What is Domain fronting? and how it is different from a VPN?
1 Answer
Domain fronting is a technique of exploiting HTTPS/TLS protocol specifics to obfuscate the actual server domain and avoid censorship. Essentially, domain fronting just hides the server's name that is exposed by SSL/TLS otherwise. The actual communication is encrypted anyway.
In one configuration, a large hosting service such as Amazon S3 or Google App Engine uses a shared SNI certificate containing both a common and target HTTPS domains. The domain name of the actual, blocked endpoint is only communicated after the establishment of an encrypted HTTPS connection, in the HTTP Host header, making it invisible to censors. This can be done if the blocked and the innocuous sites are both hosted by the same large provider, such as Google App Engine.
Other configurations allow a content delivery network's common HTTPS certificate and infrastructure to act as a reflector through to the target server behind.
These techniques work by using different domain names at different layers of communication. The domain name of an innocuous site is used to initialize the connection. This domain name is exposed to the censor in clear-text as part of the DNS request and the TLS Server Name Indication. For any given domain name, censors are typically unable to differentiate circumvention traffic from legitimate traffic. As such, they are forced to either allow all traffic to the domain name, including circumvention traffic, or block the domain name entirely, which may result in expensive collateral damage.
VPN is the use of an encrypted tunnel between two points on the Internet, forming a logical link. VPN encrypts everything running over the link, the only thing visible from the outside are the endpoints and the amount of traffic.
Both may be used for the same purpose - avoid Internet censorship - but they are completely different things.
-
So there are no "two points" in Domain fronting? it goes directly to the intended server? And please correct me if I am wrong, Domain fronting will not work if the actual server and the wanted server are not on the same CDN?– maysaraAug 10, 2019 at 20:29
-
1Essentially, domain fronting doesn't use the domain's actual SSL certificate but another one from the same hosting cluster. Doesn't necessarily need to be a CDN (although there's a greater choice of certificates there), just vhosts should suffice.– Zac67 ♦Aug 10, 2019 at 20:56
-
1.Yes, the hoster can prevent this exploit. According to WP, Google and Amazon don't allow that any more.– Zac67 ♦Aug 10, 2019 at 21:07