8 ms·

From the screencaps it looks like surveillance systems used to monitor internet cafes and public access points where people must use their real ID to login, so

From the screencaps it looks like surveillance systems used to monitor internet cafes and public access points where people must use their real ID to login, so it's a bit easier to link accounts to actual identities. A number of these IM suits are actually encrypted in transit that it's very unlikely that this level of interception is possible without a root certificate installed on the client machine.

ubercow13 8y ago
Couldn't this data be coming directly from these IM services' servers? I doubt any of them are E2EE.
- Laforet 8y ago
  It's possible but I really doubt it, considering the sheer volume of message being generated every moment. It would be much easier and less likely to have hiccups like these if they just give them server access on demand, rather than having a live data feed replicated to 18 separate locations. Moreover the tweets actually show names and addresses of various internet cafes in one of the pictures. This information should not be available if the data is coming from the service provider's backend. Contrary to popular opinion on HN and other forums in the Anglosphere, surveillance in China is a nuanced problem and tech companies are far from completely passive. Local police are often denied when they request information because technically they lack jurisdiction on companies located in a different town or province. As a result they resort to catch-all interception using devices like these makeshift DPI systems(there is no clear legal requirement, but internet cafe owners are easily coerced into installing them or risk having their business hut down over various infractions) and Stingray-like fake cell sites (a constant source of conflict with major telcos because they are often poorly installed and would interfere with normal cell sites). These ad-hoc schemes are usually put together by the lowest bidder, so they tend to be horribly inefficient and insecure like what's been shown in this case. But to local LE it's still preferable to going dark, not to mention there is usually little accountability when their system breaks.
  - 6nf 8y ago
    It's rare to see comments like yours from people who know about the technical details of how the Chinese government manage the internet. Could you share some please? How often do people actually get into trouble for their internet usage?
    - Laforet 8y ago
      >the technical details of how the Chinese government manage the internet This is a very broad topic that require several books to cover, but I will try to outline the more prominent features in a short few paragraphs. Before I start, it's important to point out that in a authoritarian state like China, laws are often deliberately made very strict but only loosely enforced. In time, everyone is likely to have already committed some crime as a matter of necessity and thus nobody is safe from the law; the constant threat of law enforcement make people fear the authorities. Every website serving users in China needs to apply and hold an ICP license[0]. Without a license, no hosting company will do business with you and your domain name run the risk of getting blacklisted if you decide to host it on a foreign server instead. If you have an established online presence, it is in your best interest to avoid anything transgressions that might result in the loss of your license, including but not limited to: - Hosting illegal content - Not promptly deleting content at the request of authorities - Not complying with any of the cyber security laws Additional permits are required if the website hosts music/video, publish games or offer money handling services. These permits are often intentionally kept scarce to make the industries more restrictive and compliant. As for internet users, every service they use require an account tied to their real ID. This is usually done by registering a mobile phone number which is technically always tied to a real identity. Public internet access also require phone verification to access. Therefore anything posted to the internet can theoretically be traced back to its author. >How often do people actually get into trouble for their internet usage? This is a really tricky question. Because of all the issues I mentioned above, service providers are strongly incentivized to practice self censorship. Thus a lot of contentious stuff people say will disappear before the authorities gets involved, especially if they are on the open web. Over at the more closed platforms such as WeChat the standards are somewhat relaxed, but from time to time people do get in trouble for what they post. In any case it's hard to tell because the standards being used to judge your words are in a constant state of flux. What happens after that really depends on where you live. In large cities, the police have more real problems to deal with and are subject to more oversight, so they tend to turn a blind eye except for the most blatantly seditious messages. And even in the latter case most people are let go after a formal warning without much consequence. Small town cops, on the other hand, are a lot more eager to seek prosecution, especially if they are corrupt or have a personal vendetta against you. Conflict zones like Xinjiang are the worst because they are under effective martial law, so anything remotely out of the line will get a follow-up. [0]:https://en.wikipedia.org/wiki/ICP_license https://en.wikipedia.org/wiki/ICP_license
iflp 8y ago
Public APs don't require ID for login. Only the IM services require ID.
- Laforet 8y ago
  They require your phone number which is always tied to an ID.
  - iflp 8y ago
    Oops. I forgot that. Tangentially, regarding your other comment that surveillance systems are often set up in an ad hoc way, could you provide some references? This is quite interesting to hear.
    - Laforet 8y ago
      I don't have a write-up on hand but you can get a gist of these systems by looking at the product page of one of the major providers: https://www.wwwscn.com/page/show/service.html https://www.wwwscn.com/page/show/service.html What isn't shown is that they also inject ads into web traffic and (allegedly) can be controlled like a botnet.
  - sathackr 8y ago
    And what happens if I log in with someone else's phone number?
Consultant32452 8y ago
It's my understanding that if you want to play ball in China, you have to give govt the keys to the kingdom. Here's one article of apple doing this. I'm not meaning to pick on Apple here, but imo they're the most security/privacy conscious of the really big players, and they've caved. https://www.theverge.com/2018/2/26/17052802/apple-icloud-encryption-keys-storage-china https://www.theverge.com/2018/2/26/17052802/apple-icloud-enc...

ubercow13 8y ago

Couldn't this data be coming directly from these IM services' servers? I doubt any of them are E2EE.

Laforet 8y ago
It's possible but I really doubt it, considering the sheer volume of message being generated every moment. It would be much easier and less likely to have hiccups like these if they just give them server access on demand, rather than having a live data feed replicated to 18 separate locations. Moreover the tweets actually show names and addresses of various internet cafes in one of the pictures. This information should not be available if the data is coming from the service provider's backend. Contrary to popular opinion on HN and other forums in the Anglosphere, surveillance in China is a nuanced problem and tech companies are far from completely passive. Local police are often denied when they request information because technically they lack jurisdiction on companies located in a different town or province. As a result they resort to catch-all interception using devices like these makeshift DPI systems(there is no clear legal requirement, but internet cafe owners are easily coerced into installing them or risk having their business hut down over various infractions) and Stingray-like fake cell sites (a constant source of conflict with major telcos because they are often poorly installed and would interfere with normal cell sites). These ad-hoc schemes are usually put together by the lowest bidder, so they tend to be horribly inefficient and insecure like what's been shown in this case. But to local LE it's still preferable to going dark, not to mention there is usually little accountability when their system breaks.
- 6nf 8y ago
  It's rare to see comments like yours from people who know about the technical details of how the Chinese government manage the internet. Could you share some please? How often do people actually get into trouble for their internet usage?
  - Laforet 8y ago
    >the technical details of how the Chinese government manage the internet This is a very broad topic that require several books to cover, but I will try to outline the more prominent features in a short few paragraphs. Before I start, it's important to point out that in a authoritarian state like China, laws are often deliberately made very strict but only loosely enforced. In time, everyone is likely to have already committed some crime as a matter of necessity and thus nobody is safe from the law; the constant threat of law enforcement make people fear the authorities. Every website serving users in China needs to apply and hold an ICP license[0]. Without a license, no hosting company will do business with you and your domain name run the risk of getting blacklisted if you decide to host it on a foreign server instead. If you have an established online presence, it is in your best interest to avoid anything transgressions that might result in the loss of your license, including but not limited to: - Hosting illegal content - Not promptly deleting content at the request of authorities - Not complying with any of the cyber security laws Additional permits are required if the website hosts music/video, publish games or offer money handling services. These permits are often intentionally kept scarce to make the industries more restrictive and compliant. As for internet users, every service they use require an account tied to their real ID. This is usually done by registering a mobile phone number which is technically always tied to a real identity. Public internet access also require phone verification to access. Therefore anything posted to the internet can theoretically be traced back to its author. >How often do people actually get into trouble for their internet usage? This is a really tricky question. Because of all the issues I mentioned above, service providers are strongly incentivized to practice self censorship. Thus a lot of contentious stuff people say will disappear before the authorities gets involved, especially if they are on the open web. Over at the more closed platforms such as WeChat the standards are somewhat relaxed, but from time to time people do get in trouble for what they post. In any case it's hard to tell because the standards being used to judge your words are in a constant state of flux. What happens after that really depends on where you live. In large cities, the police have more real problems to deal with and are subject to more oversight, so they tend to turn a blind eye except for the most blatantly seditious messages. And even in the latter case most people are let go after a formal warning without much consequence. Small town cops, on the other hand, are a lot more eager to seek prosecution, especially if they are corrupt or have a personal vendetta against you. Conflict zones like Xinjiang are the worst because they are under effective martial law, so anything remotely out of the line will get a follow-up. [0]:https://en.wikipedia.org/wiki/ICP_license https://en.wikipedia.org/wiki/ICP_license

iflp 8y ago

Public APs don't require ID for login. Only the IM services require ID.

Laforet 8y ago
They require your phone number which is always tied to an ID.
- iflp 8y ago
  Oops. I forgot that. Tangentially, regarding your other comment that surveillance systems are often set up in an ad hoc way, could you provide some references? This is quite interesting to hear.
  - Laforet 8y ago
    I don't have a write-up on hand but you can get a gist of these systems by looking at the product page of one of the major providers: https://www.wwwscn.com/page/show/service.html https://www.wwwscn.com/page/show/service.html What isn't shown is that they also inject ads into web traffic and (allegedly) can be controlled like a botnet.
- sathackr 8y ago
  And what happens if I log in with someone else's phone number?

Consultant32452 8y ago

It's my understanding that if you want to play ball in China, you have to give govt the keys to the kingdom. Here's one article of apple doing this. I'm not meaning to pick on Apple here, but imo they're the most security/privacy conscious of the really big players, and they've caved. https://www.theverge.com/2018/2/26/17052802/apple-icloud-encryption-keys-storage-china https://www.theverge.com/2018/2/26/17052802/apple-icloud-enc...