These are the visual aids I used to deliver a talk on domain fronting on June 30, 2015 at PETS 2015.
For the full paper see: https://www.bamsoftware.com/papers/fronting/.
I extracted the video of my presentation from the full-length conference videos: Day 1, Day 2, Day 3.
Domain fronting is the use of different domain names at different layers of communication.
The censor sees one domain name (an unblocked front domain), while an intermediate network device sees and obeys another.
$ wget -q -O- https://www.google.com/ | grep -o '<title>.*</title>' <title>Google</title> $ wget -q -O- https://www.google.com/ --header 'Host: maps.google.com' | grep -o '<title>.*</title>' <title>Google Maps</title> $ wget -q -O- https://www.google.com/ --header 'Host: meek-reflect.appspot.com' I’m just a happy little web server.
Transports based on this idea are now deployed in the Tor, Lantern, and Psiphon circumvention systems.
When you make an HTTPS request, the domain ends up in three places:
|DNS query||(censor can see)|
|TLS SNI||(censor can see)|
|HTTP Host header||(censor cannot see)|
We put an unblocked front domain in the DNS query and the TLS SNI. In the Host header, we put the real destination domain, hidden from the censor by HTTPS encryption.
$ wget -q -O- https://www.google.com/ --header 'Host: maps.google.com' | grep -o '<title>.*</title>' <title>Google Maps</title>
How to circumvent:
The rest is plumbing. You pay a 2–4× performance penalty depending on how you implement the transport layer.
Content delivery networks, mostly.
All these systems use TLS and some sort of tag that is undetectable by the censor but detectable by some network intermediary.
|domain fronting||decoy routing||CloudTransport|
|front domain||decoy web site||cloud storage|
|Host header||e.g. TLS tag||URL path|
|CDN edge server||ISP router||shared files|
Why is this a compelling idea?
Think of the challenges of censorship circumvention like this:
Includes fees for Google App Engine, Amazon CloudFront, and (estimated) Microsoft Azure.
General information and source code: