Dynamic Sites on Yandex Cloud Storage Enable Communication Under White-List Restrictions

A developer published a detailed account of attempts to build encrypted communication channels that survive mobile internet white lists. The restrictions, enforced since February, block access to most external resources while allowing only approved domains.

Early experiments used a national messenger bot for key exchange and encrypted messaging. The approach collapsed after the bot token was stolen the day after registration and the messenger’s API proved inadequate for protecting credentials.

The problem was then reframed as the “three neighbors” scenario: Alice and Bob on adjacent plots must route messages through Eve because direct paths are slower, yet Eve may refuse certain parcel types. This mirrors how servers act as intermediaries in normal internet traffic.

Yandex Disk was evaluated as a transport layer because it accepts GET and POST requests directly from localhost pages. Although functional, the solution required authenticated Yandex accounts on both client and intermediary, reducing anonymity and increasing registration overhead.

In October the author discovered that Yandex Cloud object storage domains remained accessible under the same white lists. A test HTML file uploaded to the service loaded successfully on a restricted mobile connection, demonstrating that cloud storage buckets can host dynamic content without additional infrastructure.

The author invites further discussion on the practicality of the method and whether similar techniques could evolve into more robust circumvention tools.