on the importance of encrypted-sni (esni) to censorship ......websites among alexa top 1m are...
TRANSCRIPT
![Page 1: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/1.jpg)
On the Importance of Encrypted-SNI (ESNI) to
Censorship Circumvention
Zimo Chai, Amirhossein Ghafari, Amir Houmansadr
University of Massachusetts Amherst
1
![Page 2: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/2.jpg)
2
What is SNI?
![Page 3: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/3.jpg)
3
Server Name Indication (SNI) allows web-hosts to render the correct certificate
a.comb.com
![Page 4: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/4.jpg)
4
Server Name Indication (SNI) allows web-hosts to render the correct certificate
ClientHello,SNI="a.com"
a.comb.com
![Page 5: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/5.jpg)
5
Server Name Indication (SNI) allows web-hosts to render the correct certificate
Website A'sDigital
Certificate
ClientHello,SNI="a.com"
a.comb.com
![Page 6: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/6.jpg)
6
Server Name Indication (SNI) allows web-hosts to render the correct certificate
Website A'sDigital
Certificate
ClientHello,SNI="a.com"
ClientHello,
SNI='b.com'
a.comb.com
![Page 7: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/7.jpg)
7
Server Name Indication (SNI) allows web-hosts to render the correct certificate
Website A'sDigital
Certificate
Website B'sDigital
Certificate
ClientHello,SNI="a.com"
ClientHello,
SNI='b.com'
a.comb.com
![Page 8: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/8.jpg)
8
TLS 1.2: SNI and CA are NOT encrypted...
Website A'sDigital
Certificate
Website B'sDigital
Certificate
ClientHello,SNI="a.com"
ClientHello,
SNI='b.com'
unencryptedencrypted TLS 1.2
a.comb.com
![Page 9: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/9.jpg)
9
TLS 1.2: SNI and CA are NOT encrypted...
Website A'sDigital
Certificate
ClientHello,SNI="a.com"
unencryptedencrypted
a.comb.com
SNI=a.comCA=a.com
![Page 10: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/10.jpg)
10
TLS 1.2: SNI and CA are NOT encrypted...
Website A'sDigital
Certificate
ClientHello,SNI="a.com"
unencryptedencrypted
a.comb.com
SNI=a.comCA=a.com
RST
RST
![Page 11: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/11.jpg)
Timeline: TLS 1.3 is finalized
11
3/21/2018
TLS 1.3 finalized
![Page 12: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/12.jpg)
12
TLS 1.3: SNI is still NOT encrypted...
Website A'sDigital
Certificate
Website B'sDigital
Certificate
ClientHello,SNI="a.com"
ClientHello,
SNI='b.com'
unencryptedencrypted TLS 1.3
![Page 13: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/13.jpg)
Censors exploit SNI for censorship
13
![Page 14: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/14.jpg)
Circumvention: Domain Fronting
ServerClient
TLS ServerHello with Certificate
TLS 1.2
TLS ClientHello with SNI
server_name: unblocked.comcertificate: unblocked.com
CensorEncrypted
Unencrypted
14
![Page 15: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/15.jpg)
Circumvention: Domain Fronting
ServerClient
TLS ServerHello with Certificate
GET / HTTP/1.1Host: blocked.com
TLS 1.2
TLS ClientHello with SNI
server_name: unblocked.comcertificate: unblocked.com
CensorEncrypted
Unencrypted
15
HTTP Response
![Page 16: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/16.jpg)
Timeline: CDNs Cease Domain Fronting
16
DNS-over-HTTPS added to Firefox 60.0
3/21/2018 4/13/2018
4/2/2018
TLS 1.3 finalized
Amazon announced an end to Domain Fronting
![Page 17: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/17.jpg)
Timeline: CDNs cease domain fronting
17
DNS-over-HTTPS added to Firefox 60.0
3/21/2018
4/30/2018
4/13/2018
4/2/2018
TLS 1.3 finalized
Amazon announced an end to Domain Fronting
Google announced an end to Domain Fronting
![Page 18: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/18.jpg)
Timeline: ESNI is proposed for TLS 1.3
18
DNS-over-HTTPS added to Firefox 60.0
3/21/2018
4/30/2018
4/13/2018 7/2/2018
4/2/2018
TLS 1.3 finalized
Amazon announced an end to Domain Fronting
Google announced an end to Domain Fronting
First ESNI Internet Draft
![Page 19: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/19.jpg)
Timeline: Cloudflare supports ESNI
19
DNS-over-HTTPS added to Firefox 60.0
3/21/2018
4/30/2018 9/24/2018
4/13/2018 7/2/2018
4/2/2018
TLS 1.3 finalized
Amazon announced an end to Domain Fronting
Google announced an end to Domain Fronting
First ESNI Internet Draft
Cloudflare started supporting ESNI
![Page 20: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/20.jpg)
Timeline: Firefox supports ESNI
20
DNS-over-HTTPS added to Firefox 60.0
3/21/2018
4/30/2018 9/24/2018
4/13/2018 7/2/2018 10/18/2018
4/2/2018
TLS 1.3 finalized
Amazon announced an end to Domain Fronting
Google announced an end to Domain Fronting
First ESNI Internet Draft
Cloudflare started supporting ESNI
ESNI added to Firefox Nightly
![Page 21: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/21.jpg)
21
How ESNI works?
![Page 22: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/22.jpg)
How ESNI works?
CDN Edge ServerClient
TLS 1.3
CensorDNS over HTTPS/TLS
DNS Server
Encrypted
22
![Page 23: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/23.jpg)
How ESNI works?
CDN Edge ServerClient
TLS 1.3
DNS query: saf3241@vasdf3213ff....
Censor
DNS TXT QueryDNS TXT Result
DNS over HTTPS/TLS
DNS Server
Encrypted
23
![Page 24: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/24.jpg)
How ESNI works?
CDN Edge ServerClient
TLS 1.3
DNS query: saf3241@vasdf3213ff....
Censor
DNS TXT QueryDNS TXT Result
DNS over HTTPS/TLS
DNS Server
Encrypted
24
![Page 25: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/25.jpg)
How ESNI works?
CDN Edge ServerClientTLS ServerHello
TLS 1.3
TLS ClientHello with ESNI
DNS query: [email protected]_server_name: f9jkls3zq....
Censor
DNS TXT QueryDNS TXT Result
DNS over HTTPS/TLS
DNS Server
Encrypted
25
![Page 26: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/26.jpg)
26
Research Questions
![Page 27: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/27.jpg)
Research Questions
27
● How many websites are supporting ESNI?
● How many currently censored websites in Chinacan be unblocked with the help of ESNI?
● Is there any censor already censoring ESNI traffic?
![Page 28: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/28.jpg)
28
How many websites are supporting ESNI?
![Page 29: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/29.jpg)
How many sites are supporting ESNI?
As of August 2019, Cloudflare is the only CDN provider supporting ESNI.
Cloudflare provides an informative debugging page for every site using its CDN service.
29
![Page 30: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/30.jpg)
How to know if a site supports ESNI?
30
![Page 31: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/31.jpg)
Cloudflare debugging page
31
![Page 32: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/32.jpg)
Cloudflare debugging page
32
![Page 33: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/33.jpg)
How many sites are supporting ESNI?
33
Location: On a VPS located in US
ESNI Enabled
![Page 34: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/34.jpg)
How many sites are supporting ESNI?
34
Location: On a VPS located in US
Alexa Top 1 Million Sites
ESNI Enabled
![Page 35: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/35.jpg)
Websites Supporting ESNI
35
More than
10% of Alexa Top 1 Million sites are supporting ESNI!
![Page 36: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/36.jpg)
Result: SNI Status and TLS Version
36
![Page 37: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/37.jpg)
ESNI adoption with Sites Popularity
37
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9Websites Grouped by Rank
0
2.5
5.0
7.5
10.0
12.5
15.0
% W
ebsi
tes S
uppo
rting
ESN
I
Ranking (Millions)1
![Page 38: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/38.jpg)
Research Questions
38
● How many websites are supporting ESNI?
● How many currently censored websites in China can be unblocked with the help of ESNI?
![Page 39: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/39.jpg)
39
How websites are censored in China?
![Page 40: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/40.jpg)
Major Censorship techniques in China
● DNS Hijacking
● IP Blocking
● SNI Filtering
40
![Page 41: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/41.jpg)
Detect DNS Hijacking - Result
41
located in China Alexa Top 1 Million Sites
![Page 42: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/42.jpg)
Detect DNS Hijacking - Result
42
24,128 domains under DNS-Hijacking
located in China
![Page 43: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/43.jpg)
Detect SNI Filtering - Setup
43
located in China Alexa Top 1 Million Sites
![Page 44: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/44.jpg)
Detect SNI Filtering - Result
44
21,446 domains under SNI-Filtering
located in China
![Page 45: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/45.jpg)
Detect IP Blocking - IP List
45
Alexa Top 1 Million Sites
DNS
Resolve from Hong Kong
Select the first IP in an answer
![Page 46: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/46.jpg)
Detect IP Blocking - IP List
46
Alexa Top 1 Million Sites
DNS
Resolve from Hong Kong
Select the first IP in an answer
539,456 unique IPs
![Page 47: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/47.jpg)
Detect IP Blocking - Setup
47
![Page 48: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/48.jpg)
Detect IP Blocking - Result
48
39,787 domains under
IP-Blocking
![Page 49: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/49.jpg)
47,069 sites censored among Alexa Top 1M
49
39,787 domains under
IP-Blocking (84.5%)
24,128 domains under DNS-Hijacking
(51.2%)
21,446 domains under SNI-Filtering (45.6%)
Blocked by DNS HijackingFiltered by SNIBlocked by IP
![Page 50: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/50.jpg)
Domains under different censorship
2514 704698
22,859
250 12
16,666
50
Blocked by DNS HijackingFiltered by SNIBlocked by IP
![Page 51: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/51.jpg)
2514 704698
22,859
250 12
16,666
70 sites are exclusively under SNI - Filtering
51
Domains under different censorship
Blocked by DNS HijackingFiltered by SNIBlocked by IP
![Page 52: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/52.jpg)
84.5% censored websites remain blocked in China
2514 704698
22859
250 12
16666
52
Domains under different censorship
Blocked by DNS HijackingFiltered by SNIBlocked by IP
![Page 53: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/53.jpg)
53
Effectiveness of ESNI
![Page 54: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/54.jpg)
DNS HijackingSNI FilteringIP Blocking
Effectiveness of ESNI
54
101,200 domains
supporting ESNI
24,128 domains under DNS-Hijacking
39,787 domains under
IP-Blocking
ESNI Supported
21,446 domains under SNI-Filtering
![Page 55: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/55.jpg)
DNS HijackingSNI FilteringIP Blocking
Assume DNS-based censorship evaded
55
101,200 domains
supporting ESNI
0 domains under DNS-Hijacking
39,787 domains under
IP-Blocking
ESNI Supported
21,446 domains under SNI-Filtering
![Page 56: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/56.jpg)
66 sites can be unblocked by ESNI
101,049 4,70266
23,024
85 16,678
0
56
Current Effectiveness of ESNI
Support ESNIFiltered by SNIBlocked by IP
Censored websites VS. ESNI supporting websites
![Page 57: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/57.jpg)
66 sites can be unblocked by ESNI
101,049 4,70266
23,024
85 16,678
0
57
Current Effectiveness of ESNI
medium.comboxun.comchinadigitaltimes.netbannedbook.orgrsf.orgamnesty.org.au….
Support ESNIFiltered by SNIBlocked by IP
Censored websites VS. ESNI supporting websites
![Page 58: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/58.jpg)
ESNI increases the cost of blocking 101k sites
101,049 4,70266
23,024
85 16,678
0
58
Support ESNIFiltered by SNIBlocked by IP
Censored websites VS. ESNI supporting websites
![Page 59: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/59.jpg)
IPs belong to CDN edge server are blocked
101,049 4,70266
23,024
85 16,678
0
59
Support ESNIFiltered by SNIBlocked by IP
Censored websites VS. ESNI supporting websites
![Page 60: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/60.jpg)
60
Monitoring ESNI-based Censorship
![Page 61: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/61.jpg)
Any area already censoring ESNI traffic?
61
![Page 62: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/62.jpg)
Monitoring ESNI-based Censorship from 14 Different Areas
62
![Page 63: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/63.jpg)
Monitoring ESNI-based Censorship - Setup
63
Sites supporting ESNI
ESNI Enabled
![Page 64: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/64.jpg)
64
Monitoring from 14 Different Areas
No ESNI-based Censorship Detected!
![Page 65: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/65.jpg)
65
Conclusions
![Page 66: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/66.jpg)
Conclusions
66
● 10% websites among Alexa Top 1M are supporting ESNI.
![Page 67: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/67.jpg)
Conclusions
67
● 10% websites among Alexa Top 1M are supporting ESNI.
● 84.5% currently censored websites will remain blocked in China even if DNS- and SNI-based censorship are evaded.
![Page 68: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/68.jpg)
Conclusions
68
● 10% websites among Alexa Top 1M are supporting ESNI.
● 84.5% currently censored websites will remain blocked in China even if DNS- and SNI-based censorship are evaded.
● Only 66 websites currently censored in China can be unblocked by ESNI.
![Page 69: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/69.jpg)
Conclusions
69
● 10% websites among Alexa Top 1M are supporting ESNI.
● 84.5% currently censored websites will remain blocked in China even if DNS- and SNI-based censorship are evaded.
● Only 66 websites currently censored in China can be unblocked by ESNI.
● No ESNI-based censorship is detected in our experiment across 14 different areas.
![Page 70: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/70.jpg)
ContactsZimo Chai - CS MS/PhD [email protected]
SPIN Lab, with Amir Houmansadrhttps://people.cs.umass.edu/~amir/Research.html
We have released all our probing tools and datasets at http://traces.cs.umass.edu/index.php/Network, to maintain reproducibility and to benefit future research works.
70
![Page 71: On the Importance of Encrypted-SNI (ESNI) to Censorship ......websites among Alexa Top 1M are supporting ESNI. 84.5% currently censored websites will remain blocked in China even if](https://reader034.vdocument.in/reader034/viewer/2022042407/5f21f5378475240e9036353c/html5/thumbnails/71.jpg)
Let’s Enable ESNI Now!1. Open about:config in Firefox2. Set network.security.esni.enabled to true3. Set network.trr.mode to 34. Set network.trr.uri to
https://1.1.1.1/dns-query5. Check if it works:
https://www.cloudflare.com/ssl/encrypted-sni
71