[squid-users] Yet another new cipher?
jlay at slave-tothe-box.net
Thu Jun 30 14:35:53 UTC 2016
On 2016-06-30 07:18, James Lay wrote:
> On Fri, 2016-07-01 at 01:04 +1200, Amos Jeffries wrote:
>> On 1/07/2016 12:43 a.m., James Lay wrote: On Wed, 2016-06-29 at
>> 19:33 -0600, James Lay wrote: Yugh...starting around 10:00 facebook
>> no longer works via peek/splice. pcap contents show:
>> 1QTV01...CHLO....SNI.....VERS....scontent.xx.fbcdn.netQTV1 after the
>> threeway handshake and an instant reset. Anyone know what this is?
>> Cause I haven't a clue....screenshot of success after bypassing
>> included. Thank you. I guess I should also say that this is from the
>> official Facebook app on Android...just updated on Tuesday.
> FWIW: I identified the last one from your posted wireshark details.
> Looking at the "Unknown Ciphers:" list and looking up the hex codes
> listed there in the IANA registry. The details posted so far about
> this issue tells me nothing except that FB suddenly stopped working.
> Amos _______________________________________________ squid-users
> mailing list squid-users at lists.squid-cache.org
> http://lists.squid-cache.org/listinfo/squid-users 
> That's fair...I'm including a successful handshake...wireshark just
> sees this as data. Thanks Amos!
>  http://lists.squid-cache.org/listinfo/squid-users
> squid-users mailing list
> squid-users at lists.squid-cache.org
Meh...this is QUIC Crypto:
More information about the squid-users