South Korea is Censoring the Internet by Snooping on SNI Traffic

guest · Feb 13, 2019

South Korea is Censoring the Internet by Snooping on SNI Traffic
February 13, 2019
https://www.bleepingcomputer.com/ne...ring-the-internet-by-snooping-on-sni-traffic/

A warning page bearing the seals of the Korea Communications Standards Commission (KCSC) and the Korean National Police Agency is displayed for blocked HTTP websites, while TLS sites blocked using Server Name Indication (SNI) filtering will only throw a "This site can't be reached" error.
SNI filtering used to block websites
SNI filtering is used when connecting to a website over HTTPS and it allows ISPs to inspect SNI packets sent by a user's browser to the server it wants to connect to during the authentication stage.
This is possible because while TLS 1.3 encrypts almost all the data sent between the client and the server, it will still allow ISPs to extract the domain name the client connects to as detailed in IETF's "Encrypted Server Name Indication for TLS 1.3" draft

According to a tweet by Cloudfare's head of crypto Nick Sullivan, the South Korean government went one step further and decided to completely block all connections made using browsers that come with support for Encrypted SNI (ESNI) which would not allow it to snoop for the server names in the authentication packages sent to the websites' servers.
Click to expand...

Log in or Sign up

South Korea is Censoring the Internet by Snooping on SNI Traffic

guest Guest

Log in or Sign up

South Korea is Censoring the Internet by Snooping on SNI Traffic

guest Guest

Useful Searches