10 ms·

China Tells Carriers to Block Access to Personal VPNs by February

152 points by valentinebm 9y ago

greggman 9y ago
not being a network guru how easy is this? I have my VPN set to run over port 443 but I assume it would be easy to see enough of the traffic to see it's a VPN and not an HTTPS connection. I'm assuming that could be obscured in some way but then I've heard even if you can't see the contents you can generally tell it's not HTTPS by looking at the traffic patterns?
- vanous 9y ago
  Yes, deep packet inspection with ML, read for example here [1] [1] http://blog.zorinaq.com/my-experience-with-the-great-firewall-of-china/ http://blog.zorinaq.com/my-experience-with-the-great-firewal...
  - lngnmn 9y ago
    DPS will give you nice and beautifully encrypted payloads. Now what? Emulating a standard browser TLS handshake is a no-brainer.
    - kbaker 9y ago
      The Great Firewall blocks these no problem, not sure if you realize the scale of who and what you are dealing with. There are enough side channels leaked trying to proxy an Internet connection through an encrypted tunnel, this is picked up on through Machine Learning or otherwise and it pretty effectively blocks many forms of escape. Read the parent article, let it soak in, and come back. And from TFA, it looks like whatever China can't block through technology, they are blocking through politics.
    - cameldrv 9y ago
      The handshake is only one of the many giveaways of a VPN connection. A single HTTPS connection has a certain normal pattern of traffic that is very different from a VPN connection. VPN connections often persist, with bursts of activity as pages are loaded. Even if you repeatedly put up and tear down the VPN connection, you're exchanging large amounts of traffic with a single IP address, which is not typical of normal web browsing behavior. If you can see all of the traffic going in and out of China, you can easily tell which IP addresses and/or ranges host VPN servers. There are many, many features which you can put into an ML model that will identify users that are using VPNs just based on IP headers. Will it block 100% with no false positives? No. However, they can simply set the penalty to be not being able to connect to outside-China IP addresses for half an hour if they detect VPN usage. After tripping this a certain number of times, you get a letter, and then eventually someone pays you a visit. If for some reason this doesn't work, they'll just require everyone to install their MITM root certificate to use the internet like lots of corporations do. Will some people find ways around it? Yes. However, it will be risky, and if any given technique becomes widespread, they will find a way to block it.
      - lngnmn 9y ago
        There are lots of corporate VPNs and RPCs. Blocking of these will result in a disaster. So, just mimic, say, one of hundreds Microsoft Windows 10 user data collecting services. AWS traffic also never will be blocked. Notice that a selective blocking is not the same as real-time https inspection and filtering, which is an intractable task.
      - tankenmate 9y ago
        http://ipop-project.org/ http://ipop-project.org/
- deleted 9y ago
  [deleted]
- wolfgang42 9y ago
  You can make it more difficult, but short of actually disconnecting China's network from the rest of the Internet entirely I don't think there's any way to completely prevent it. I had a run-in with a particularly aggressive captive portal last week that kept injecting ads into unencrypted pages (if I'm traveling on one of your vehicles, I don't want to buy tickets to travel with you), but fortunately didn't firewall outgoing port 22 so I could use sshuttle to route 0.0.0.0/0 via an SSH connection to my personal server. This works with pretty much any server you can run Python on, so I don't know of a good way to stop it unless you're willing to block anyone from SSHing outside of the country (thus preventing e. g. Chinese companies with a global market from running servers in other countries).
  - d-sc 9y ago
    China could simply require business that use ssh to register and/or ssh through one of their firewall servers.
  - greglindahl 9y ago
    ssh sessions reveal enough that an interactive session, a file transfer (scp), and sshuttle routing someone web browsing look quite different from one another. Sure, you can multiplex and throw in extra traffic, but it's not trivial.
  - baybal2 9y ago
    They do block SSH at random. Having it on port other than 22 helps some times.
lngnmn 9y ago
Time to get funds for 443 port vpn startups. ;) Hint: TLS encrypted traffic following an appropriate browser-style handshake cannot be distinguished from "legitimate" https.
- kbaker 9y ago
  Yes, it can. By watching the size and timing of flows with 'regular HTTPS' traffic vs 'VPN HTTPS' traffic, it can be distinguished.
  - schlipity 9y ago
    If you can calculate the difference, couldn't a VPN force their traffic to mimic that difference as well?
    - Dylan16807 9y ago
      You can't disguise an elephant as a mouse.
      - someonewhocar3s 9y ago
        Imitate an encrypted video link? Without crypto there's stenography. As long as there is a legitimate data format there must be a way to emulate it. The question isn't really if that's at all possible. The question is if you'd be willing to take the chance if the (fear of) retribution is great. And even if you or someone still circumvents the GFW, it achieves its purpose of guiding the spirit of the people. We should primarily cross our fingers, and hope the Chinese turn their collective spirit to global liberty and prosperity. At least, I'm in no position to affect them.
  - Ajedi32 9y ago
    So write a program that emulates 'regular HTTPS' traffic patterns. On the technical side of things, I'm pretty sure the VPNs have the upper hand in this game of cat and mouse.
tondoter 9y ago
This is a sure sign that China is one black swan event away from an economic collapse and possible Arab spring. Between the 300%+ gdp/debt ratio, stalled stock market, complete frozen capital control, second real estate bubble bursting in shanghai/tier1 cities, huge spike in shadow lending, Trump's 100 day ultimatum to China regarding trade deficit, demographics crisis, NK situation, south asia island situation, Foreign Direct Investments leaving China, protectionisms against China in europe/US/Japan, etc. The authoritarian Chinese government is starting to have some sense of fear now.
EZ-E 9y ago
With China, there is a big difference between what is said, what is law and what is actually enforced. What's likely to happen is that there will be a crack down, some satisfying numbers will be shown to officials, and then everything will become back to normal soon after. There has been this kind of talk about cracking down on VPN before, and it's still available, so wait and see
- cctan 9y ago
  I have a hunch that these kind of news had been circulated before, officials threw a few sacrificial lambs in to reach the quota, then the headlines fade slowly into background.
- deleted 9y ago
  [deleted]
- b9599b93b5 9y ago
  I think they are getting really serious this time... Just last year, out of the blue, Xi Jinping replaced the director of the Cyberspace Administration of China with a new guy named Xu Lin (which could be deemed as some sign that Xi Jinping really cares about the functioning of this department). Xu Lin has been staying pretty quietly during the past year, contrary to the flamboyant style of his predecessor...If someone is quiet and still able to stay in his position, especially a position that is concerned by a autocratic leader, then that usually indicates that he has been doing something concrete and not just putting up a show... In the past, although there had been a lot of talks about regulating (not indiscriminately shutting down, but regulating) VPNs in China, but technically, they still did not have the capability of achieving that goal without shutting down many business at that time. Recently, China started to enforce new cyber security rules (and laws) which, as we could see from the following instance (see [1]), requires firms operating in China, for their communication devices and software, to: * have regulator backdoor * use domestic encryption technology ... After those measures took effect, those companies, if they are still willing to operate in China, could still do their business as long as they are willing to register with the government and let the government monitor their data...And for those data channels which the government could not monitor and figure out its content, then they could easily detect them and shut them down... My guess is, the communist regime starts to realize that it is really important for them to control the information flow in the country in a way that is firm and concrete...And by observing their North Korean neighbor (as well as the Arabian revolts in the past decade), they understand that as long as they could control their people's mind and disrupt the natural synchronization in the society, they could have an ever lasting rule even there is another great famine or some serious crisis -- and otherwise, even if their people could enjoy a certain share of economic prosperity, the government could be overthrown sooner or later as long as there are continuous occurrences of triggering events, which would be inevitable given the practical difficulty and unscalability of managing a society of one and half billion people with a centralized administration, and given the fact that many officials in the current government are really corrupt, unscrupulous and have a fairly low respect for normal humanity (for the long dehumanization tradition of the communism) at this time... -- [1] http://knowledge.freshfields.com/zh/China/r/1514/china_introduces_comprehensive_new_cyber_security_rules http://knowledge.freshfields.com/zh/China/r/1514/china_intro...
powstudio 9y ago
China is one black swan event away from an economic collapse and possible Arab spring. The authoritarian Chinese government is starting to have some sense of fear now. Between the 300%+ gdp/debt ratio, second real estate bubble bursting in shanghai/tier1 cities, huge spike in shadow lending, stalled stock market, complete frozen capital control, Trump's 100 day ultimatum to China regarding trade deficit, demographics crisis, NK situation, south asia island situation, protectionisms against China in europe/US/Japan, Foreign Direct Investments leaving China, etc.
- contingencies 9y ago
  The preconditions of revolution exist in the UK, and most western countries. The number of active pre-conditions is quite stunning, from elite isolation to concentrated wealth to inadequate socialisation and education, to concentrated land holdings to loss of authority to repression of new technologies especially in relation to energy, to the atrophy of the public sector and spread of corruption, to media dishonesty, to mass unemployment of young men and on and on and on. [...] Preconditions are not the same as precipitants. We are waiting for our Tunisian fruit seller. The public will endure great repression, especially when most media outlets and schools are actively aiding the repressive meme of 'you are helpless, this is the order of things.' When we have a scandal so powerful that it cannot be ignored by the average Briton or American, we will have a revolution that overturns the corrupt political systems in both countries, and perhaps puts many banks out of business. Vaclav Havel calls this 'The Power of the Powerless.' One spark, one massive fire. - Robert David Steele, ex-Marine, ex-CIA, Open Source Intelligence Expert in The Guardian, 2014-06-19 ... from my fortune DB @ https://github.com/globalcitizen/taoup https://github.com/globalcitizen/taoup
  - bovitclan 9y ago
    Robert David Steele has interesting things to say about OSINT, but one must take him with an entire cow lick of salt. After getting interested in his ideas and watching several interviews with him, I was very disappointed. His personal narrative is exaggerated; he advocates conspiracy theories that are popular but ridiculous; he shows a certain arrogance. He looks & quacks like an aggressive self promoter without much substance to offer. This man has claimed to be the father of OSINT one day, and said that Pizzagate was spot-on the next. No one with a clue about how to conduct an investigation should have swallowed that. That is all to say, I believe we are in very troubled times, but I don't believe we are on the verge of revolution.
iliketosleep 9y ago
Previously, there was an implicit understanding that the Great Firewall was in place to prevent unauthorised access to the Internet by the masses. This is to prevent them from being influenced by foreign media, prevent too much information leakage of citizen info (e.g. via facebook), and to give Chinese tech companies a monopoly in China. If, however, you had the will and ability to use VPN software, the government usually turned a blind eye. Afterall, it was only a minority of people and they usually had a genuine need. In fact, this is what made staying in China tolerable. If this block does truly come into effect, they are essentially closing the door to the outside world. China was a country of reasonable compromises before, but with Xi Jinping's nationalism, they are starting to think "why should we compromise at all?"
- seanmcdirmid 9y ago
  That was never the official or even the implicit position. There has always been a war with VPNs, want VPNs work and don't can change monthly, and it's been like that for the last 10 years. Xi's nationalism is nothing new here, they just think that the tech is good enough to cut off VPNS for good now. China has been trying to close their internet since after the Olympics. It isn't surprising that they would eventually succeed at it.
  - imron 9y ago
    Since well before the Olympics actually. I was in China when 9/11 happened and for a brief period of time they opened access to a large number of previously blocked foreign news sites so that people could read what was happening.
    - l5870uoo9y 9y ago
      The have periodically been discussions about "opening up" in China. Fore-instance the party where split in the decision to crack down on the Falun Gong movement who also included many party members. Likewise were there some opposition to the violent crack down on Tiananmen square. Hardliners seems to win.
honestoHeminway 9y ago
Time for a meshnet that smuggles data on peoples devices. At least then the censorship gets more visiblity, with every phone searched at the airport. And if you add a bonus-kharma system + annoymous payments for smuggling..
larrysalibra 9y ago
The same state-owned Chinese carriers will sell you products in Hong Kong that when used in mainland China let you circumvent the great firewall. https://www.larrysalibra.com/hop-over-the-great-firewall-with-government-help/ https://www.larrysalibra.com/hop-over-the-great-firewall-wit... The regular crackdowns on VPNs mean that many who live in the region long since stopped using them and switched to a mobile plan or prepaid sim from China Mobile Hong Kong or Hong Kong Unicom that provides a Hong Kong IP address and unfiltered internet while roaming in the mainland.
- gcb0 9y ago
  but the regular Chinese cant easily take the train to Hong Kong.
chairmanwow 9y ago
From my experience in China, it seems that the vast majority of Chinese citizens have no idea what a VPN is and or why they would use it. Friends of mine that are Chinese citizens that study abroad in the US make extensive use of VPNs to circumvent the GFW. Every technology company that I've come across in China has invested a great deal of effort into establishing stable VPN connections. I have seen several "VPN microservices" that act to tunnel all foreign-bound traffic out of the country. In the vacuum of mature, western technologies many Chinese copycats have popped up. I have been hoping that we would start to see more and more Chinese technology companies exporting their technology [1]. With these new legislative actions, it seems like a step in the wrong direction. I'm struggling to come to terms with the restrictive policies that the Chinese government continually struggles to hoist over their citizens. During the midst of one of the most dramatic periods of economic development in history, the Chinese government is moving to artificial isolate themselves from the developing global economy? [1] Strikingly: https://www.crunchbase.com/organization/striking-ly#/entity https://www.crunchbase.com/organization/striking-ly#/entity
- duncan_bayne 9y ago
  This isn't the first time, either. https://history.stackexchange.com/questions/663/why-did-china-shut-itself-out-of-the-world-in-the-15th-century https://history.stackexchange.com/questions/663/why-did-chin...
  - dis-sys 9y ago
    it is completely different, in the 15th Century, the Haijin policy was used to stop "barbarians" from flooding the country. there is nothing to gain from trading with the rest of the world because the country was ranked No.1 in the world in almost all metrics. today's GFW is to protect a young but fast growing industry - because the overall economy is not that strong.
    - barry-cotter 9y ago
      https://en.wikipedia.org/wiki/Comparative_advantage https://en.wikipedia.org/wiki/Comparative_advantage The rest of the world totally did have things the Chinese wanted, silver and gold. Not much else at that stage to be fair but China was sucking precious metals from Western Eurasia for most of the first and second millenia.
bitcharmer 9y ago
The way things are going I'm expecting to see the same initiative in the UK or Germany sooner than you think. That will stop them evil terrorists.
- CamperBob2 9y ago
  A strange thing to downvote, considering that the UK government has basically promised exactly this sort of measure.
  - topranks 9y ago
    Yep. Banning the use of strong encryption (introducing penalties for it,) is the logical conclusion of what Theresa May has said she wants to do.
    - CamperBob2 9y ago
      Yes, it absolutely is. Outlawing private communications between citizens (or subjects, in the UK's case) is not the first step down this particular slippery slope, it's well past the halfway point. I recommend watching a movie called The Lives of Others, to those who don't understand or agree. It should be available on either Netflix or Amazon, or if all else fails, the Pirate Bay.
reustle 9y ago
I'm headed to china next week for a few weeks. I need access to at least Gmail. Are there any suggestions here on an easy way to get around it for a VPN noob? I'm usually fine using PrivateInternetAccess but I'm sure that is blocked there.
- b9599b93b5 9y ago
  If you are working for an international company there and will be using your company's network (through VPN or a physical port), then you should be fine -- according to a friend of mine who worked in one of those companies...
- tluyben2 9y ago
  VPNs still work; ExpressVPN gives good results. Although I usually just forward gmail to outlook for the time being and will just use that for the weeks I am there.
  - yorwba 9y ago
    FWIW, I have been able to access imap.googlemail.com from all Chinese networks I have tried so far. However, the first few times, Google blocked the attempt and I had to use a VPN to log into my Google account and whitelist the access. This highlights another issue that makes internet access in China inconvenient: Many websites flag Chinese IP addresses by default, presumably because they couldn't handle the spam otherwise.
  - baybal2 9y ago
    The thing is that they block Gmail MX from time to time. Don't use google mail for work there
    - tluyben2 9y ago
      No I forward all to Outlook.com and send from there as well. Sucks but works.
- Canada 9y ago
andy_ppp 9y ago
So what we need is a VPN that looks like https traffic or is https forbidden in China too? Is anyone working on this? After a quick read it's apparent that even the most sophisticated defences are going to be open to the one endpoint having loads of data against it. It would need lots of different "real" IP connections and my guess peer to peer would be difficult too. Statistics and machine learning will always be good enough to evade attempts I can think of here.
- sasas 9y ago
  A few VPN providers offer this, I.e torguard's stealth VPN option. https://torguard.net/stealth-vpn.php https://torguard.net/stealth-vpn.php
- netsharc 9y ago
  Life finds a way? I could encode 0 to "duck" and 1 to "cat" and I can tell you "duck duck cat duck, cat duck duck cat" and that's 0010 1001, i.e. the letter I. Obviously it need to be more sophisticated than this. Then, you can use the channels that no one's looking at, but I guess China is looking everywhere.
  - andy_ppp 9y ago
    That's fine but still most of your traffic will go to a single endpoint. It'd be easy to analyse patterns in most surfing protection solutions...
- 77pt77 9y ago
  > So what we need is a VPN that looks like https traffic or is https forbidden in China too? An https proxy would work for that. This is all academic because blocking VPN traffic is simple. See a lot of traffic to the same ip? If yes, then block.
pmlnr 9y ago
ssh -D8888 - SOCKS proxy port 8888. SSH is not VPN ;)
ajeet_dhaliwal 9y ago
Expats/foreigners/immigrants make heavy use of VPNs according to friends I have. I don't live in China but if I did and this was successful this would be a serious reason to consider leaving for me, access to the internet and www is just too important nowadays.
baybal2 9y ago
Currently, https tunnels with replay attack protection hold strong. UDP VPNs do fail at random right now, I guess GFW people arrived at the point when they can't do anything about obfuscated and replay attack protected endpoints other than blocking all UDP traffic at random
geff82 9y ago
You should not deal with censorshipping countries. Period. That's a dead end road. If you are Chinese - fight for your natural rights. If you are a foreigner: let them alone and try to do business with countries that provide more freedom or that are at least on the right track (I fully understand that not every country is equal or values freedom equally - but at least they should move in the right direction).
- gcb0 9y ago
  this mostly correct. gotta love when people don't say this about china right away here, but talk about building your product inside a platform owned by fb or apple and you get the warnings instantly. also, this is a good time to remember everyone to at least run a 1mbps tor node at home. costs nothing.

152 points by valentinebm 9y ago

not being a network guru how easy is this? I have my VPN set to run over port 443 but I assume it would be easy to see enough of the traffic to see it's a VPN and not an HTTPS connection. I'm assuming that could be obscured in some way but then I've heard even if you can't see the contents you can generally tell it's not HTTPS by looking at the traffic patterns?

vanous 9y ago
Yes, deep packet inspection with ML, read for example here [1] [1] http://blog.zorinaq.com/my-experience-with-the-great-firewall-of-china/ http://blog.zorinaq.com/my-experience-with-the-great-firewal...
- lngnmn 9y ago
  DPS will give you nice and beautifully encrypted payloads. Now what? Emulating a standard browser TLS handshake is a no-brainer.
  - kbaker 9y ago
    The Great Firewall blocks these no problem, not sure if you realize the scale of who and what you are dealing with. There are enough side channels leaked trying to proxy an Internet connection through an encrypted tunnel, this is picked up on through Machine Learning or otherwise and it pretty effectively blocks many forms of escape. Read the parent article, let it soak in, and come back. And from TFA, it looks like whatever China can't block through technology, they are blocking through politics.
  - cameldrv 9y ago
    The handshake is only one of the many giveaways of a VPN connection. A single HTTPS connection has a certain normal pattern of traffic that is very different from a VPN connection. VPN connections often persist, with bursts of activity as pages are loaded. Even if you repeatedly put up and tear down the VPN connection, you're exchanging large amounts of traffic with a single IP address, which is not typical of normal web browsing behavior. If you can see all of the traffic going in and out of China, you can easily tell which IP addresses and/or ranges host VPN servers. There are many, many features which you can put into an ML model that will identify users that are using VPNs just based on IP headers. Will it block 100% with no false positives? No. However, they can simply set the penalty to be not being able to connect to outside-China IP addresses for half an hour if they detect VPN usage. After tripping this a certain number of times, you get a letter, and then eventually someone pays you a visit. If for some reason this doesn't work, they'll just require everyone to install their MITM root certificate to use the internet like lots of corporations do. Will some people find ways around it? Yes. However, it will be risky, and if any given technique becomes widespread, they will find a way to block it.
    - lngnmn 9y ago
      There are lots of corporate VPNs and RPCs. Blocking of these will result in a disaster. So, just mimic, say, one of hundreds Microsoft Windows 10 user data collecting services. AWS traffic also never will be blocked. Notice that a selective blocking is not the same as real-time https inspection and filtering, which is an intractable task.
    - tankenmate 9y ago
      http://ipop-project.org/ http://ipop-project.org/
deleted 9y ago
[deleted]
wolfgang42 9y ago
You can make it more difficult, but short of actually disconnecting China's network from the rest of the Internet entirely I don't think there's any way to completely prevent it. I had a run-in with a particularly aggressive captive portal last week that kept injecting ads into unencrypted pages (if I'm traveling on one of your vehicles, I don't want to buy tickets to travel with you), but fortunately didn't firewall outgoing port 22 so I could use sshuttle to route 0.0.0.0/0 via an SSH connection to my personal server. This works with pretty much any server you can run Python on, so I don't know of a good way to stop it unless you're willing to block anyone from SSHing outside of the country (thus preventing e. g. Chinese companies with a global market from running servers in other countries).
- d-sc 9y ago
  China could simply require business that use ssh to register and/or ssh through one of their firewall servers.
- greglindahl 9y ago
  ssh sessions reveal enough that an interactive session, a file transfer (scp), and sshuttle routing someone web browsing look quite different from one another. Sure, you can multiplex and throw in extra traffic, but it's not trivial.
- baybal2 9y ago
  They do block SSH at random. Having it on port other than 22 helps some times.

lngnmn 9y ago

Time to get funds for 443 port vpn startups. ;) Hint: TLS encrypted traffic following an appropriate browser-style handshake cannot be distinguished from "legitimate" https.

kbaker 9y ago
Yes, it can. By watching the size and timing of flows with 'regular HTTPS' traffic vs 'VPN HTTPS' traffic, it can be distinguished.
- schlipity 9y ago
  If you can calculate the difference, couldn't a VPN force their traffic to mimic that difference as well?
  - Dylan16807 9y ago
    You can't disguise an elephant as a mouse.
    - someonewhocar3s 9y ago
      Imitate an encrypted video link? Without crypto there's stenography. As long as there is a legitimate data format there must be a way to emulate it. The question isn't really if that's at all possible. The question is if you'd be willing to take the chance if the (fear of) retribution is great. And even if you or someone still circumvents the GFW, it achieves its purpose of guiding the spirit of the people. We should primarily cross our fingers, and hope the Chinese turn their collective spirit to global liberty and prosperity. At least, I'm in no position to affect them.
- Ajedi32 9y ago
  So write a program that emulates 'regular HTTPS' traffic patterns. On the technical side of things, I'm pretty sure the VPNs have the upper hand in this game of cat and mouse.

tondoter 9y ago

This is a sure sign that China is one black swan event away from an economic collapse and possible Arab spring. Between the 300%+ gdp/debt ratio, stalled stock market, complete frozen capital control, second real estate bubble bursting in shanghai/tier1 cities, huge spike in shadow lending, Trump's 100 day ultimatum to China regarding trade deficit, demographics crisis, NK situation, south asia island situation, Foreign Direct Investments leaving China, protectionisms against China in europe/US/Japan, etc. The authoritarian Chinese government is starting to have some sense of fear now.

EZ-E 9y ago

With China, there is a big difference between what is said, what is law and what is actually enforced. What's likely to happen is that there will be a crack down, some satisfying numbers will be shown to officials, and then everything will become back to normal soon after. There has been this kind of talk about cracking down on VPN before, and it's still available, so wait and see

cctan 9y ago
I have a hunch that these kind of news had been circulated before, officials threw a few sacrificial lambs in to reach the quota, then the headlines fade slowly into background.
deleted 9y ago
[deleted]
b9599b93b5 9y ago
I think they are getting really serious this time... Just last year, out of the blue, Xi Jinping replaced the director of the Cyberspace Administration of China with a new guy named Xu Lin (which could be deemed as some sign that Xi Jinping really cares about the functioning of this department). Xu Lin has been staying pretty quietly during the past year, contrary to the flamboyant style of his predecessor...If someone is quiet and still able to stay in his position, especially a position that is concerned by a autocratic leader, then that usually indicates that he has been doing something concrete and not just putting up a show... In the past, although there had been a lot of talks about regulating (not indiscriminately shutting down, but regulating) VPNs in China, but technically, they still did not have the capability of achieving that goal without shutting down many business at that time. Recently, China started to enforce new cyber security rules (and laws) which, as we could see from the following instance (see [1]), requires firms operating in China, for their communication devices and software, to: * have regulator backdoor * use domestic encryption technology ... After those measures took effect, those companies, if they are still willing to operate in China, could still do their business as long as they are willing to register with the government and let the government monitor their data...And for those data channels which the government could not monitor and figure out its content, then they could easily detect them and shut them down... My guess is, the communist regime starts to realize that it is really important for them to control the information flow in the country in a way that is firm and concrete...And by observing their North Korean neighbor (as well as the Arabian revolts in the past decade), they understand that as long as they could control their people's mind and disrupt the natural synchronization in the society, they could have an ever lasting rule even there is another great famine or some serious crisis -- and otherwise, even if their people could enjoy a certain share of economic prosperity, the government could be overthrown sooner or later as long as there are continuous occurrences of triggering events, which would be inevitable given the practical difficulty and unscalability of managing a society of one and half billion people with a centralized administration, and given the fact that many officials in the current government are really corrupt, unscrupulous and have a fairly low respect for normal humanity (for the long dehumanization tradition of the communism) at this time... -- [1] http://knowledge.freshfields.com/zh/China/r/1514/china_introduces_comprehensive_new_cyber_security_rules http://knowledge.freshfields.com/zh/China/r/1514/china_intro...

powstudio 9y ago

China is one black swan event away from an economic collapse and possible Arab spring. The authoritarian Chinese government is starting to have some sense of fear now. Between the 300%+ gdp/debt ratio, second real estate bubble bursting in shanghai/tier1 cities, huge spike in shadow lending, stalled stock market, complete frozen capital control, Trump's 100 day ultimatum to China regarding trade deficit, demographics crisis, NK situation, south asia island situation, protectionisms against China in europe/US/Japan, Foreign Direct Investments leaving China, etc.

contingencies 9y ago
The preconditions of revolution exist in the UK, and most western countries. The number of active pre-conditions is quite stunning, from elite isolation to concentrated wealth to inadequate socialisation and education, to concentrated land holdings to loss of authority to repression of new technologies especially in relation to energy, to the atrophy of the public sector and spread of corruption, to media dishonesty, to mass unemployment of young men and on and on and on. [...] Preconditions are not the same as precipitants. We are waiting for our Tunisian fruit seller. The public will endure great repression, especially when most media outlets and schools are actively aiding the repressive meme of 'you are helpless, this is the order of things.' When we have a scandal so powerful that it cannot be ignored by the average Briton or American, we will have a revolution that overturns the corrupt political systems in both countries, and perhaps puts many banks out of business. Vaclav Havel calls this 'The Power of the Powerless.' One spark, one massive fire. - Robert David Steele, ex-Marine, ex-CIA, Open Source Intelligence Expert in The Guardian, 2014-06-19 ... from my fortune DB @ https://github.com/globalcitizen/taoup https://github.com/globalcitizen/taoup
- bovitclan 9y ago
  Robert David Steele has interesting things to say about OSINT, but one must take him with an entire cow lick of salt. After getting interested in his ideas and watching several interviews with him, I was very disappointed. His personal narrative is exaggerated; he advocates conspiracy theories that are popular but ridiculous; he shows a certain arrogance. He looks & quacks like an aggressive self promoter without much substance to offer. This man has claimed to be the father of OSINT one day, and said that Pizzagate was spot-on the next. No one with a clue about how to conduct an investigation should have swallowed that. That is all to say, I believe we are in very troubled times, but I don't believe we are on the verge of revolution.

iliketosleep 9y ago

Previously, there was an implicit understanding that the Great Firewall was in place to prevent unauthorised access to the Internet by the masses. This is to prevent them from being influenced by foreign media, prevent too much information leakage of citizen info (e.g. via facebook), and to give Chinese tech companies a monopoly in China. If, however, you had the will and ability to use VPN software, the government usually turned a blind eye. Afterall, it was only a minority of people and they usually had a genuine need. In fact, this is what made staying in China tolerable. If this block does truly come into effect, they are essentially closing the door to the outside world. China was a country of reasonable compromises before, but with Xi Jinping's nationalism, they are starting to think "why should we compromise at all?"

seanmcdirmid 9y ago
That was never the official or even the implicit position. There has always been a war with VPNs, want VPNs work and don't can change monthly, and it's been like that for the last 10 years. Xi's nationalism is nothing new here, they just think that the tech is good enough to cut off VPNS for good now. China has been trying to close their internet since after the Olympics. It isn't surprising that they would eventually succeed at it.
- imron 9y ago
  Since well before the Olympics actually. I was in China when 9/11 happened and for a brief period of time they opened access to a large number of previously blocked foreign news sites so that people could read what was happening.
  - l5870uoo9y 9y ago
    The have periodically been discussions about "opening up" in China. Fore-instance the party where split in the decision to crack down on the Falun Gong movement who also included many party members. Likewise were there some opposition to the violent crack down on Tiananmen square. Hardliners seems to win.

honestoHeminway 9y ago

Time for a meshnet that smuggles data on peoples devices. At least then the censorship gets more visiblity, with every phone searched at the airport. And if you add a bonus-kharma system + annoymous payments for smuggling..

larrysalibra 9y ago

The same state-owned Chinese carriers will sell you products in Hong Kong that when used in mainland China let you circumvent the great firewall. https://www.larrysalibra.com/hop-over-the-great-firewall-with-government-help/ https://www.larrysalibra.com/hop-over-the-great-firewall-wit... The regular crackdowns on VPNs mean that many who live in the region long since stopped using them and switched to a mobile plan or prepaid sim from China Mobile Hong Kong or Hong Kong Unicom that provides a Hong Kong IP address and unfiltered internet while roaming in the mainland.

gcb0 9y ago
but the regular Chinese cant easily take the train to Hong Kong.

chairmanwow 9y ago

From my experience in China, it seems that the vast majority of Chinese citizens have no idea what a VPN is and or why they would use it. Friends of mine that are Chinese citizens that study abroad in the US make extensive use of VPNs to circumvent the GFW. Every technology company that I've come across in China has invested a great deal of effort into establishing stable VPN connections. I have seen several "VPN microservices" that act to tunnel all foreign-bound traffic out of the country. In the vacuum of mature, western technologies many Chinese copycats have popped up. I have been hoping that we would start to see more and more Chinese technology companies exporting their technology [1]. With these new legislative actions, it seems like a step in the wrong direction. I'm struggling to come to terms with the restrictive policies that the Chinese government continually struggles to hoist over their citizens. During the midst of one of the most dramatic periods of economic development in history, the Chinese government is moving to artificial isolate themselves from the developing global economy? [1] Strikingly: https://www.crunchbase.com/organization/striking-ly#/entity https://www.crunchbase.com/organization/striking-ly#/entity

duncan_bayne 9y ago
This isn't the first time, either. https://history.stackexchange.com/questions/663/why-did-china-shut-itself-out-of-the-world-in-the-15th-century https://history.stackexchange.com/questions/663/why-did-chin...
- dis-sys 9y ago
  it is completely different, in the 15th Century, the Haijin policy was used to stop "barbarians" from flooding the country. there is nothing to gain from trading with the rest of the world because the country was ranked No.1 in the world in almost all metrics. today's GFW is to protect a young but fast growing industry - because the overall economy is not that strong.
  - barry-cotter 9y ago
    https://en.wikipedia.org/wiki/Comparative_advantage https://en.wikipedia.org/wiki/Comparative_advantage The rest of the world totally did have things the Chinese wanted, silver and gold. Not much else at that stage to be fair but China was sucking precious metals from Western Eurasia for most of the first and second millenia.

bitcharmer 9y ago

The way things are going I'm expecting to see the same initiative in the UK or Germany sooner than you think. That will stop them evil terrorists.

CamperBob2 9y ago
A strange thing to downvote, considering that the UK government has basically promised exactly this sort of measure.
- topranks 9y ago
  Yep. Banning the use of strong encryption (introducing penalties for it,) is the logical conclusion of what Theresa May has said she wants to do.
  - CamperBob2 9y ago
    Yes, it absolutely is. Outlawing private communications between citizens (or subjects, in the UK's case) is not the first step down this particular slippery slope, it's well past the halfway point. I recommend watching a movie called The Lives of Others, to those who don't understand or agree. It should be available on either Netflix or Amazon, or if all else fails, the Pirate Bay.

reustle 9y ago

I'm headed to china next week for a few weeks. I need access to at least Gmail. Are there any suggestions here on an easy way to get around it for a VPN noob? I'm usually fine using PrivateInternetAccess but I'm sure that is blocked there.

b9599b93b5 9y ago
If you are working for an international company there and will be using your company's network (through VPN or a physical port), then you should be fine -- according to a friend of mine who worked in one of those companies...
tluyben2 9y ago
VPNs still work; ExpressVPN gives good results. Although I usually just forward gmail to outlook for the time being and will just use that for the weeks I am there.
- yorwba 9y ago
  FWIW, I have been able to access imap.googlemail.com from all Chinese networks I have tried so far. However, the first few times, Google blocked the attempt and I had to use a VPN to log into my Google account and whitelist the access. This highlights another issue that makes internet access in China inconvenient: Many websites flag Chinese IP addresses by default, presumably because they couldn't handle the spam otherwise.
- baybal2 9y ago
  The thing is that they block Gmail MX from time to time. Don't use google mail for work there
  - tluyben2 9y ago
    No I forward all to Outlook.com and send from there as well. Sucks but works.
Canada 9y ago

andy_ppp 9y ago

So what we need is a VPN that looks like https traffic or is https forbidden in China too? Is anyone working on this? After a quick read it's apparent that even the most sophisticated defences are going to be open to the one endpoint having loads of data against it. It would need lots of different "real" IP connections and my guess peer to peer would be difficult too. Statistics and machine learning will always be good enough to evade attempts I can think of here.

sasas 9y ago
A few VPN providers offer this, I.e torguard's stealth VPN option. https://torguard.net/stealth-vpn.php https://torguard.net/stealth-vpn.php
netsharc 9y ago
Life finds a way? I could encode 0 to "duck" and 1 to "cat" and I can tell you "duck duck cat duck, cat duck duck cat" and that's 0010 1001, i.e. the letter I. Obviously it need to be more sophisticated than this. Then, you can use the channels that no one's looking at, but I guess China is looking everywhere.
- andy_ppp 9y ago
  That's fine but still most of your traffic will go to a single endpoint. It'd be easy to analyse patterns in most surfing protection solutions...
77pt77 9y ago
> So what we need is a VPN that looks like https traffic or is https forbidden in China too? An https proxy would work for that. This is all academic because blocking VPN traffic is simple. See a lot of traffic to the same ip? If yes, then block.

pmlnr 9y ago

ssh -D8888 - SOCKS proxy port 8888. SSH is not VPN ;)

ajeet_dhaliwal 9y ago

Expats/foreigners/immigrants make heavy use of VPNs according to friends I have. I don't live in China but if I did and this was successful this would be a serious reason to consider leaving for me, access to the internet and www is just too important nowadays.

baybal2 9y ago

Currently, https tunnels with replay attack protection hold strong. UDP VPNs do fail at random right now, I guess GFW people arrived at the point when they can't do anything about obfuscated and replay attack protected endpoints other than blocking all UDP traffic at random

geff82 9y ago

You should not deal with censorshipping countries. Period. That's a dead end road. If you are Chinese - fight for your natural rights. If you are a foreigner: let them alone and try to do business with countries that provide more freedom or that are at least on the right track (I fully understand that not every country is equal or values freedom equally - but at least they should move in the right direction).

gcb0 9y ago
this mostly correct. gotta love when people don't say this about china right away here, but talk about building your product inside a platform owned by fb or apple and you get the warnings instantly. also, this is a good time to remember everyone to at least run a 1mbps tor node at home. costs nothing.