South Korea is Censoring the Internet by Snooping on SNI Traffic

[e1-531g]

https://www.bleepingcomputer.com/new...n-sni-traffic/

South Korea has been blocking HTTP websites that are on their censor list for a while now and they have recently started using SNI filtering to block their counterparts served over HTTPS.

A warning page bearing the seals of the Korea Communications Standards Commission (KCSC) and the Korean National Police Agency is displayed for blocked HTTP websites, while TLS sites blocked using Server Name Indication (SNI) filtering will only throw a "This site can't be reached" error.

https://twitter.com/grittygrease/sta...30153319358465

Originally Posted by Nick Sullivan

And it looks like they're blocking encrypted SNI outright (according to accounts on the ground).

https://twitter.com/mathemonkey/stat...33240180867073

Originally Posted by Leonid Evdokimov

It's kinda interesting that ESNI is blocked (according to your text), while SNI split across several TCP segments passes through (according to GoodbyeDPI users reporting that to @ValdikSS) and lack of SNI passes through as well (thanks RIPE Atlas). Seems, ESNI is _targeted_.