인터넷 4차 차단 발발! 발전하는 차단 우회 테크닉들

Technological Concepts & Censorship Timeline

• Premise/goal: The speaker argues that the country is “strict” about internet access and proposes a technical review of censorship methods and how users bypass them over time (HTTP/HTTPS → DNS blocking → SNI blocking → cloud infrastructure → VPN).

---

Censorship Season 1: HTTP-era Blocking (Easy Inspection)

• HTTP has no encryption, so governments/ISPs can inspect traffic directly.
• Because data is transparent, blocking is described as comparatively straightforward (traffic can be viewed/filtered).

---

Shift to HTTPS: Encryption Causes “Headaches”

• As web servers adopted HTTPS (HTTP + encryption), censorship became harder.
• The speaker explains that even if traffic is intercepted, destination/content isn’t easily visible due to encryption.
• Result: censorship difficulty increases, and “illegal” services increasingly move to HTTPS.

---

Censorship Season 2: DNS-based Censorship (DNS Spoofing/Tampering)

The speaker introduces DNS-based attacks as a censorship technique:

• DNS tampering/spying approach: The DNS server is modified so the user receives a malicious/redirect IP instead of the legitimate one.
• Example described: A user requests “google.com”, but is returned an IP controlled by the censor.
• Mechanism described: If users use the mobile carrier’s default DNS, the carrier can return “warning/blocked” responses prepared by the government.

User bypass

• Switch to public/overseas DNS providers:
  • 8.8.8.8 (Google DNS)
  • 1.1.1.1 (Cloudflare DNS)
• Claimed outcome: both “Season 1 & 2” strategies eventually get detoured by alternative DNS.

---

VPN Introduction (Product Pitch + Features)

The speaker recommends a VPN service (named Nord VPN in the subtitles) and highlights “added features,” including:

• Virus & Threat Protection
  • Phishing-site protection using a list of phishing sites.
• Malware/malicious download prevention
  • Blocking accidental downloads of malicious code.
• Safe Call Protection (noted as Android-focused)
  • Blocking suspicious/scam/phishing calls and flagging dangerous numbers.

The VPN is framed as part of the “bypass” toolkit.

---

2018–2019: SNI Field Blocking (TLS Handshake, Pre-encryption Metadata)

The speaker describes a move to SNI (Server Name Indication) blocking:

• Core claim: SNI is sent during the TLS handshake, before HTTPS encryption fully begins.
• Even though the HTTPS payload is encrypted, the hostname/domain in SNI is visible to censors.

Timeline (as described)

• 2018 announcement: develop/apply SNI-blocking tech; rely on DNS blocking meanwhile.
• February 2019 rollout: ISPs begin blocking using SNI.
• “Websites started to be blocked,” with widespread public reaction.

Controversy addressed

• The speaker emphasizes it is not “wiretapping” and claims it’s not content interception—just hostname identification in an unencrypted portion of the connection.

---

Counter-bypass: ESNI / Cloudflare (“Encrypted SNI” / “Cloud” Shields)

Because SNI is plaintext, the speaker suggests encrypting it:

• ESNI is mentioned as a way to hide the domain during the handshake.

Cloudflare adaptation (as described)

• Cloudflare is described as enabling this change.
• Many sites are said to adopt it to support newer handshake behavior, “cutting off” censorship based on SNI visibility.

Cat-and-mouse claim

• Since censorship targeted SNI visibility, the ecosystem adapts with encrypted/hidden handshake signals.
• The speaker also claims neighboring/other countries responded differently (e.g., blocking ESNI/TLS variants), forcing further adjustments.

---

Censorship Season 3: Pressure on Cloudflare (Platform-level Blocking)

The speaker argues bypass infrastructure often relies on cloud platforms due to security features:

• Governments try to push cloud providers to block specific country traffic.
• Example described: government pressure → cloud provider cooperation → blocking requests from Korean IPs.
• Mentions escalation: fines/legal actions in Europe (Italy mentioned) and later Korea blocking beginning May 1, 2026 (as described in subtitles).

Practical outcome (claimed)

• SNI-based bypass via cloud infrastructure becomes less reliable.
• “Cloud players aren’t a good option either” after the new blocking begins.

---

“Final” Bypass: VPN (Season 4 Framing)

The speaker positions VPN as the remaining breakthrough:

• VPN encrypts end-to-end from “start to finish,” reducing DNS/HTTPS/handshake visibility.
• VPN uses overseas servers, changing apparent IP/country routing.
• The speaker claims governments understand VPNs can bypass censorship, but:
  • censorship “can’t be fully solved,” and
  • blocking VPNs can be “irreversible”/hard.

---

Broader Analysis Conclusion (Arms Race + Limits)

• The speaker frames censorship as an ongoing arms race:
  • When one blocking method works, bypassers adapt; then new blocking methods appear again.
• They suggest the real target should be removing illegal content operators (e.g., better investigation/tracking and stronger punishment) rather than continually expanding content-access restrictions.
• Policy concern mentioned: even if censorship starts with “illegal webtoons/illegal OTT,” it may expand as culture/policies evolve.

---

Main Speakers / Sources (as Referenced in Subtitles)

• Primary speaker: a single presenter (no named host given in subtitles).
• Named sources/products referenced:
  • Nord VPN (VPN recommendation)
  • Google Public DNS: 8.8.8.8
  • Cloudflare DNS: 1.1.1.1
  • Cloudflare (referred to as “cloud player” in subtitles)
  • Google.com (example domain for DNS/SNI concepts)
  • Korean government bodies (mentioned):
    • Ministry of Culture, Sports and Tourism
    • Korea Communications Commission
  • Also mentions U.S. Trade Representative
• Concepts: HTTP, HTTPS, DNS, DNS spoofing/tampering, TLS handshake, SNI, ESNI