Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Russian government wants to make use of HTTPS illegal (gov.ru)
25 points by ivan_gammel on Sept 21, 2020 | hide | past | favorite | 9 comments


The text of the draft legislation translated to English:

„...Clause 2 of Article 10 shall be supplemented with the following paragraphs: "It is prohibited to use encryption protocols on the territory of the Russian Federation that allow you to hide the name (identifier) Internet pages or site on the Internet, except for cases established by the legislation of the Russian Federation. Violation of the prohibition on the use in the Russian Federation of encryption protocols that allow hiding the name (identifier) of a web page or site on the Internet shall entail the suspension of the functioning of the Internet resource no later than 1 (one) business day from the day the violation was discovered by the authorized federal executive body.“


> to hide the name (identifier) Internet pages or site on the Internet I may be a bit rusty, but if it is forbidden to hide the URL of a web site, it does not forbid HTTPS.

(edit: I am wrong, thanks for the comments)


I didn't downvote, but

> in HTTPS the URL is in clear.

You can see the domain from a previous DNS query, but the URL requested is encrypted. Everything HTTP is encapsulated in TLS.


You don’t need the DNS query to get the host name/domain: The hostname is sent in clear before the TLS connection is established, otherwise name based virtual hosting would break with TLS. The host would not know which certificate to present. The feature is called SNI - Server Name Indication. AFAIK encrypted SNI is being worked on, but I haven’t followed the latest developments.


...and the explaining letter attached to the draft explicitly mentions both TLS 1.3 and DNS over HTTPS.


Well, these moves are to protect status quo of Russia's people in power (political and economical). Despite of their best efforts, they're loosing now Belarus, they've lost completely Ukraine, all they're left is to make sure they will keep control in their own country.



Good to see the site it's self uses HTTPS


"except for cases established by the legislation of the Russian Federation" would probably apply here.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: