6 ms·
I'm interested to see how they go about filtering VPN traffic. AFAIK, running openvpn over port 443 is pretty much indistinguishable from normal TLS traffic.
by parliament32 8y ago
I'm interested to see how they go about filtering VPN traffic. AFAIK, running openvpn over port 443 is pretty much indistinguishable from normal TLS traffic.
- tiatia123 8y agoSome VPNs go through extraordinary length for VPN over HTTP(S). It is not so trivial. Assuming that Uganda is likely buying blocking equipment from China.
- LinuxBender 8y agoProbably more like silicon valley. Bluecoat vars have been known to sell equipment to sanctioned countries and those that violate human rights.
- tiatia123 8y agohttps://www.voanews.com/a/iran-plans-its-own-sanitized-internet-with-chinese-help/1713638.html https://www.voanews.com/a/iran-plans-its-own-sanitized-inter...
- detaro 8y agoSure, but Iran is under embargo from the west. Uganda is not, and thus can freely buy censorship tech on the open market.
- tiatia123 8y agoNot sure why this gets downvoted. Good luck trying OpenVPN over 80 or 443 in China. If you want to build your own, use at least VPN that was developed in Japan. (Google)
- imbusy111 8y agoBy blocking a known set of IP addresses that belong to the most popular VPN providers or identifying these providers by traffic patterns? Surely a list of these IP addresses or technology to identify them must be floating around between the authoritarian governments.
- ryan-c 8y agoChina's gotten pretty good at it. OpenVPN running over port 443 is generally going to be using a CA that is not a public CA, and issues certificates directly rather than through an intermediate. Even if you tunnel something over normal TLS, the type of traffic can potentially be determined by analyzing how much data flows in which direction and when. If circumvention is seen as too widely spread, Uganda may simply decide that all TLS traffic leaving the country must be intercepted by a MitM proxy, and require everyone to trust their CA. I'm sure there are plenty of companies that would be happy to get the contract to provide this service. These blocks can often be circumvented by methods that do not scale, but if only tech savvy people who can afford to run their own VPN server on a VPS somewhere can circumvent the block, it's "mission accomplished".
- SomeRandomDev 8y agoI feel like China is good about public/shared VPN's. If you set up your own and keep the details to yourself I was under the impression that it'd work just fine. That being said I love to travel and can work wherever but haven't been to CN yet for this reason in particular.
- ryan-c 8y agoFrom what I've heard second-hand (my SO has a friend who frequently travels to China), they do actually block people's private one-off VPN servers quite effectively. Have a look at https://www.cs.tufts.edu/comp/116/archive/fall2016/ctang.pdf https://www.cs.tufts.edu/comp/116/archive/fall2016/ctang.pdf - it talks about GFW using machine learning with flow analysis to do this.
- userchris 8y agoI took that class (comp 116) a few years ago! Just had some fun finding and rereading my own final paper from the archives (the one you linked to makes mine seem way less interesting). Ming is a really awesome and unique lecturer.
- 8y ago
- zzzcpan 8y agoAs others have said, that's not true. It's actually pretty hard to hide VPN traffic from DPI solutions. And judging by bgp.he.net, ISP market in Uganda is monopolized and censorship friendly, the government can just ask the ISPs to install DPI equipment for censorship and they will comply no questions asked.
- xrisk 8y agoMy college Wi-Fi manages to do it... so I doubt that it can be too hard.