4 ms·

> Everything has to be encrypted and authenticated end-to-end. This isn't really enough. Even with QUIC / TLS your ISP can still know what endpoint you're conn

by gnode 8y ago

> Everything has to be encrypted and authenticated end-to-end. This isn't really enough. Even with QUIC / TLS your ISP can still know what endpoint you're connecting to, which may in itself be too bad. This is the problem VPNs are solving (or at least moving the trust). There's also the touted alternative of conglomerate everything onto Cloudflare and have encrypted SNI.

walrus01 8y ago
If your ISP is doing netflow analysis and DPI on your connection (like the Chinese GFW), with malicious intent specifically aimed at you, you're pretty much screwed anyhow. If they decide to start blocking traffic to VPN endpoints and such. This can be seen if you try running a non-obfuscated openvpn link into and out of China.
- gnode 8y ago
  Excluding steganography, an eavesdropper will know if they're unable to understand your communications. What's important is that what they can glean isn't enough for them to be specifically motivated or able to harm you. Being seen to be using a VPN only labels you as a VPN user. In China, the authorities dislike individual VPN use, and attempt to curb it with technical measures, but for the most part, they don't go around imprisoning people only for VPN use, because there isn't much expected gain to be had from the average VPN user.
  - walrus01 8y ago
    The new thing with the GFW in the last 3-4 years is to identify VPN-resembling traffic from DPI, using a fully automated/scripted system, and then over a period of several hours/days, the GFW causes incredibly high packet loss for all traffic to/from the non-china endpoint, eventually culminating in a nullroute of all traffic.
- dylz 8y ago
  Without malicious intent, ISPs are already doing this, both to sell aggregated traffic data and to shit all over their network. On Sprint and ATT Mobility I cannot maintain many TCP connections for long durations - websockets will be killed after a while and require reconnection, long-connected TCP games will drop after a few minutes, quite a handful of HTTPS/TLS sites do not load and immediately hardfail with a TLS protocol error or connection reset, traffic appears modified and periodically injected, DNS is hijacked, images' hash values do not match the server side on plaintext connections, NXDOMAIN DNS values are hijacked, traffic crossing any port will be tampered with as long as it looks like HTTP/1.x, etc.

by gnode 8y ago

walrus01 8y ago

If your ISP is doing netflow analysis and DPI on your connection (like the Chinese GFW), with malicious intent specifically aimed at you, you're pretty much screwed anyhow. If they decide to start blocking traffic to VPN endpoints and such. This can be seen if you try running a non-obfuscated openvpn link into and out of China.

gnode 8y ago
Excluding steganography, an eavesdropper will know if they're unable to understand your communications. What's important is that what they can glean isn't enough for them to be specifically motivated or able to harm you. Being seen to be using a VPN only labels you as a VPN user. In China, the authorities dislike individual VPN use, and attempt to curb it with technical measures, but for the most part, they don't go around imprisoning people only for VPN use, because there isn't much expected gain to be had from the average VPN user.
- walrus01 8y ago
  The new thing with the GFW in the last 3-4 years is to identify VPN-resembling traffic from DPI, using a fully automated/scripted system, and then over a period of several hours/days, the GFW causes incredibly high packet loss for all traffic to/from the non-china endpoint, eventually culminating in a nullroute of all traffic.
dylz 8y ago
Without malicious intent, ISPs are already doing this, both to sell aggregated traffic data and to shit all over their network. On Sprint and ATT Mobility I cannot maintain many TCP connections for long durations - websockets will be killed after a while and require reconnection, long-connected TCP games will drop after a few minutes, quite a handful of HTTPS/TLS sites do not load and immediately hardfail with a TLS protocol error or connection reset, traffic appears modified and periodically injected, DNS is hijacked, images' hash values do not match the server side on plaintext connections, NXDOMAIN DNS values are hijacked, traffic crossing any port will be tampered with as long as it looks like HTTP/1.x, etc.