Niklas Niere/JonSnowWhite

Ph.D. student at Paderborn University. TLS/Censorship/Cryptography 🐢
PGP Key:

[gfw.report @gfw_report]

🚨 Our S&P’25 paper reveals rising regional censorship in China.
In addition to the national Great Firewall, Henan province runs its own firewall. Though less sophisticated, it’s more volatile and aggressive—once blocking 10× more domains than the GFW.
👉 https://t.co/i0soDRjud4

[Niklas Niere/JonSnowWhite @JonSnowWhite2]

China advanced its QUIC censorship.

The GFW now decrypts QUIC Initial packets and extracts the hostname from the SNI extension—similar to its censorship of TLS over TCP.

My colleague details our findings in our new blog post:

https://t.co/epidRv0jf9

[ACSAC @ACSAC_Conf]

Congrats to Fabian Bäumer, Marcus Brinkmann, Nurullah Erinola, Sven Hebrok, Nico Heitmann, Felix Lange, Marcel Maehren, Robert Merget, Niklas Niere, Maximilian Radoy, Conrad Schmidt, Jörg Schwenk, Juraj Somorovsky on the 2nd #ACSAC2024 Cybersecurity Artifacts Impact Award 👏👏👏

[ACSAC @ACSAC_Conf]

Great presentations by all four #ACSAC2024 Cybersecurity Artifacts Impact Award finalists! 👏👏👏 A difficult decision for the jury indeed!

[Niklas Niere/JonSnowWhite @JonSnowWhite2]

3. Unencrypted HTTP/1.1 is still supported by around 20% of servers.
4. To easily analyze a website for unencrypted HTTP support, we provide a small tool: https://t.co/JP3BQpiake

[Niklas Niere/JonSnowWhite @JonSnowWhite2]

Unencrypted HTTP/2 is uncensored in China and Iran. While mostly used in conjunction with TLS, HTTP/2 can be used standalone to circumvent HTTP(S) censorship. We outline this finding in a blog post https://t.co/YdOQA0ei49 and summarize the takeaways below.

[Niklas Niere/JonSnowWhite @JonSnowWhite2]

1. Unencrypted HTTP/2 is uncensored in China and Iran. We suspect similar behavior in other countries.
2. Unencrypted HTTP/2 is supported by up to 6.28% of servers. Smaller servers and censored websites show higher support than large websites.

[Niklas Niere/JonSnowWhite @JonSnowWhite2]

Last week, Russia started blocking the Encrypted Client Hello(ECH). This prevents Russian internet users from utilizing ECH for censorship circumvention. It also blocks otherwise uncensored websites such as SteamDB. I wrote a short summarizing blog post: https://t.co/sPmLWdYTNf

[Vinicius Fortuna @vinifortuna]

The latest version of Intra has more robust protection against SNI attacks, unblocking more sites in more places, without the need for a VPN!

It's working very well in Iran for Youtube, Reddit and other sites.

Check out https://t.co/cYeWtn3ET3 and help spread the word!

[Niklas Niere/JonSnowWhite @JonSnowWhite2]

Closing remarks:

1. (Voluntary) Internet Censorship is prevalent in Germany
2. It is also easily circumventable
3. Copyright holders of scientific work put in effort to uphold that copyright

[Niklas Niere/JonSnowWhite @JonSnowWhite2]

Sci-Hub is now officially blocked in Germany.

Following a decision from Jan 8th, 2024, ISPs now redirect to a shared blockpage: https://t.co/s56UTJWbSe

I share some insights in this thread:

[Niklas Niere/JonSnowWhite @JonSnowWhite2]

How can the block be circumvented?

1. Use an alternate domain, not all Sci-Hub domains are affected by the blocks

2. Use an alternative DNS server. A quick fix in Firefox is to enable "Increased protection" for DNS over HTTPS; for Chrome enable "Use secure DNS"

[juraj somorovsky @jurajsomorovsky]

It is really ridiculous that disclosing crypto vulnerabilities is so hard nowadays. We can practically decrypt @fastly TLS sessions, and they ignore/misunderstand our disclosure for 2 months. Is that really so hard to understand TLS if you are a large CDN???

[juraj somorovsky @jurajsomorovsky]

Anybody from my followers working for Fastly (or knows anyone) who can help us with some TLS analyses? Thank you!