Is there any way to bypass sni-based https filtering?

Question

From the side of the website owner, not the client.

South Korean government announced that they will censor internet by sni filtering.

According to korean law, every porn website will be blocked forever in korea.

Until now, we have bypassed censorship by connecting with the https protocol. But now it is useless. All Korean men consider this very serious.

I will surely find a way and inform it with all Korean online communities. For the freedom of all Koreans.

I have heard that TLS 1.3 does not yet support sni encryption.

So, is there any solution that can solve this problem in this moment?

There are ways to do things like using proxy, VPN, tor, but I do not think it's a fundamental solution. It is not a fundamental solution unless taking action on the server.

Answer 1

I think you don't actually understand what TLS and SNI do. SNI is a technology that allows multiple web server to be hosted on the same IP and listening on the same port but use different SSL/TLS certificates for encryption. Before SNI two web servers listening on the same port had to share the certificate, for example having a reverse proxy handling the TLS channel and redirecting the traffic to the actual web-server

Until now, we have bypassed censorship by connecting with the https protocol. But now it is useless. All Korean men consider this very serious.

HTTPS (HTTP with TLS or SSL) does not avoid censorship, what it does is encrypt - and provide integrity and authentication in some schemes - the communication channel so an adversary that is able to watch the traffic - a.k.a. eavesdropper - is not able to know what information is being transmitted. It does not have any anti-censorship property, an attacker that is able to cut the transmission channel won't know what it was sent but the communication will be stopped anyway.

Even more, for the particular case of HTTPS with SNI, not every information is encrypted. The hostname you're connecting to is sent in the clear when the TLS handshake is made

There are ways to do things like using proxy, VPN, Tor, but I do not think it's a fundamental solution. It is not a fundamental solution unless taking action on the server.

Usually governments ban access to certain websites through DNS. DNS is a protocol to translate hostnames into IPs that a computer can connect to, this means that if you have configured your DNS resolver to be x.x.x.x you can only access those hostnames for whom x.x.x.x knows the IP. In some cases changing the DNS resolver is enough to recover access to banned websites (Some popular DNS resolvers are 8.8.8.8 and 8.8.4.4 from Google or 1.1.1.1 and 1.0.0.1 from Cloudflare). This scenario happened in Siria some years ago where the Google DNS was written with paint on the walls to recover access to media information. Note that in this case, changing the DNS resolver won't prevent an adversary in the local network or in an intermediary node from knowing that the client is communicating with the webserver

In cases when you don't want an adversary to know to which server you're connecting a VPN or Tor is mandatory. When using a VPN or Tor an adversary in the local network of the client or in an intermediary node until the Tor entry point will know that you're connecting to that VPN or Tor entry node but won't be able to know anything after that. In a similar way the web server - and an adversary in its local network - will know that the connection is coming from a Tor exit node. For VPNs and Tor network special care needs to be taken to prevent DNS leaks

Using proxies may be secure depending on the proxy type.

• A SOCKS proxy will work similar to the Tor network but with a single node, this greatly reduces privacy as an adversary eavesdropping the incoming and outgoing traffic of the proxy can easily identify which proxy user is connecting to which web server, this is not as simple in Tor as entry and exit nodes are different and don't communicate directly.

• If an HTTPS proxy is used instead, the connection is encrypted between the client and the proxy using the proxy certificate, then decrypted and reencrypted using the web server certificate. This means that the client needs to trust the proxy as it can see all the traffic going through it. Furthermore, client's browser will probably show warnings as the proxy certificate won't be trusted.

Finally, using a VPN, Tor or both is the best solution. Contrary to what it seems, censorship is applied on the "client side" of the connection and not on the web server. What is disallowed is that clients from certain countries connect to the webserver, the webserver can't do anything about that AFAIK

Answer 2

Connecting to a site using Tor, a VPN or even a proxy is the standard way of bypassing a network filter. I don't know why you don't consider it a solution, or why you want a solution on the server (which would probably have little incentive for implementing bypassing features).

A way to conceal the website you are connecting to by TLS is to connect requesting a domain in the TLS layer (SNI) but a different one in the HTTP layer (you would need a non-standard software for this), a technique called domain fronting.

Since the network inspection can only see the outer one, you may be able to provide an innocuous domain in SNI and have the server reply to the HTTP one. If both domains are hosted at the same IP address (eg. they are at a CDN), as the censoring agent can't tell apart accesses to the innocuous domain and the unwanted one, they would have to also block the other one. Signal used to do this, hiding their connections with TLS stating they were to google.com, a website too big to block.

Answer 3

There are a number of serverless client apps that you can tell your users to use. They don't redirect traffic, so there's no slowdown.

You can use the Intra App on Android or GoodbyeDPI on Windows. It seems Green Tunnel works on Linux, Windows and macOS, but I never heard of it.

Alternatively, you can host your site on Cloudflare, which supports encrypted SNI, and tell users to use Firefox Nightly.