See all results

How to sing to caged birds

Or what you need to serve the oppressed masses

7 min read

I got the idea for this post when I noticed a couple of issues on the site of one of the resistance groups operating in ruzzia (credit where it’s due: they fixed them fast, and I will not name them). This little guide could be useful for opposition media too.

If you’re making something that is frowned upon by your local Authoritarianism™ franchise, you have a moral obligation to protect not only your cell | group | band | merry wagon, but your visitors too.

Maybe even them first, because, not unlike you, they are not prepared and not vigilant enough.

Some dictatorships will prosecute them for the visit itself; others will use finesse and make an “aggravating circumstance” out of it when they bake another “high treason” case.

You can slap Cloudflare over your site and give yourself a gold star for security, but that’s only the beginning of your saboteur journey.

User device is a threat to the user

Or, to be precise, a cop scouring through it. You don’t have to learn what modern forensic hardware can or cannot do, just treat the user’s device as fully transparent to the authorities. Especially those practicing cryptanalysis with the help of a car battery attached to your genitals.

Mind the cache

  • Use Cache-Control: no-store.
  • no-store also stops a CDN from caching, and the CDN is your DDoS shield.
  • Keep it caching with the targeted header CDN-Cache-Control: max-age=60 (RFC 9213), which the browser ignores.
  • If you worry about slow and metered connections, just remove the 5 different font files you included and cut down on JS/CSS.

You are not making the next Facebook here

  • No service worker: its registration persists and is listed in chrome://serviceworker-internals.
  • No web app manifest, no “install this app” prompt, no push notifications.
  • No localStorage, IndexedDB or long-lived cookies.
  • If a cookie is unavoidable: session-only, Secure, HttpOnly, SameSite=Strict (Set-Cookie).

A “clear traces” link

  • A URL that answers with Clear-Site-Data: "cache", "cookies", "storage".
  • This header wipes everything the site left in the browser, in one click.
  • Read the specification and MDN.
  • It doesn’t clear browser history. Remind your users to do it.

The Net is dark and full of terrors

DNSSEC is not optional

  • DNS is always one of the first victims of “sovereign internet” endeavours.
  • It’s not a panacea: malevolent actors can still force users through unsafe paths.
  • They can also shoot users in their user faces, what can I say, we control what we can control.
  • Do your part, enable damn DNSSEC, then check the chain with DNSViz.

HSTS is not optional. HSTS preload too.

  • Without HSTS, any visit that starts on plain HTTP can be stripped: the ISP answers the HTTP request itself, fetches the site over HTTPS, and serves it back over HTTP. The redirect on the server never reaches the reader.
  • Typed domains, old http:// links, QR codes and messenger links all start on HTTP.
  • HSTS ends the stripping from the second visit on; preload ends it from the first, because the list ships inside the browser.
  • Add a header: Strict-Transport-Security: max-age=63072000; includeSubDomains; preload (MDN, RFC 6797), then submit at hstspreload.org.
  • A visit that starts on https:// cannot be stripped: the attacker needs a valid certificate, and gets a full-page warning without one. Unless the device trusts a …

State Root CA

  • ruzzia has one already. One day your country will have one too (Kazakhstan tried). To protect kids, dogs or national something.
  • A CAA record will not save you, because a rogue government actor won’t respect it. That doesn’t mean you should ignore it.
  • Certificate Transparency logs show certificates issued for your domain by public CAs, so monitor them.
  • Some of your users will MITM themselves for access to banking. They will forget to switch browsers or profiles.
  • Just accept it and keep it in mind. Some of your users will see your site fully controlled by the dark side.

Encrypted Client Hello (ECH)

  • Encrypts the SNI, so the ISP sees only the CDN’s IP, shared with thousands of other sites (RFC 9849).
  • Needs DNS-over-HTTPS on the reader’s side and a CDN that supports it (Cloudflare does).

TLS 1.3

  • Use TLS 1.3. Keep TLS 1.2 only with a stripped cipher list, or better, don’t use it at all. It’s not worth it.
  • Mozilla’s SSL Configuration Generator writes the server config for you.

Any external resource is a liability

  • Remove Google Analytics, Meta Pixel, ad networks, Google Fonts, external CDNs for scripts. You don’t control them, and they don’t care about you or your audience.
  • Obviously, never use a service run from the hostile country (e.g. Yandex.Metrica).
  • The same goes for NPM packages and other supply chains.
  • If you need statistics: self-hosted, IP-less analytics (Matomo, Plausible, GoatCounter) or process the web server logs.
  • Self-host fonts, scripts and images. If you can’t, pin them with Subresource Integrity.
  • Add Referrer-Policy: no-referrer, so linked sites never learn the reader came from here.
  • A strict CSP keeps a tracker from being added back by accident.

Educate your users

  • Steer them to Tor Browser, or at least a private window.
  • Remind them that phones get searched at checkpoints and borders: clear history and app data, remove subscriptions before travel.
  • Warn them about the risks of malware like Yandex.Browser, and of certificates or “security profiles” a provider or an official asks them to install.

Protect sources and readers who write in

Add mirrors

  • Have an Onion / I2P mirror and urge people to use it.
  • Announce them with the Onion-Location and X-I2P-Location headers on the HTTPS site; Tor Browser then offers the onion address by itself.
  • The darknet copy should not leak the clearnet origin: canonical URLs, RSS and absolute links pointing at the clearnet domain push the reader out of Tor.
  • Host the clearnet mirrors on infrastructure the censor cannot block without breaking things it needs (large clouds, large CDNs). This is called collateral freedom.
  • Keep a list of mirror domains ready, and rotate them when one is blocked.
  • Fake mirrors carrying malware are a standard attack on blocked outlets.
  • Publish a signed list of official mirrors, and link it from everywhere.

Protect ya neck

  • DDoS protection, free for independent media:
  • Domain: never the hostile country’s ccTLD (it can be seized), a registrar outside its reach, registrar lock on.
  • Staff accounts: hardware security keys everywhere, the registrar and the DNS host first.
  • Server logs: no IP addresses, short retention, a host outside the regime’s legal reach. A log that does not exist cannot be subpoenaed or seized.
  • App stores remove apps on government demand: offer an APK directly or through F-Droid.
  • Don’t forget to close the origin to non-Cloudflare addresses (IP ranges, Authenticated Origin Pulls).
  • If your host responds with the same content to a direct-IP request, an attacker can find it by brute-forcing the whole IPv4 space.

Related