logoalt Hacker News

ignoramoustoday at 10:11 AM1 replyview on HN

> Was pretty useful back when I was in India since Jio randomly blocked websites

With Jio, you don't really need ECH at all. The blocks are mostly rudimentary and bypassed with encrypted DNS (DoH / DoT / DNSCrypt) and Firefox (which fragments the TLS ClientHello packets into two).

Also: https://news.ycombinator.com/item?id=34232190


Replies

arch-choottoday at 10:57 AM

Should've added this was back in like 2018 or so. Setting up DoH was harder than enabling SNI, and from my testing back then they were hard filtering on SNI (e.g. I used OpenSSL CLI to set the SNI to `pornhub.com` and connect to "known good" IPs, it'd still get reset).

Funnily enough, not setting the SNI and connecting the the origin IP, and then requesting the page worked fine.

show 1 reply