49

Given that Site X uses HTTPS, how can it be blocked by a country?

My browser reads: 128-bit encryption | ECDHE_RSA as key exchange.

I say it's blocked since when I use Tor, it works fine.

One important thing to point out is that it's not blocked in the typical sense we are used to see, which clearly shows a page that says it's blocked, instead, site X is blocked in a way that my browser just doesn't load the page and displays the error:

This webpage is not available, Error code: ERR_CONNECTION_RESET

for the HTTPS version, and that regular "page is blocked" page when requesting the HTTP version.

Note that no other HTTPS sites are blocked! Just this one! I assume this is evidence that excludes port blocking and protocol blocking. However, it leaves DPI; but there are other HTTP-blocked websites which have the HTTPS version still working! If they can DPI-block site X, why can't they block the other HTTPS sites the same way?

4
  • 3
    You might get a more precise answer when you would say which country you are from. Web censorship is implemented differently in different countries.
    – Philipp
    Aug 3, 2014 at 11:12
  • I assume you are also using another browser when you connect via Tor network. In this case it might actually be an error in your browser. Have you tested it in other browser or another device?
    – adrian7
    Aug 3, 2014 at 11:57
  • Nope, I torified Chrome in my PC (anonymity is not a concern with this site, only censorship bypass is) so it works with Tor ON, and doesn't with Tor OFF, and I also tested it on Android (Next Browser)
    – Mars
    Aug 3, 2014 at 12:01
  • 3
    They will block it via IP and domain name. You can use it using TOR since different IP will be serving the page for you which won't be blacklisted.
    – Paul
    Aug 4, 2014 at 9:31

7 Answers 7

50

TL;DR: TLS only secures the content of a message. Not the metadata.

When communicating over the clear net, it's important to remember that there are some portions of a given communication that cannot be secured using standard technologies. Unless you use something like TOR, your ISP will be able to determine who you're talking to even if you're using TLS.

To use an analogy, imagine sending an envelope via the postal service. The contents of the envelope are completely inaccessible to anyone other than the recipient. Even if a postman were to somehow view the contents, they wouldn't be able to comprehend it (Perhaps you ran it through a Caesar cipher first? Hehe).

However, in order to have the postal service send it to the correct address, the outside of the envelope must be marked with a plainly readable representation of the destination address. If the postal service didn't want anyone to be able to send letters to "Joe Schmoe, 123 Fake street," then they could just not deliver any letters with that address.

Since the postal service can't read the contents of the message, they have no way to identify the intent of the letter. The only information that they have is the fact that the intended recipient is Joe Schmoe. They can't screen only the letters that they deem to be malicious; it's all or nothing.

Similarly, the IP protocol (the routing protocol that TCP runs on top of) has plainly marked "sender" and "receiver" fields. TLS cannot encrypt this for two reasons:

  • TLS runs on top of TCP/IP, and thus cannot modify parts of the packets that belong to those protocols.
  • If the IP section was encrypted, then the carrier service (ISP routers) would not be able to identify where the packets need to go to.

The firewall that your ISP or country is forcing all of your traffic through cannot inspect TLS traffic. They only know the metadata supplied by the TCP/IP protocol. They have also deemed that the site you want to access is more bad than good, so they drop all of the traffic to and from the site regardless of the contents.

There is a method to secure even the metadata of online communications, but it is slow and not very scalable. TOR hidden services are one attempt at implementing this. Of course, hidden services only work within the TOR network, which can only be accessed by first connecting to a machine over the clear net. This means that the ISP or firewall still knows that you're proxying your data through the onion. No matter how you try, you will always leak some metadata. If they wanted to, they could reset all connections to TOR nodes in addition to the site they're currently blocking.

If you are trying to establish a direct connection to a specific IP through a firewall, and the firewall has explicit rules to kill any traffic to or from that given IP, then connecting to that IP directly will always be fruitless. You will have to connect to it indirectly, either through TOR, a VPN, or some other proxy service.

20
  • 1
    I don't see how this answers the question. To refresh your memory: the question was, how are they blocking my connection? I don't see an answer here. (Tangentially, the answer is pretty obvious: DNS blocking or packet inspection.)
    – D.W.
    Aug 4, 2014 at 6:54
  • 25
    I'm pretty sure I made the answer abundantly clear. While TLS is securing content of the traffic to and from the site, the TCP/IP transport layers are still open to inspection. Any firewalls that the OP's connection passes through can easily discard any packets sent to or from an undesirable IP.
    – Kaslai
    Aug 4, 2014 at 7:20
  • 1
    That wasn't clear to me. I suggest editing your answer to state the answer to the question explicitly. One way would be to start with the answer to the question, and then elaborate on the details.
    – D.W.
    Aug 4, 2014 at 7:43
  • 5
    There's a Tor and HTTPS article from EFF explaining what gets leaked when using HTTPS
    – icc97
    Aug 5, 2014 at 11:03
  • 1
    A lot of firewalls employed by places such as high schools often rely on scanning the traffic for keywords. If the traffic is over TLS, then the firewall can't scan for keywords. At my high school, the only thing our filter did was check the hostname of sites. This defeated your HTTPS workaround, but you could still DNS the url and connect using the IP. I believe that most firewalls put in place by schools are there to help increase productivity, not to censor content. That's why they're hilariously easy to work around.
    – Kaslai
    Aug 6, 2014 at 3:02
34

Many government web filters are implemented through DNS filtering.

In order to connect to https://www.example.com, your browser first connects to the DNS server of your internet service provider and asks for the IP address of www.example.com. It then builds an encrypted connection to the IP it gets. So the government instructs the ISPs to configure their DNS servers to return no or a fake IP address for the websites they want to block.

To test this, you could configure your network settings to use a different DNS server, like Google's 8.8.8.8. How to do this depends on your operating system, but a guide should be easy to find.

Another method of web filtering is by IP address itself. The ISPs just configure their firewalls to blocks all traffic to the IP address of example.com. Such a filter is harder to circumvent than a DNS filter, but causes a lot more collateral damage. Large web hosters often host thousands or even millions of completely unrelated websites on the same IP address. When ISPs block by IP, they can't block a specific site without also blocking all the others which share the IP.

5
  • 1
    Nope, that's impossible in my case. I'm using encrypted DNS. Sorry for not providing that info earlier.
    – Mars
    Aug 3, 2014 at 11:26
  • 1
    @Mars Encrypted DNS doesn't do much when the DNS server itself is compromised by censorship.
    – Philipp
    Aug 3, 2014 at 11:27
  • It's not. The DNS is clean, and I've also just tested another 5 public DNS (Google (2), OpenDNS, Swiss Foundation, and Local ISP)
    – Mars
    Aug 3, 2014 at 11:32
  • 3
    Well, that would hint at IP blocking being applied. Have you tried a simple proxy outside your country yet? That could get you a further understanding of what's going on...
    – Karl Hardr
    Aug 4, 2014 at 12:03
  • 2
    Don't forget that the addresses of those public DNS servers may also be redirected to a rogue DNS server working for your country. Make sure you test them through Tor too, to cross-validate the results, or you won't be able to assess the correctness of the responses you're getting. Aug 5, 2014 at 9:15
20

When you connect to an HTTPS website, the hostname of the website you are connecting to is transmitted over the network in cleartext as part of the TLS handshake. The server's certificate always contains the hostname, because that's how the server authenticates itself to the client: "I am the server that is authorized to serve content for www.foo.example, according to Jim-Bob's Bait Shop and Certificate Authority." Modern browsers1 also send the hostname in cleartext from the client to the server, in the "Server Name Indication" message which makes it possible to host many HTTPS websites on one IPv4 address.

This is necessary because of the way the math of setting up a secure channel works. Basically, the server has to make a cryptographically unforgeable assertion of its hostname (and some other stuff, most importantly its "public key"), in cleartext, before the process of "key agreement" begins, or else the client cannot be sure that there is no man in the middle intercepting communications.

But the downside is, a "deep packet inspection" firewall can learn that you are trying to connect to a specific website, and block access (e.g. by forging TCP RST packets) even though it couldn't have eavesdropped on the content of your communications with that site, and even if you never reveal the hostname of the site you want to communicate with in any other way.

1 in this case, "everything you are likely to encounter nowadays, with the glaring exceptions of IE on Windows XP, and the stock Android browser prior to 3.0; unfortunately, both of those are more common than we'd like".

4

HTTPS does not and cannot hide the IP and hostname of a website or the fact that you're connecting to it. It only encrypts the traffic sent over that connection once it is established.

Given that, it is trivial for someone controlling the line to terminate any connections for a particular site. What HTTPS (hopefully) prevents them from doing is monitoring or modifying the information exchanged with the site, but the fact that you're connecting to it is always visible.

2

Institutions and companies [eg. hotspot providers] generally deal with this in two ways:

  • Instructing DNS servers to point at other IPs: this is a weak obstacle, since technically savvy users can easily change their DNS service, and used when it's not really important to block a site. I believe this is what, for example, the Italian government does: the national ISPs are asked to change their DNS servers so that requests to banned site are instead redirected to a government-hosted page.
  • Blocking connections on an IP basis, rather than on a domain basis: this normally requires a transparent proxy (especially used by hotspot providers and such) or a firewall with deep packet inspection (eg. the Chinese firewall). To prevent the user from connecting to banned IPs, a few techniques are then used - among them, injecting TCP reset packets, redirecting packets, or simply dropping them.
1
  • > Blocking connections on an IP basis, rather than on a domain basis: this normally requires a transparent proxy (hence why this is generally used by hotspot providers and such) which drops packets sent to banned IPs, or otherwise stops connections (eg. the Chinese firewall injects TCP reset packets). Rubbish. You don't need proxies or packet inspection or any L4 stuff if all you want to do is block access to IP addresses. Simple L3 routing techniques (BGP etc.) is all you need.... and you can apply it at whatever level you want ... ISP level, per-subscriber etc.
    – user3083
    Aug 4, 2014 at 16:23
0

It is possible the target site itself is preventing you from accessing it from the source IP range in question.

I know firsthand of many large organisations who block countries not for any other reason than to minimise exposure to hackers coming from that region.

4
  • 1
    Nope. It's The Pirate Bay..
    – Mars
    Aug 3, 2014 at 12:20
  • If it's TPB, then you might as well just use it on TOR. It's not exactly a heavy bandwidth user, and it can even be accessed as a hidden service (uj3wazyk5u4hnvtk.onion). They're likely just killing all traffic to the known IP addresses for TPB.
    – Kaslai
    Aug 3, 2014 at 13:19
  • 1
    I can access it already. I'm more interested in knowing HOW they can block it since it uses SSL! That's why I didn't mention the site name, it's irrelevant knowledge-wise
    – Mars
    Aug 3, 2014 at 13:20
  • @Mars Some sites are hosted from dynamic IPs, but i don't think TPB is. Aug 5, 2014 at 21:15
0

My ISP can block access to some site even with DOH applied. Without DOH, while accessing blocked site browser while redirect to ISP page. With DOH when i access browser says "SSL_ERROR_BAD_CERT_DOMAIN". So i open cerificate button and this certificate is belong to ISP. Thats mean ISP block site via injecting ssl cert

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .