Subject: [Add] OONI Report: "DNS over TLS blocked in Iran"

From: Alec Muffett <[email-masked]>
Date: Thu, 25 Jun 2020 21:13:51 +0100

Source: https://ooni.org/post/2020-iran-dot/

The locks are being screwed down, and it sounds like an opportunity for
something more discreet, like DoH perhaps?

  - alec

*DNS over TLS (DoT) is a network protocol that allows one to use DNS over
TLS (i.e. with encryption and authentication of the remote DNS server).We
investigated whether DoT works in Iran by gathering a list of 31 well-known
DoT endpoints and running experiments from four distinct Iranian mobile and
fixed-line Internet Service Providers (ISPs): MCI, TCI, Irancell, and
Shatel.We discovered that:*

   -
*57% of the endpoints are blocked on a least one ISP; *
   -
*the blocking is not implemented uniformly across ISPs; *
   -
*most blocking happens by interfering with the TLS handshake; *
   -
*in some cases TLS handshake blocking seems to depend on the SNI, while in
   other cases it seems to depend strictly on the TCP endpoint being used; *
   -
*forcing TLSv1.3 does not change the rate of successful TLS handshakes
   compared to letting the server choose a TLS version between v1.0 and v1.3. *

*In this report, we share details from our experiments and findings.*
(continues at https://ooni.org/post/2020-iran-dot/)

--
http://dropsafe.crypticide.com/aboutalecm