| seem to want to admit.
| bombcar wrote:
| Also ever since "driving while black/poor/not liked"
| became something you couldn't arrest on they need another
| excuse.
| denton-scratch wrote:
| Speaking for myself, I own a Buck Hunter knife that I
| used to carry as a pocket knife. When I learned that it's
| not street-legal (it's blade locks, and is 1/2" too long)
| I stopped carrying it. So that's one anecdatum. I'm not
| particularly unusual; I imagine many people that once
| carried a locking pocket knife no longer do.
|
| There was a spate of stabbing reports, about a decade
| ago. That seems to have died down. My guess (and it's
| only a guess) is that only drug dealers and people bent
| on mayhem carry guns or knives that aren't street-legal
| these days; what's the point in getting busted for
| carrying a penknife?
|
| Incidentally, I don't get the point of the ban on
| _locking_ knives. If you stab someone with a knife that
| doesn 't lock, then I suppose there's a risk to your own
| fingers; but the dude you stabbed won't care if it was a
| locking knife or not. I do get the blade-length
| restriction though. You don't need a 3" blade to sharpen
| pencils.
|
| My straight razors _are_ street-legal, though, and I
| think they 're quite a lot more dangerous than a 3" knife
| that locks. The sharpened edge of a razor is only about
| 2" long, so I assume it's street-legal; but you could
| really make a mess of someone's face with a razor (the
| preferred weapon of Pinky, the gangster from Brighton
| Rock).
| azalemeth wrote:
| Another piece of anecdatum: a vague friend of mine once
| had a routine traffic stop by the police as he'd renewed
| his car insurance on the day it expired and the change
| hadn't made it onto the database they use yet. The police
| officer asked something like "just as a routine question,
| do you have anything on you that you might think you
| shouldn't have, like knives etc". He was (at the time) a
| professional chef and had a large roll of huge, high end
| kitchen knives on the back seat of the car. He also had
| chef's whites and was driving to work. The policeman said
| that apparently a few smarter drug dealers had started
| doing that (keeping them in a roll) as it was more
| plausible that they'd be cooking with them rather than
| stabbing their mates. The give away, apparently, was that
| they'd just have one massive one and not bother with the
| chef's job and still end up with a few years in prison.
|
| My friend "got" a nice chat, and went on with his day,
| but did later comment that had he not had the outfit to
| go with them, and a vast array of obvious kitchen tools,
| he thought that they'd probably look at it a lot more
| seriously.
| [deleted]
| xeromal wrote:
| There's an argument to be made for that. See, the UK.
| chitowneats wrote:
| Sure. Might be hard for people to do certain manual labor
| jobs without access to sharp objects. I'm sure they'll
| figure it out.
|
| We'll have to ban rocks next though.
| oneplane wrote:
| It's pretty hard to stab people with rocks, especially
| multiple people.
| notadev wrote:
| But pretty easy to cause blunt force trauma to the head
| hedora wrote:
| Generations of Native Americans beg to differ.
| oneplane wrote:
| The native-american generations population probably
| doesn't intersect with the population of teenage knife-
| wielding attackers in london, which is what we're talking
| about.
|
| Then again, if you want to argue stone-age semantics: we
| can't ban anything and should just resort to continuous
| murder since rule-based society is too hard.
| exedore6 wrote:
| We just need to watch out for teenagers learning flint-
| knapping.
| badrabbit wrote:
| Talk about a strawman. Knives have utiltiy which is a
| feature. Domain fronting is a bug not a supported feature.
| brookst wrote:
| You're mixing up definition and policy.
|
| If airlines banned knives and someone posted a definition
| of "knife" that suggested they are only used for eating
| food, it would be perfectly reasonable for a reply to point
| out that there are dangerous uses which might have led to
| the bad, and that it's disingenuous to suggest that the ban
| was obviously motivated by a desire to make eating
| difficult.
|
| It's still fair to debate the balance of use and the merits
| of the ban, but IMO it is not reasonable to be upset over a
| more complete definition and context.
| [deleted]
| psychphysic wrote:
| Lack of SNI encryption is the Achilles heel of modern web when it
| comes to oppressive regimes blocking access.
|
| Between encrypted SNI (Or domain name fronting), encrypted DNS
| and of course HTTPS. The biggest legitimate use case of Tor would
| vanish.
| hoppla wrote:
| It will still be possible to correlate IP addresses and
| hostnames. You can only hope for plausible deniability provided
| that the site you are visiting share IP address with a bunch of
| other sites.
| ianlevesque wrote:
| While true, I feel this reasoning has been used to delay
| improving the situation for far too long. There's a big
| difference between "accessed this CDN IP used by thousands of
| websites" and "deliberately connected to example.com"
| mindslight wrote:
| > _Between encrypted SNI (Or domain name fronting), encrypted
| DNS and of course HTTPS. The biggest legitimate use case of Tor
| would vanish._
|
| Your comment was on point up until this. Just because the Tor
| use _you_ seemingly most identify with is access from
| oppressive regimes to the western web, doesn 't mean that the
| rest should be shunned. If you want to make political points
| about specific other uses of Tor, do it explicitly rather than
| maligning the whole project.
___________________________________________________________________
(page generated 2022-11-12 23:01 UTC)