[squid-users] Yet another new cipher?

[Amos Jeffries]

On 1/07/2016 12:43 a.m., James Lay wrote:
> On Wed, 2016-06-29 at 19:33 -0600, James Lay wrote:
>> Yugh...starting around 10:00 facebook no longer works via
>> peek/splice.  pcap contents show:
>>
>> 1QTV01...CHLO....SNI.....VERS....scontent.xx.fbcdn.netQTV1
>>
>> after the threeway handshake and an instant reset.  Anyone know what
>> this is?  Cause I haven't a clue....screenshot of success after
>> bypassing included.  Thank you.
>>
> I guess I should also say that this is from the official Facebook app
> on Android...just updated on Tuesday.

FWIW: I identified the last one from your posted wireshark details.
Looking at the "Unknown Ciphers:" list and looking up the hex codes
listed there in the IANA registry.

The details posted so far about this issue tells me nothing except that
FB suddenly stopped working.

Amos