4 ms·

Waiting for the "can't stop me using VPNs L0Lz" comments.. VPN use for a free and open Internet is abnormal - not a long term solution to issues like censorshi

Waiting for the "can't stop me using VPNs L0Lz" comments.. VPN use for a free and open Internet is abnormal - not a long term solution to issues like censorship. They're already out of reach for normal users. Companies will offer better ways to block or detect usage for lucrative gov contracts. Simply making it illegal will detour most people. I don't understand why VPN crackdown is thought to be impossible. ISPs have a good idea of what normal traffic looks like and a very good map of the Internet. The Internet may be big. To an ISP, is it really that big? Netflix, Google, YouTube, Dropbox etc are normal. Your companies VPN IP are normal. That's unusual! Open connection to a DNS port? sending large amounts of data? its encrypted? No one has accessed that digital ocean IP before on this network! Lets throttle, interrupt it periodically or flag that user. Someone else sending large amounts data to a known VPN IP range? block, throttle, close connection, police knock on door etc. policy change, not more VPNs.

Kenji 9y ago
Exactly. It baffles me how people think political problems can be solved with technological workarounds. What's next, being gay is illegal again so "just hide your relationship lulz"? Sometimes, I feel like a part of the crowd here is like a bunch of toddlers who try to work around some rules the parents made and feel clever at the same time.
- deathhand 9y ago
  Ahem..You are talking to a bunch of technologists. Technologists who believe that technology can actually change the world. We can see tech's influence from Arab Spring[1] to Defcon's recent vandalism[2]. We make up the people pushing the buttons behind the scene. In the name of humanity I know I will try everything to keep the Internet free and open and I hope many like minded people will to. Free sharing of ideas is the best way for us to advance. This is why you and OP's comment are detracting and unproductive. We made this. We run the show. [1]https://www.researchgate.net/profile/Ghazali_Sulong/publication/234040341_The_Role_of_Modern_Technology_in_Arab_Spring/links/0fcfd50e7b3ecbdd28000000/The-Role-of-Modern-Technology-in-Arab-Spring.pdf https://www.researchgate.net/profile/Ghazali_Sulong/publicat... [2]https://www.cnet.com/news/everything-looks-like-a-hack-when-youre-paranoid-at-defcon/ https://www.cnet.com/news/everything-looks-like-a-hack-when-...
  - lawnchair_larry 9y ago
    That was not vandalism and had nothing to do with defcon. See the story you linked to.
- iovrthoughtthis 9y ago
  A responce to this by a barrister friend of mine. Re-phrased because I don't remember it verbatim: "We've only been trying technological solutions for the past hundred years and look at what they've achieved. We've been trying political solutions for thousands of years." Though, I agree that we need to be aware of the limitations we and our systems impose on technical solutions. That said, perhaps we should play to our strengths?
  - ernst_klim 9y ago
    >We've only been trying technological solutions for the past hundred years and look at what they've achieved Holocaust, Nazi Science, Atomic bombs, Stalin's industrialization, mass surveillance, cold war? Man, 20-th century was such a mess, technology only made that mess more messy, and good stuff was achieved by political discussion, dialog, not because of new technologies (although technologies makes both dialog and murdering much easier)
bdcravens 9y ago
Many websites block users of common VPNs.
politician 9y ago
We've known how to shape encrypted traffic to look like other media to prevent this sort of traffic analysis for at least 2 decades.
CaptSpify 9y ago
Why not both? We absolutely need policy change, but we also need to use and encourage tech that makes it impossible for bad policies to take these to gain a foothold.
Veratyr 9y ago
> Simply making it illegal will detour most people. Don't mean to be pedantic but I think you mean "deter". "Detour" = reroute, like "we're taking a detour to get some gas". "Deter" = Discourage, like "making something illegal deters law abiding citizens from doing it". > I don't understand why VPN crackdown is thought to be impossible. Because it's hard to distinguish VPN traffic from legitimate traffic and false positives will be extremely bad for the ISP. > Open connection to a DNS port? sending large amounts of data? its encrypted? No one has accessed that digital ocean IP before on this network! In order: Many VPNs will use standard HTTPs ports rather than DNS. There are numerous reasons to send large amounts of data, like backups. Encryption is quickly becoming the default, major video sites like YouTube and Netflix are encrypted for instance. Software developers are likely to access DigitalOcean IP addresses. I do believe that at ISP scale it's possible to identify VPNs though and the things you've mentioned could contribute to a heuristic algorithm. Some other things to add are the geographical diversity of the users accessing a server (legitimate video services will have PoPs near a user, so few will cross the country), the distribution of response times and sizes (a pure web server will have lots of small, ~100ms responses, a video server will have lots of infrequent very high bandwidth transfers) and if you can access it, the outgoing connections of the servers themselves (e.g. Cogent can tell that a server is generating user traffic rather than business traffic).
- codedokode 9y ago
  > Because it's hard to distinguish VPN traffic from legitimate traffic I don't think so. Chinese firewall can block VPN. For example, the easiest way to see if the user is using a VPN is to count a number of IP addresses they connect to. > and false positives will be extremely bad for the ISP. How exactly?
  - Veratyr 9y ago
    > I don't think so. Chinese firewall can block VPN. For example, the easiest way to see if the user is using a VPN is to count a number of IP addresses they connect to. China is a special case as unlike most other countries, all major ISPs are state owned. When you own every internet connection in the country, it's much easier to spot VPNs. When you're say Comcast, you only see the connections your customers make and accept, you can't see what VPN servers are doing. > How exactly? In countries other than China, where government control is less prevalent and the government is overtly democratic, false positives will result in anger in the populace, which will lead to the person implementing the policy losing power or at the very least, a degree of support.

Kenji 9y ago

Exactly. It baffles me how people think political problems can be solved with technological workarounds. What's next, being gay is illegal again so "just hide your relationship lulz"? Sometimes, I feel like a part of the crowd here is like a bunch of toddlers who try to work around some rules the parents made and feel clever at the same time.

deathhand 9y ago
Ahem..You are talking to a bunch of technologists. Technologists who believe that technology can actually change the world. We can see tech's influence from Arab Spring[1] to Defcon's recent vandalism[2]. We make up the people pushing the buttons behind the scene. In the name of humanity I know I will try everything to keep the Internet free and open and I hope many like minded people will to. Free sharing of ideas is the best way for us to advance. This is why you and OP's comment are detracting and unproductive. We made this. We run the show. [1]https://www.researchgate.net/profile/Ghazali_Sulong/publication/234040341_The_Role_of_Modern_Technology_in_Arab_Spring/links/0fcfd50e7b3ecbdd28000000/The-Role-of-Modern-Technology-in-Arab-Spring.pdf https://www.researchgate.net/profile/Ghazali_Sulong/publicat... [2]https://www.cnet.com/news/everything-looks-like-a-hack-when-youre-paranoid-at-defcon/ https://www.cnet.com/news/everything-looks-like-a-hack-when-...
- lawnchair_larry 9y ago
  That was not vandalism and had nothing to do with defcon. See the story you linked to.
iovrthoughtthis 9y ago
A responce to this by a barrister friend of mine. Re-phrased because I don't remember it verbatim: "We've only been trying technological solutions for the past hundred years and look at what they've achieved. We've been trying political solutions for thousands of years." Though, I agree that we need to be aware of the limitations we and our systems impose on technical solutions. That said, perhaps we should play to our strengths?
- ernst_klim 9y ago
  >We've only been trying technological solutions for the past hundred years and look at what they've achieved Holocaust, Nazi Science, Atomic bombs, Stalin's industrialization, mass surveillance, cold war? Man, 20-th century was such a mess, technology only made that mess more messy, and good stuff was achieved by political discussion, dialog, not because of new technologies (although technologies makes both dialog and murdering much easier)

bdcravens 9y ago

Many websites block users of common VPNs.

politician 9y ago

We've known how to shape encrypted traffic to look like other media to prevent this sort of traffic analysis for at least 2 decades.

CaptSpify 9y ago

Why not both? We absolutely need policy change, but we also need to use and encourage tech that makes it impossible for bad policies to take these to gain a foothold.

Veratyr 9y ago

> Simply making it illegal will detour most people. Don't mean to be pedantic but I think you mean "deter". "Detour" = reroute, like "we're taking a detour to get some gas". "Deter" = Discourage, like "making something illegal deters law abiding citizens from doing it". > I don't understand why VPN crackdown is thought to be impossible. Because it's hard to distinguish VPN traffic from legitimate traffic and false positives will be extremely bad for the ISP. > Open connection to a DNS port? sending large amounts of data? its encrypted? No one has accessed that digital ocean IP before on this network! In order: Many VPNs will use standard HTTPs ports rather than DNS. There are numerous reasons to send large amounts of data, like backups. Encryption is quickly becoming the default, major video sites like YouTube and Netflix are encrypted for instance. Software developers are likely to access DigitalOcean IP addresses. I do believe that at ISP scale it's possible to identify VPNs though and the things you've mentioned could contribute to a heuristic algorithm. Some other things to add are the geographical diversity of the users accessing a server (legitimate video services will have PoPs near a user, so few will cross the country), the distribution of response times and sizes (a pure web server will have lots of small, ~100ms responses, a video server will have lots of infrequent very high bandwidth transfers) and if you can access it, the outgoing connections of the servers themselves (e.g. Cogent can tell that a server is generating user traffic rather than business traffic).

codedokode 9y ago
> Because it's hard to distinguish VPN traffic from legitimate traffic I don't think so. Chinese firewall can block VPN. For example, the easiest way to see if the user is using a VPN is to count a number of IP addresses they connect to. > and false positives will be extremely bad for the ISP. How exactly?
- Veratyr 9y ago
  > I don't think so. Chinese firewall can block VPN. For example, the easiest way to see if the user is using a VPN is to count a number of IP addresses they connect to. China is a special case as unlike most other countries, all major ISPs are state owned. When you own every internet connection in the country, it's much easier to spot VPNs. When you're say Comcast, you only see the connections your customers make and accept, you can't see what VPN servers are doing. > How exactly? In countries other than China, where government control is less prevalent and the government is overtly democratic, false positives will result in anger in the populace, which will lead to the person implementing the policy losing power or at the very least, a degree of support.