undefined | Better HN

0 pointsdependenttypes6y ago0 comments

It is actually a good idea to use https rather than your own protocol because then your network provider/government will not be able to (easily) find out that you aren't just making https requests using your browser. Useful for people living in oppressive governments as well as employees/students under restrictive firewalls. In addition to that this will get more efficient once we have http over quic.

0 comments

6 comments · 3 top-level

BlueTemplar6y ago· 2 in thread

Quic seems to be the UDP equivalent to TCPcrypt? Both of which should be used by default on the Internet? But why should in your examples "the authorities" care or not whether you are using a browser over HTTP(S) or any other kind of software/protocol? If any communication channel is available, it's possible to send any kind of VPN traffic through it. Bits are bits. Especially when encrypted, so the censor has no idea as to what is inside...

dependenttypesOP6y ago

> But why should in your examples "the authorities" care or not whether you are using a browser over HTTP(S) or any other kind of software/protocol?

You are going to be more suspicious if you are using $protocol-specific-for-encrypted-chat than if you are just browing the web.

> Bits are bits

I agree, but this does not stop my ISP from throttling my SSH speed.

BlueTemplar6y ago

Also, IPSec.

Uehreka6y ago· 1 in thread

Bear in mind that when students and employees are on their school/work network, they often have to accept the network admin's certificate authority in order to be allowed to connect to the network. So effectively, the network admin can spoof SSL certificates and MITM traffic, even if it's encrypted.

pmontra6y ago

If that's part of the threat model, a layer 7 protocol can encrypt and sign the payload. Then anybody terminating the connection wouldn't be able to read and modify messages.

There are also replay attacks and probably many other issues I can't think about. Maybe some IM protocol already deals with that.

ppjet66y ago

You can also do XMPP over HTTP (long-polling aka bosh, or websockets). If people really want to add a layer, it is doable :)

j / k navigate · click thread line to collapse