I want certain web pages blocked (within my country) by my Govt on a website that uses HTTPS on all pages. My Govt agrees that the specific URLs need to be blocked but expresses helplessness as their ISPs claim they can't selectively block HTTPS URLs but must block the entire website/domain / sub-domain which will cause genuine users to be affected. The prominent website in question has refused to take down the impugned web pages despite notices from my government and law enforcement requests.
-
3More generally: security.stackexchange.com/questions/4388/…– Gilles 'SO- stop being evil'Commented Jan 18, 2021 at 0:44
-
12On grounds of ethics, I would still refuse to cooperate with the OP to provide help/guidance in achieving what is expected from the question.– usr-local-ΕΨΗΕΛΩΝCommented Jan 20, 2021 at 12:06
-
@usr-local-ΕΨΗΕΛΩΝ There could be very valid reasons to block certain content, while not wanting to block the entire site. One wonders, though, what site would be important enough that they would not want to block it altogether, but would not accept legitimate requests for removal of specific content. To me, either the site is quite rogue, and it should not matter if it was completely blocked (it could lead them to revise their behaviour) or the reasons for removal are not legitimate enough to be universally recognised.– jcaronCommented Jan 20, 2021 at 13:44
-
Is this why Wikipedia has gone to mandatory modern encryption (which breaks older platforms)?– Harper - Reinstate MonicaCommented Jan 21, 2021 at 4:07
Add a comment
|
3 Answers
No, the ISP cannot block specific HTTPS protected pages because it cannot determine which page is being accessed.
HTTPS does not hide the server that is being accessed, because it needs the SNI (Server Name Indication) to be on the clear, so the server can know which certificate to use on the connection. Once the handshake is established, everything else is encrypted, including which page you are requesting.
So the ISP have two non-optimal ways to answer: don't block anything, or block the entire server.
Encrypted SNI is actually a thing (I think Cloudflare did add support back in 2018). Admittedly I have no idea how widespread it is. – s1lv3r
Encrypted SNI is a thing for the future. It is part of the TLS 1.3 specification, but isn't something that can be enabled by changing a configuration option on the webserver. It needs changes on the DNS records, and support from the webserver. It still don't have widespread support among webservers and web browsers, and is still not mature enough for high-traffic servers to adopt it.
ESNI would help hide the domain you are accessing from your ISP and government (depending heavily on your network configuration), but would not help the ISP selectively block pages on the domain.
answered Jan 18, 2021 at 0:12
-
5Encrypted SNI is actually a thing (I think Cloudfare did add support back in 2018). Admittedly I have no idea how widespread it is. Otherwise your answer is correct of course (+1).– s1lv3rCommented Jan 18, 2021 at 11:49
-
3At a guess, the site is either not served over HTTPS or sometihng is doing the blocking before the encryption is applied. Commented Jan 18, 2021 at 12:16
-
20@ThankYouSRT Possibly you have a corporate style firewall between you and the internet which is decrypting the internet traffic, selectively blocking it, and re-encrypting it with a certificate that corporate IT has installed only your machine. Check the "lock" symbol beside the URL and see who provided the certificate for the page.– throxCommented Jan 18, 2021 at 12:30
-
2@Desmond No, the specific TLD has nothing to do with the mechanics of HTTPS. Commented Jan 18, 2021 at 20:12
-
2@Desmond You Government may attempt to issue themselves with the same certificates as the website thereby allowing them to insert a transparent HTTPS proxy between you and the website and blocking specific pages but if they get caught browser manufacturers will simply ban all SSL/TLS certificates from your government forcing all websites to buy their certificates somewhere else. This has happened several times before, most recently for Khazakstan. Browser vendors do this because falsely issuing certificates is a flagrant violation of trust Commented Jan 19, 2021 at 1:06
Just for completeness, there are actually ways to achieve this, but they are usually the work of totalitarian regimes who want to eavesdrop on everyone's conversations and/or block content not matching the "party line", and of course won't be done "just for you": force all users to install an alternate root certificate, and have all traffic to that site to go through a proxy which will present a TLS certificate signed by that alternative root before forwarding to the original server, except for the page in question of course.
-
10For the record, Kazakhstan attempted to do this back in July (or August?) 2019.– iBugCommented Jan 18, 2021 at 15:35
-
10@iBug they've tried at least twice most recently in Dec 2020, but the browser makers just keep responding by refusing to trust the spyware cert. zdnet.com/article/… Commented Jan 18, 2021 at 18:08
-
4In practice, governments with a better PR office already have root certificates included in the browsers' standard lists, so in principle they could do this without you installing anything. Commented Jan 19, 2021 at 7:35
-
3@FedericoPoloni In theory, if they attempted to use such a root cert in the manner described in the answer at any detectable scale, they would probably get their cert ejected from browsers pretty quickly. Of course, if they do it in a very targeted fashion to stay under the radar...– jcaronCommented Jan 19, 2021 at 10:46
-
1@FedericoPoloni this is what certificate transparency tries to prevent Commented Jan 20, 2021 at 12:08
Like others said, for most cases inspecting TLS traffic would require installing certificates or even some software, which don't applies for most people. In the other hand, depending on how you consider blocking, there is a method which can make it possible:
There is a study that shows that in some cases HTTPS encrypted content can be identified: there is a paper (PDF) that shows that's possible to build a database of fingerprints which can be used to identify HTTPS-protected Netflix videos in real-time. There some limitations, such as taking some time to identify the video: "[...] the majority of the identifications occurring less than two and a half minutes into the video stream.".
It doesn't identify which exact URL was being accessed and cannot be used to block content completely, but if the URL just points to a video and the content that need to be blocked is after the detection margin, it can be used to detect when someone started to watch it then block connections to the server after that. In the context of totalitarian regimes, it could even be used to find those who watched videos against it. In the context of ISPs, it could be used to guess if some user-watched some popular video then sell this data to advertisers.
As this paper dates from 2017, before TLS 1.3, is possible that this method isn't working anymore. I hope.
-
1Oooooh that's a funny one. It's quite specific to video streaming though.– jcaronCommented Jan 20, 2021 at 15:59
-
1Deep Fingerprinting: Undermining Website Fingerprinting Defenses with Deep Learning Sirinam etal. 2018 Overall, our study reveals the need to improve WF defenses to be more robust against attacks using deep learning, as attacks only get better, and we have already identified several directions to improve the DF attack further.– brynkCommented Jan 21, 2021 at 4:35
-
1and a bit more recent: Triplet Fingerprinting: More Practical and Portable Website Fingerprinting with N-shot Learning Sirinam etal. 2019 WF attacks pose a serious threat to users’ online privacy, including for users of Tor ... WF attacks like Deep Fingerprinting (DF) have reached up to 98% accuracy. DF requires large amounts of training data that needs to be updated regularly ... we examine how an attacker could leverage N-shot learning- a machine learning technique requiring just a few training samples to identify a given class...– brynkCommented Jan 21, 2021 at 4:52