Subject: [hrpc] And a reminder of the landscape...

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 22 Jul 2015 13:43:13 +0200

To help us recruit people for this afternoon's meeting, turkish prime
minister reactivated DNS censorship on twitter.com:

https://gist.github.com/bortzmeyer/b652ae4ff432848422a7

Do note that, since the last time, many RIPE Atlas probes in Turkey
now use a custom resolver and therefore do not see the lie.

I suggest that RIPE Atlas probes are an enabler of human rights, since
they make censorship very visible and analysable from everywhere :-)

---

From: Seda <[email-masked]>
Date: Wed, 22 Jul 2015 08:11:35 -0400

stephane, this is great. if you have more information, I can share it with folks from turkey.
seda

On Jul 22, 2015, at 7:43 AM, Stephane Bortzmeyer <[email-masked]> wrote:

> _______________________________________________
> hrpc mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/hrpc

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Wed, 22 Jul 2015 18:18:10 +0200

> they make censorship very visible and analysable from everywhere :-)

Wow. This is an important insight for me. (and not just RIPE but the
other monitoring probe platforms like Bismark, etc.)

-- 
Joseph Lorenzo Hall
Chief Technologist
Center for Democracy & Technology
1634 I ST NW STE 1100
Washington DC 20006-4011
(p) 202-407-8825
(f) 202-637-0968
[email-masked]
PGP: https://josephhall.org/gpg-key
fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871

---

From: Corinne Cath <[email-masked]>
Date: Wed, 22 Jul 2015 17:25:22 +0100

These are some of the Iranian examples i was referring to, that came up in
conversation with researchers looking at Iran.

Iran exploits protocol weaknesses in the course of attempting to control
information. They take advantage of unauthenticated DNS (both through
having DNS servers hand out fake addresses, in addition to DPI on DNS
queries), HTTP inspection without TLS, BGP announcements without
verification, etc.

 I realize it's hard to design protocols resistant to traffic
classification against the entirety of a protocol. e.g. If Iran wants to
block all HTTPS connections to Apple because TLS has "apple.com" included
in the clear, that's a weakness in TLS 1.2; if Iran wants throttle all
HTTPS traffic, then there's not a whole lot than can be done.

-- 

'The management of normality is hard work'