Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

First of all I'm sorry if the theory in my question is not correct or too lazy.

Living in Syria, so many sites are blocked "the foolish way" I think. Some examples (always using HTTP) are:

However, the thing that makes me so confused is that although http://ar.wikipedia.org is blocked, https://ar.wikipedia.org is not blocked (or more acurately, not matching any foolish blocking criteria), which poses the following question:

If the ISP is blocking based on request URL, it should catch that the request header contains host: ar.wikipedia.org, no matter what the protocol is, and therefore stop that request. However, this isn't happening apparently. What seems to be happening is that it's catching the response's location and blocking is happening based on it. But when the request/response are through https, the response header is not readable except by the browser, and therefore the ISP is not able to check and block.

Is what I'm supposing right or am I just a fool trying to imagine how the world works?

If I'm a fool, please feel free to delete the question. If I'm right, then I have the ultimate question:

Is the ISP fool for not using request header to decide to block or not, or there's some techincal difficulty that prevents it from doing so?

share

migration rejected from serverfault.com Sep 2 '13 at 4:27

This question came from our site for professional system and network administrators. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.

closed as too broad by random Sep 2 '13 at 4:27

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Because a professional network administrator would not ask this question. It's a good question, just more appropriate here. –  Michael Hampton Sep 1 '13 at 23:56
    
@MichaelHampton: I got it. –  Tamer Shlash Sep 1 '13 at 23:57
    
I guess he's a fool because he could easily block blogspot.au or he assumed that most people just wont use https and he might be right, average users never care about https so why bother –  Fischer Sep 2 '13 at 0:07
    
i advise you to use privatetunnel.com, or install openvpn on a cheap vps –  Fischer Sep 2 '13 at 0:10
comments disabled on deleted / locked posts

1 Answer 1

From a quick search, it seems that Syria is using filtering devices from BlueCoat that it purchased on the black market to do its Internet filtering. These are almost certainly not capable of blocking https connections.

It's theoretically possible to block an https connection in much the same way as http connections are blocked, but many filters don't do it. This is usually because they aren't capable of doing so; it is only possible if the web browser in use is relatively recent and supports Server Name Indication. In this case, the fully qualified domain name is transmitted in the clear in the TLS ClientHello message, and this could be used to block the connection.

And even then, if the filtering devices weren't legally acquired to begin with, it may not be possible to activate the features even if they are present on the device. Many network hardware vendors place such licensing restrictions on most or all of their devices.

Why some things aren't blocked that perhaps could be blocked? We're only human and we make mistakes. Perhaps it is an oversight. It could also be that some things are left unblocked intentionally, so that the authorities can learn who is reading certain content.

I generally advise people who are trying to avoid filtering of this sort to use a VPN or other encrypted connection (such as an SSH tunnel) to a server in a third country to tunnel one's Internet traffic, both to avoid filtering and to avoid surveillance. Of course the fact of the VPN usage can still be noted, but the traffic content cannot be. VPNs are usually tolerated because of their heavy use by international business travelers.

share
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.