Lu Wei <
[email protected]> wrote:
VanguardLH wrote:
Lu Wei <[email protected]> wrote:
An example: http://fankui.dongtaiwang.net/index.php?board=2.0 All
links on the page are HTTPS which would get time out, but changing to
HTTP manually would work. I have a bookmarklet:
javascript:(function(){location.href=location.href.replace(/^https\:/,"http:");})()
But it only works *after* the URL time out.
When I visit the HTTP page, yep, it's HTTP and does not get redirected
to an HTTPS page by their web server. When I click on a hyperlink, I'm
taken to HTTPS pages - but they show up, and do not time out.
They may show up for you, but not for me: I have to visit that site
through proxy because the direct connection is blocked by the Great
Firewall, and maybe HTTPS negotiation through the proxy is interrupted
also. HTTP-only mode is the solution for this case.
Sounds like a defect in whatever VPN that you use in not supporting
HTTPS. When the VPN exit node connects to the site, it becomes the
client to the site and uses HTTPS, so traffic from exit node to site is encrypted. Traffic across the VPN should be encrypted. When your
client connects to the VPN's entry node, it uses HTTPS, so traffic from
entry node to your client is encrypted. Looks like a deficiency in
whatever VPN you are using that HTTPS is not support at the exit or
entry nodes, or both.
China has banned VPNs not approved by them. They want the backdoor
access which renders VPNs insecure. While companies and corporations
are banned from operating entry/exit nodes within China, looks like the
law does not apply to citizens operating their own VPNs.
VPNs are not the secure transmission venue as touted. You have to trust
the VPN service, or the operators of the entry and exit nodes, to not
intercept your traffic to interrogate it. Since HTTPS is between exit
node to site, and between you and entry node, that traffic is decrypted
at the entry and exit nodes, so the VPN (and Tor nodes) could monitor
your traffic if they want to. Rarely do you know the operators of the
VPN or Tor nodes, so you're trusting your web content to unknowns. You
can hope the big VPN providers are trustworthy. You haven't a clue what
a private VPN operator is doing with your web traffic. VPNs and Tor are
about trusting unknowns with your web traffic, but they're based on a
trust model. They are to secure against outside interception and
iterrogation of traffic, not for security within their network. Maybe
they're safe, maybe not. You have to hope they're not watching. They
can be used for other purposes, like working around geofencing, or, in
your case, getting past a firewall to grant access the firewall would
otherwise thwart providing the firewall doesn't block access between VPN
or Tor nodes.
For the VPN you are using, do they operate a web site (which could
expose them to the Chinese gov't), or have a contact e-mail address, to
get information on limitations of their VPN, or to report problems in
using it? Just because they operate a VPN does not mean they support
HTTPS at their entry or exit node, or they're supporting TLS 2.0, or
later, rather than SSL or even TLS 1.0 (which is SSL 3.0, but with some handshaking differences that make SSL 3.0 and TLS 1.0 incompatible)
which would be using unsupported ciphers by the client or site. To be compatible today, and for the past many years, the VPN should support
HTTP via TLS. Alas, there are VPNs that are not very robust, and have
some crippling limitations.
https://www.vpnmentor.com/blog/nordvpn-works-china-first/
That mentions how to get NordVPN to work with their obfuscated servers.
The article says ExpressVPN is easier to set up. Those are commercial
VPN operators, so banned in China. You'll have to check if your choice
of VPN (aka proxy) operator has limitations on HTTPS (on either side of
their proxy network).
Have you tried visiting that HTTP site *without* HTTPS Everywhere
interferring? Disable the HTTPS Everywhere, and try the hyperlinks on
that web site again. You could add an exception to HTTPS Everywhere to
see if that works with the add-on active.
I have no experience with HTTPS Everywhere; never need that.
Sorry, I thought you saying "HTTP everywhere" meant you were asking
about the HTTPS Everywhere add-on from EFF. After 2 days of replies,
now it's about you trying to find an add-on that does just the opposite
by trying to force HTTPS connects to use HTTP. As mentioned, the site determines whether it uses HTTP or HTTPS. Even if you managed to force
your web client to always use HTTP for the initial connection, most
sites properly administered that support HTTPS will redirect HTTP
connects to their HTTPS pages. You cannot force them to undo their
automatic redirect.
Seems the problem is with whomever's VPN/proxy you are using.
--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)