7 ms·

Interesting, how does QUIC help with 'arbitrary censorship'?

634636346 3y ago
See: https://ooni.org/post/2022-quick-look-quic-censorship/ https://ooni.org/post/2022-quick-look-quic-censorship/ I assume Google and co. will fix this if it ever starts to seriously benefit platforms like KiwiFarms, which in the last year was being blocked by CenturyLink, a major US ISP. I also predict these QUICfixes will be met with broad enthusiasm by HNers.
jupp0r 3y ago
It mandates perfect forward secrecy TLS cipher modes mandatory which makes it impossible for man-in-the-middle hardware to intercept and read users' connections while still pretending to be secure. There was quite a bit of pushback on this in the IETF from financial institutions that think they have mandatory obligations to spy on their employees. Here is a relevant HN discussion thread from 2016 about TLS 1.3, most of which applies to HTTP/3: https://news.ycombinator.com/item?id=12641880 https://news.ycombinator.com/item?id=12641880
- rini17 3y ago
  This also means you can tunnel http3 traffic through cloudflare without them decrypting it?
  - ignoramous 3y ago
    Well, if your intention is to use Cloudflare's network for your H3 tunnels, then expect an API for it soon: https://blog.cloudflare.com/building-privacy-into-internet-standards-and-how-to-make-your-app-more-private-today/ https://blog.cloudflare.com/building-privacy-into-internet-s...
  - deleted 3y ago
    [deleted]
- horsawlarway 3y ago
  > There was quite a bit of pushback on this in the IETF from financial institutions that think they have mandatory obligations to spy on their employees. To be fair, they do have mandatory requirements to prevent their employees from doing some things online in some cases. For example - some of the rules around coordination on a trading floor: https://www.sec.gov/rules/sro/nyse/2017/34-80374-ex5.pdf https://www.sec.gov/rules/sro/nyse/2017/34-80374-ex5.pdf Or - in many cases they are legally required to retain a copy of communications sent, and there are a large number of sites that offer diverse services banks want that also happen to have "chat/email" hidden as a feature. That's legally communication, and they often can't collect and retain it. Long story short - they don't really care so much, because many of them are already doing this collection now in other ways... my first job out of college 13 years ago was helping large banks transition this monitoring and policy enforcement to browser extensions (Guess who was grumbling about the MV3 changes in chrome, for very similar reasons). Now they're moving to directly adding the monitoring in the OS/Kernel
  - jupp0r 3y ago
    Good to know, thanks for the perspective. I only know that there was huge pushback against these somewhat niche (but still important) requirements making TLS 1.3 less secure for everybody. I'm glad somebody held firm.
  - still_grokking 3y ago
    > Now they're moving to directly adding the monitoring in the OS/Kernel Does this mean financial software has root-kits build in? Good to know! So this means every banking computer is fundamentally compromised at the OS level. Let' see how long it takes until this backfires. Could be a nice global firework when it goes off. Who exactly builds those root-kits? How good are they protected against supply chain attacks?
  - betaby 3y ago
    They are of course free to use http in a closed environment, without any encryption. Or use any internal proprietary protocols. There is absolutely nor reason to mandate the world to follow their 'requirements'.

See: https://ooni.org/post/2022-quick-look-quic-censorship/ https://ooni.org/post/2022-quick-look-quic-censorship/ I assume Google and co. will fix this if it ever starts to seriously benefit platforms like KiwiFarms, which in the last year was being blocked by CenturyLink, a major US ISP. I also predict these QUICfixes will be met with broad enthusiasm by HNers.

jupp0r 3y ago

It mandates perfect forward secrecy TLS cipher modes mandatory which makes it impossible for man-in-the-middle hardware to intercept and read users' connections while still pretending to be secure. There was quite a bit of pushback on this in the IETF from financial institutions that think they have mandatory obligations to spy on their employees. Here is a relevant HN discussion thread from 2016 about TLS 1.3, most of which applies to HTTP/3: https://news.ycombinator.com/item?id=12641880 https://news.ycombinator.com/item?id=12641880

rini17 3y ago
This also means you can tunnel http3 traffic through cloudflare without them decrypting it?
- ignoramous 3y ago
  Well, if your intention is to use Cloudflare's network for your H3 tunnels, then expect an API for it soon: https://blog.cloudflare.com/building-privacy-into-internet-standards-and-how-to-make-your-app-more-private-today/ https://blog.cloudflare.com/building-privacy-into-internet-s...
- deleted 3y ago
  [deleted]
horsawlarway 3y ago
> There was quite a bit of pushback on this in the IETF from financial institutions that think they have mandatory obligations to spy on their employees. To be fair, they do have mandatory requirements to prevent their employees from doing some things online in some cases. For example - some of the rules around coordination on a trading floor: https://www.sec.gov/rules/sro/nyse/2017/34-80374-ex5.pdf https://www.sec.gov/rules/sro/nyse/2017/34-80374-ex5.pdf Or - in many cases they are legally required to retain a copy of communications sent, and there are a large number of sites that offer diverse services banks want that also happen to have "chat/email" hidden as a feature. That's legally communication, and they often can't collect and retain it. Long story short - they don't really care so much, because many of them are already doing this collection now in other ways... my first job out of college 13 years ago was helping large banks transition this monitoring and policy enforcement to browser extensions (Guess who was grumbling about the MV3 changes in chrome, for very similar reasons). Now they're moving to directly adding the monitoring in the OS/Kernel
- jupp0r 3y ago
  Good to know, thanks for the perspective. I only know that there was huge pushback against these somewhat niche (but still important) requirements making TLS 1.3 less secure for everybody. I'm glad somebody held firm.
- still_grokking 3y ago
  > Now they're moving to directly adding the monitoring in the OS/Kernel Does this mean financial software has root-kits build in? Good to know! So this means every banking computer is fundamentally compromised at the OS level. Let' see how long it takes until this backfires. Could be a nice global firework when it goes off. Who exactly builds those root-kits? How good are they protected against supply chain attacks?
- betaby 3y ago
  They are of course free to use http in a closed environment, without any encryption. Or use any internal proprietary protocols. There is absolutely nor reason to mandate the world to follow their 'requirements'.