
TLS 1.3 Is an Opportunity for Amazon, Google and Microsoft to End Censorship - walterbell
https://www.privateinternetaccess.com/blog/2018/08/tls-1-3-is-coming-an-opportunity-for-amazon-google-and-microsoft-to-end-censorship/
======
ufmace
Why would anybody think that Amazon, Google, or Microsoft are against
censorship? Recent events have demonstrated that they love them some
censorship, when they do it. Witness the case of gab.ai - Google was happy to
pull their app from the Play store. Microsoft didn't mind at all threatening
to shut down their Azure account unless they censored a post. The Azure case
is particularly amazing. I can't believe the tech press isn't picking up on a
supposed cloud provider threatening to shut down someone's account unless they
make their website behave in a particular way.

I will say I haven't heard of Amazon censoring anything yet, at least not at a
level I would consider massively inappropriate for a cloud services provider.
Not selling something on their normal store is one thing, but pulling the plug
on an AWS account for website behavior would be something entirely different.

~~~
jonstokes
AWS has absolutely taken down websites because they didn't like what was on
them, just recently, in fact:

[https://freebeacon.com/issues/gun-rights-activists-posted-
gu...](https://freebeacon.com/issues/gun-rights-activists-posted-gun-files-
say-facebook-amazon-censored-site/)

I'm a journalist and have seen a screencap of the takedown that Amazon issued
to the Firearms Policy Coalition, which started and maintains the censored
site (CodeIsFreeSpeech.com). The takedown erroneously cited a temporary
restraining order issued against an entirely different site (defcad.com) as
the reason for the sudden, no-warning booting of the site from AWS.

And as you mentioned, Azure just now threatened to pull Gab.ai off its
platform over a pair of anti-Semitic posts.

[https://www.businessinsider.com/microsoft-gab-azure-cloud-
an...](https://www.businessinsider.com/microsoft-gab-azure-cloud-anti-
semitism-2018-8)

So these infrastructure providers are absolutely involved in censorship right
now.

~~~
djsumdog
I wrote about this last year:

[https://fightthefuture.org/article/the-new-era-of-
corporate-...](https://fightthefuture.org/article/the-new-era-of-corporate-
censorship/)

It's easy to side with CloudFlair when they go against a site like The Daily
Stormer (Which is so out there it might just fall into Poe's Law).

The fact is that most decent hosting is only available in a handful of
industries. Even the CF CEO has had misgivings of his decision and it gets us
into a really questionable space.

Platforms should be free to do what they want right? They should be able to
deny customers .. just like an airplane company should be allowed to keep
people who crazy political opinions from boarding plans right? .. oh and black
people too. Oh wait..what?

The freedom of speech in the US is pretty limited to government censorship.
But we don't let businesses do whatever they want. They can't keep a certain
ethnic group from eating at their restaurant, and in many states they can't
choose if their venue allows smoking. The big question is, does speech need to
fit into this same framework?

With the recent child protection act that gutted craigslist and took down
backpage (an act that is leading to more violence against sex workers in the
US and an act that the EFF and ACLU are actively fighting as being
unconstitutional), we see the US government holding content hosting companies
liable for the criminal actions of their user base. That is disturbing and
already a form of government control over what customers a business is allowed
to have.

It'd be one thing if censored sites could just go to another provider, but
there are only a couple of big providers and their mass has the ability to
crush anything they find questionable.

~~~
repolfx
It's actually worse than there being only a couple of big providers.

The problem is that the same sort of people who are trying to shut down sites
through legal pressure tactics against Amazon, Google etc are absolutely happy
to use illegal tactics too. In particular once sites are booted off large
providers onto smaller ones or self hosted sites, that's when the DDoS attacks
start. Infowars already saw one, for instance. How many firms can sink large
DDoS attacks without needing to kick out the target? Not many.

If a pressure group or activist employee base can get content off CloudFlare,
Google, Amazon and Microsoft then DDoS-wielding ideological zealots will do
the rest and then the site is gone for good.

Where does speech go then?

It's a very dangerous game for the people at these content platforms to play.
I don't see Republicans sitting back doing nothing as their worldview and
voter base is systematically wiped off the internet. Legislation seems likely.

~~~
geodel
I agree. I see this all the time when otherwise reasonable people spout "oh
well, Google/FB/Twitter are private companies so free speech argument does not
apply to them and that racists/nazis etc aren't owed anything by social media
platforms."

~~~
cwyers
This is based on a slippery slope argument: if the major platforms can ban
speech inciting violence against Jews and African-Americans, then what's to
stop them from doing it for other classes of speech? The answer is that the
public outcry for kicking off other kinds of users is likely to be more
pronounced and more justified. I'm not shedding any tears for the Daily
Stormer or Gab, and I don't view them as canaries in the coal mine.

~~~
jquery
Relying on public outcry to defend free speech is by definition guaranteed not
to work, because the only speech that needs protecting is unpopular speech.

------
exabrial
I have a few thoughts that come to mind.

One mistake we make frequently as tech people is trying to solve human
relationship problems with a technology fixes. Censorship has existed for
10,000+ years; encrypted s night isn't going to magically fix it. There isn't
an easy answer, just the hard path educate everyone.

Requiring encrypted sni will only mean the little influence thought leaders
have in censored countries will be blotted our and replaced with state-run
companies.

MITM proxies are a necessary evil, unfortunately, but the internet giants
aren't doing a good job letting clients know when their TLS is being
intercepted, so we're failing hard on education right now.

Also the makers of the commercial MITM proxies do a terrible job of staying
current on TLS specs. This is likely in part due to customers being unwilling
to install patches that cause a service interruption, so that should be taken
into the design of said devices.

~~~
Eridrus
Yeah, I think the recent death of domain fronting and the collateral damage
from Russia blocking Telegram are pretty indicative.

Regimes are completely willing to block large chunks of the internet if they
can't do targeted blocks. And cloud providers aren't particularly interested
in using their customers as collateral.

I expect surveillance prone regimes to just block anything with encrypted SNI.

------
ctz
This article is unfortunately inaccurate. TLS1.3 does not include encrypted
SNI. Encrypted SNI is still being worked on by the TLS working group, and
isn't in a deployable state.

~~~
remoteorbust
Thanks for the heads up. I've made some proxy software that routes on SNI. If
TLS1.3 drops SNI then I feel like that will accelerate ipv6 adoption because
we're going to need a shitload more IP addresses.

~~~
bogomipz
I'm not following the connection between how IPv6 would accelerate in the
absence of SNI. Could you elaborate?

~~~
tialaramex
Without SNI the only way for a client to talk to this.example rather than
that.example over TLS and thus HTTPS is to give this.example and that.example
different IP addresses. There aren't enough addresses to plausibly do this in
IPv4, but in IPv6 there are plenty (except in some unusual corner cases)

~~~
bogomipz
Indeed and I remember the bad old days of burning /24s for IP based virtual
hosts in order to provide TLS. our current IPv4 exhaustion was the part I was
missing. Cheers.

------
Crontab
Seeing how search results are being censored in “free countries” due to things
like the DMCA and The Right To Be Forgotten, maybe we shouldn’t look to
private companies to fix this issue.

~~~
tialaramex
Technology does have implications for whether a country can effectively
control something. Consider this for example:

[https://www.gov.uk/government/uploads/system/uploads/attachm...](https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/673425/Guidance_from_the_Secretary_of_State_for_Digital__Culture__Media_and_Sport_to_the_Age-
Verification_Regulator_for_Online_Pornography_-_January_2018.pdf)

That's the UK government explaining how it's going to enforce a worldwide
requirement for Age Verification on all sites with (what it considers to be)
pornographic material.

Now regardless of whether you think this policy goal makes any actual sense,
or whether a potential regulator would even try to do more than clamp down on
UK porn companies that don't do age verification, the mechanism described has
two halves to it:

1\. UK ISPs voluntarily block non-complaint sites in DNS

2\. Hopefully everybody uses their ISP's DNS servers

Why doesn't it say the UK government will make every ISP run all connections
through a government-owned proxy to enforce these rules regardless of DNS?
Because that would cost an eye-watering amount of money and "We had to raise
taxes by 10% for our anti-pornography law" is a guaranteed vote loser. It
would also be ineffective but let's see them spend that money first.

~~~
nickik
It has nothing to do with money. Setting up a DNS like that would not even
require raising of taxes by 0.1%.

The reason is that the law is only a political battle. Once the battle and the
marketing are over non of this law or how it is or is not implemented. At best
you get a bunch of bureaucrats in place that monitor these things and write a
report every so often. Those will be ignored until some politician is again
interested in fighting this battle.

------
yardstick
Encrypted SNI is great for individual privacy but terrible for
business/corporate security.

At the moment it is possible to MITM proxy (without the possibility
decryption) to inspect the SNI and determine if the host is allowed, and if so
the proxy does its own IP resolution and transparently proxies/forwards the
TCP traffic. Ie it never engages in the TLS session. This is useful for
restricting access from a LAN to services hosted on large cloud provides like
AWS, GCP, etc where fixed IPs are not available (well, the third party
service/website elects to use a CDN/load balancer/etc without regard to the
full security impact).

A good example is PCI DSS and the payment card LAN. You should firewall and
lock down so devices can only communicate with necessary services. Along with
actual payment services, these LANs often need to allow access out to third
party loyalty systems, digital receipt systems, etc that are cloud based.

With Encrypted SNI this won’t be possible to do securely anymore. A full MITM
TLS decrypting proxy with explicitly configure clients will be required to
ensure the encrypted SNI isn’t changed to a malicous host to eg upload
captured payment data to. That’s a lot more overhead both in:

1\. Configuring clients to use a proxy and custom CA (let’s hope all the
various third parties apps support proxy setup and custom CAs, and no cert
pinning!) 2\. Running a proxy that now it has to do full decryption and
encryption (to make sure you aren’t messing with the SNI and going to a host
you shouldn’t).

Of course I don’t expect businesses to these lengths until there has been a
serious breach exploiting encrypted SNI. Even then I don’t know which side
will take action (or if neither side will)— merchants installing MITM proxies
(unlikely), or third party service providers ditching load balancers and
sticking to fixed IPs on their cloud hosts (less unlikely).

~~~
growse
Aren't businesses that are serious about meeting their legal/regulatory
obligations for controlling internet access already using full MITM TLS
interception with their own CAs?

Given a malicious actor can register any old domain and get a cert for it very
easily, I'm not sure what particular threat blocking TLS connections based
just on the SNI is actually protecting you from.

~~~
yardstick
Think of all the small 1-2 employee businesses / mom & pop businesses etc that
take credit cards. They have no dedicated IT person. They’d be lucky to have a
dedicated LAN for payments (a PCI DSS requirement). Increasing the barriers to
compliance for these people is not a good thing. In practice they will just
close their eyes and pretend nothing is wrong, or they will just pay the fine
charges by the banks for non compliance— which doesn’t improve your credit
card security at all.

You can’t tell all these small businesses they can’t take card payments, and
you can’t make an already tough job harder, more complex and more expensive
without an associated drop in compliance.

~~~
growse
1-2 person businesses are likely outsourcing the entire problem of payment
processing (and thus, the majority of the PCI controls) to a 3rd party like
Stripe. The only PCI compliance needed then is an annual self-attestation
which basically asks "Did you change your router's default password?" and "do
you apply patches?" [1]

There _may_ be some mildly masochistic tiny businesses that choose to process
/ store payment details on their own networks and try to manage all the
controls needed for that, but in the presence of so many options for
outsourcing the problem, this doesn't seem like a particularly rational
decision.

> You can’t tell all these small businesses they can’t take card payments, and
> you can’t make an already tough job harder, more complex and more expensive
> without an associated drop in compliance.

This is only true if there are no sane alternatives.

[1] [https://www.pcisecuritystandards.org/documents/PCI-
DSS-v3_2_...](https://www.pcisecuritystandards.org/documents/PCI-
DSS-v3_2_1-SAQ-A.pdf)

~~~
yardstick
For bricks and mortar businesses Stripe won’t help much, still need a chip and
PIN reader on premise.

Square on the other hand does let you outsource the entire problem of physical
card payments to them, at the cost of much higher fees, as they are the
merchant of record so you don’t need to be PCI compliant at all. Which is a
real worry as that doesn’t give me much confidence when buying from a square
“seller”.

Their card reader originally didn’t encrypt data, and at least one model that
did encrypt could be bypassed via tampering
[https://www.zdnet.com/article/square-reader-to-card-
skimmer-...](https://www.zdnet.com/article/square-reader-to-card-skimmer-in-
less-than-10-minutes/) and while their current hardware may or may not have
issues, they display a distinct lack of concern for local device security.
Defense in depth is the way to go, but with Square you can put your
Android/iOS device onto any WiFi network and without any security on who else
is on it. Likewise you can download any random app that may look innocent
enough but is full of exploits (eg an app that claims to help you manage a
customer mailing list so you can grab signups on the same device as you take
payments, or an app that claims to help with inventory levels, etc).

~~~
growse
Can you link the PCI requirement that means anyone who simply accepts physical
payments needs to TLS-intercept all network traffic?

~~~
yardstick
See requirement 1.2 of
[https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-...](https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf)

Only services necessary for the business should be allowed in/out. If the
service can’t be firewalled by simple IP:port then you are left with having to
use a proxy to enforce the access control.

------
RRRA
ESNI is sadly not in the final standard, only in a seperate RFC. Hopefully
it'll be ready soon...

------
vbezhenar
I'm sure that many countries will block Amazon, Google and whatever else if
needed. It won't end censorship, it would make life of ordinary people there
even harder.

~~~
pimmen
But, if they do, they have a tougher sell. They might get away with ”we’re
just protecting you from certain sites we deem harmful, and we’re thorough
with your best interests in mind” when they block specific sites. It requires
a far more gullible public to pull that off if it’s more than half the
Internet.

~~~
majewsky
They'll just spin it as "supporting local businesses" who could not compete
with FANG otherwise.

------
ishitatsuyuki
> If Google Cloud, Amazon Web Services, and Microsoft Azure allow domain
> fronting with TLS 1.3, censorship countries like China are faced with a
> binary choice.

This sounds inaccurate to me. If encrypted SNI is applied, the middleman
should not be able to figure out which domain you are connecting to, without
interrupting the connection. Domain fronting is a technique for prior TLS
which you had to disguise the hostname.

~~~
tialaramex
Encrypted SNI isn't a feature of TLS 1.3. The article never outright says that
it is, but it manages to give that impression.

It was a desirable feature, but it wasn't delivered even for the final drafts
at the top of this year, let alone back in 2016 when TLS 1.3 was originally
thought to be finished.

The TLS Working Group is going to adopt it (consensus at IETF 102 and on the
mailing list was to adopt) but there's a LOT of work needed before Rescorla's
rough sketch turns into something you'd want to actually deploy to millions of
users.

Here's the email about adopting (Joe is one of the WG chairs) Rescorla's
draft.

[https://www.ietf.org/mail-
archive/web/tls/current/msg26842.h...](https://www.ietf.org/mail-
archive/web/tls/current/msg26842.html)

Note that this is nowhere close to a finished feature. They're not sure
whether to do DNS TXT records, whether this should live in a SRV record, some
new DNS record (DNS Ops doesn't like TXT, but real world DNS services often
don't have fancy new records for years because they're crap). They're not even
sure if this should be two documents (one about DNS, one about how you use the
keys which you presumably got from DNS) or just one.

Because TLS 1.3 doesn't always (today never) encrypt SNI, a middleman could
just insist on refusing connections with encrypted SNI. This becomes a staring
contest - do the browsers deploy this anyway, and risk losing customers in
places where governments have deployed a technology to prohibit it, or do they
blink and hide it in some "Privacy" feature no ordinary users will ever
enable.

------
Boulth
> The problem is that Amazon Web Services and Google Cloud currently do not
> allow domain fronting. Only Microsoft Azure does.

Is there an official word from Microsoft that they allow it or just "they
didn't ban it yet"?

------
peterwwillis
TLS 1.3 is just a protocol for transporting encrypting communications. We have
had such protocols for a long time. Censorship has continued unabated.

There is no technical solution that can prevent censorship. Censorship is a
social issue. If a government policy, or the policy of a privately held
corporation, insists on censoring something, it will do so.

Literally the only way a transport protocol could end censorship is if a law
were enacted that specifically stated _" This protocol may not be circumvented
or obstructed by any party, private or public, by any means, for the purpose
of censorship."_.

------
rqs
> Currently, SNI in TLS 1.2 has a flaw that allows censors to differentiate
> between a “real” service and a “fake” service if they are savvy enough to
> figure it out. Interestingly, SNI in TLS 1.3 fixes this problem by hiding
> all of the information about the service behind encryption.

Isn't this (Encrypted SNI) was the one been extensively discussed here:
[https://news.ycombinator.com/item?id=17538390](https://news.ycombinator.com/item?id=17538390)
?

This is great. I hope CDNs like Cloudflare etc deploy it ASAP. Also, deprecate
previous TLS versions as ASAP so it can be more effective.

~~~
TheCycoONE
That was my thought reading the article. [https://tools.ietf.org/html/draft-
ietf-tls-sni-encryption-03](https://tools.ietf.org/html/draft-ietf-tls-sni-
encryption-03) indicates this is not a solved problem for TLS 1.3, and the key
in DNS solution is still in the experimental phase (though compatible with TLS
1.3)

This article is premature?

------
RcouF1uZ4gsC
The issue with dealing with nation states, is that they actually have the
power of physical coercion. Even if you have a technical solution to say
domain front, the nation state depending on how big it is, may just make it a
crime to domain front a censored site. They can levy civil penalties and
possibly even criminal penalties against the company/employees. There is not
much benefit to the company to go against a nation state actor.

------
greatabel
In fact, google cloud already be blocked by GFW. Many of AWS server's ip have
been blocked by GFW. Only Azure can be used in China.

~~~
ianlevesque
Yeah the article writes “They can either block gigantic swaths of the Internet
(and face enormous backlash) or allow SNI to work” but I think China shows
that depressingly the enormous backlash is a myth.

------
anticensor
The article is ironically censored for me.

------
mhkool
The author does not consider that a filter can block TLS 1.3 and force apps to
continue using TLS 1.2.

~~~
judge2020
The downgrade protection in 1.3 is supposedly much better than 1.2,
[https://tools.ietf.org/html/rfc8446#section-4.1.3](https://tools.ietf.org/html/rfc8446#section-4.1.3)

------
hotpotjunkie
Unless TLS 1.3 includes built-in stenography, it will do nothing for
censhorship. Oppressive regions have historically used simple throttling/DoS
to make encrypted protocols unusable.

------
bufferoverflow
That assumes they want to end censorship. Google, for instance, outright
participates in political censorship, especially on Youtube - I've seen many
right and alt-right youtubers disappear or get strikes for something
unimportant that the left does without any repercussions. They also fired
Damore for quite mild comments about sex/gender.

~~~
futurix
If Chinese government was only censoring racists / misogynists / homophobes,
I'm sure less people wouldn't have a problem with that.

~~~
jquery
How about we don't censor based on what is the most political palatable?
Censorship via racism is especially slippery these days, should Sarah Jeong be
censored or the NYT taken down for publishing articles written by a racist?

------
DanielGee
Why is the assumption always that AMZN, GOOG and MSFT doesn't want censorship?
Especially when they have taken to censorship like duck to water.

Why is the assumption that when given a "binary choice", entities like China,
EU, etc would give in to tech companies? Especially when these companies so
easily succumbed to US government/media pressure at home where we have a
strong tradition of free speech? When a binary choice is created, it's the
companies that have given in, not the state.

Why are these tech companies being portrayed as being on the side of "good",
while nations are portrayed as being on the side of "bad". The idea that AMZN,
GOOG and MSFT have chinese, european or anyone else's best interest at heart
while the PRC, EU or any other state doesn't. Did the british east india
company have india's best interest at heart compared to mughal india?
Considering how suspiciously we view foreign companies ( especially chinese
tech companies ), it's odd that we view our own so highly.

~~~
duckerude
I don't like Google as a whole.

But I don't think Google is evil, in the sense of doing bad things because
they're bad. At a low resolution, I think it responds to incentives and tries
to make as much money as it can get away with. At a higher resolution, it's
made up of a lot of people and smaller groups that each have their own
incentives to follow, and whose goals don't exactly line up with Google's.

Fighting censorship is nice for PR, supporting censorship is bad for PR. Some
(not all!) ways of supporting censorship might help make more money, but good
PR also helps make more money, so it's a trade-off. Drawing attention to
Google's ability to fight censorship slightly shifts that trade-off.

But not all of Google's decisions are made centrally. Many (almost all, I
would guess) people in Google are well-meaning, and I expect they can get away
with making good decisions a lot of the time. The people working on TLS
probably aren't individually pro-censorship just because they work for Google,
which means they may not make pro-censorship decisions unless specifically
pressured to.

------
phobosdeimos
Sure if these companies want to lose market share. And whats censorship? Who
decides, the US? No thanks.

