5 ms·
Yes, it can. By watching the size and timing of flows with 'regular HTTPS' traffic vs 'VPN HTTPS' traffic, it can be distinguished.
by kbaker 9y ago
Yes, it can. By watching the size and timing of flows with 'regular HTTPS' traffic vs 'VPN HTTPS' traffic, it can be distinguished.
- schlipity 9y agoIf you can calculate the difference, couldn't a VPN force their traffic to mimic that difference as well?
- Dylan16807 9y agoYou can't disguise an elephant as a mouse.
- someonewhocar3s 9y agoImitate an encrypted video link? Without crypto there's stenography. As long as there is a legitimate data format there must be a way to emulate it. The question isn't really if that's at all possible. The question is if you'd be willing to take the chance if the (fear of) retribution is great. And even if you or someone still circumvents the GFW, it achieves its purpose of guiding the spirit of the people. We should primarily cross our fingers, and hope the Chinese turn their collective spirit to global liberty and prosperity. At least, I'm in no position to affect them.
- Ajedi32 9y agoSo write a program that emulates 'regular HTTPS' traffic patterns. On the technical side of things, I'm pretty sure the VPNs have the upper hand in this game of cat and mouse.
- dylz 9y agoGFW does not just inspect traffic, it actively probes server IP:ports looking for its responses, can replay packets you sent legitimately, and can impersonate IP addr behind GFW. As in, it is not only a passive observer periodically resetting connections, it will also make its own to test the waters
- ticoombs 9y agoI would love to see a write up about that. Got a source?
- jitl 9y agoHere's a few that I dug up from 15 mins of googling: - In-Depth Analysis of the Great Firewall of China. Has other good sources at the bottom: http://www.cs.tufts.edu/comp/116/archive/fall2016/ctang.pdf http://www.cs.tufts.edu/comp/116/archive/fall2016/ctang.pdf - How China is Blocking Tor: https://arxiv.org/abs/1204.0447 https://arxiv.org/abs/1204.0447 - Summary of "How China is Blocking Tor" from MIT Review: https://www.technologyreview.com/s/427413/how-china-blocks-the-tor-anonymity-network/ https://www.technologyreview.com/s/427413/how-china-blocks-t...
- dylz 9y agoSome fun reads https://www.cs.princeton.edu/~rensafi/projects/active-probing/imc2015.pdf https://www.cs.princeton.edu/~rensafi/projects/active-probin... https://citizenlab.ca/wp-content/uploads/2009/10/ChinasGreatCannon.pdf https://citizenlab.ca/wp-content/uploads/2009/10/ChinasGreat...
- vacri 9y ago"Interesting - this user is downloading gigs of data from a single IP over https, and zero data from anywhere else"
- 77pt77 9y agoThis is all it takes. No DPI needed. Until this is circumvented there is no real solution.
- ilikeATMs 9y agoStatistical analysis of traffic flow in encrypted communications to determine the type of traffic has been done effectively. There was a paper a few years ago against VoIP protocols specifically.
- lngnmn 9y agoIt should be https-inside-https (or http2 or even plain TLS) scheme for multiple AWS IPs. A bit laggy but will do the job. Wildcard blocking of these would break too many legitimate services, including banking, airlines, etc. BTW, the task of DPI-ing of all https traffic on the operator side is intractable.
- topranks 9y agoYeah, like the ToR "meek" obfuscation method does. https://trac.torproject.org/projects/tor/wiki/doc/meek https://trac.torproject.org/projects/tor/wiki/doc/meek