8 ms·

Pakistan bans VPNs

161 points by molecule 15y ago

gilgad13 15y ago
To do this, wouldn't they have to effectively block SSL and SSH connections as well? SSL is used in OpenVPN and some Cisco implementations. And we all know that you can tunnel any port over ssh. Or is the plan that the punishment for stepping outside the lines be enough to keep people from experimenting with these technologies?
- pavel_lishin 15y ago
  From the article, it sounds more like Pakistan has banned all encryption than VPNs specifically - VPNs were just one example cited.
  - swombat 15y ago
    So, your answer is actually yes, even though it looks like a 'no' - i.e. they have banned SSL and SSH along with VPNs.
  - kijin 15y ago
    Hmm, that would mean no Gmail for anyone in Pakistan. Any service that uses SSL for logins would also become unusable if SSL was banned. I don't see any mention of a wholesale ban on encryption, only the use of encryption for privacy purposes. So, port 443 might still be open. It's still pretty easy to distinguish between HTTPS traffic and VPN traffic, though.
    - pavel_lishin 15y ago
      Well, the article said: > Authority prohibited usage of all such mechanisms including encrypted virtual private networks (EVPNs) which conceal communication to the extent that prohibits monitoring. They sure can't monitor your email if you're using SSL, so I'd wager that yes, if you have gmail and live in Pakistan, now would be a great time to back it all up.
      - pohl 15y ago
        They sure can't monitor your email if you're using SSL... That would have been my gut feeling until I saw this yesterday: http://news.ycombinator.com/item?id=2938516 http://news.ycombinator.com/item?id=2938516
    - jevinskie 15y ago
      They could proxy the SSL connections and still let people log in while monitoring the traffic. Of course, your browser will complain if they rewrap it in SSL unless they get a cert like Iran did.
      - jm4 15y ago
        They don't need to do what Iran did. What Iran did was get a cert that was automatically trusted by nearly every web browser in the world because the issuer was a trusted CA by default. You only need a trusted cert if you don't want users to get a warning. Iran was trying to be sneaky. Pakistan is up front about wanting to monitor traffic. They can use any cert they want. They could use a self signed cert to proxy SSL. Sure, the browser will complain that it's not a trusted cert, but the government is already saying they are going to monitor everything. If users add the cert to the "trusted" list they won't get the warning anymore.
  - rahoulb 15y ago
    So no SSH and no accessing git servers. In other words goodbye to any software development industry in PK
- ArtemZ 15y ago
  I think they just blocked standart VPN ports as it has been done here, in China. To effectively block users from accessing unwanted content censors have to block all (or most) foreign ip addresses, but I don't think it will ever happen anywhere.
- dasil003 15y ago
  Yes, I think they would need to block those as well in order to be effective. Frankly I don't see how they could possibly get away with it. Businesses of any size can't run without encrypted channels. Proceeding with this seems sure way to smother any economic development and relegate the country to third-world backwater status for the foreseeable future. And is any world leader crazy enough to do that besides Kim Jong-il?
  - anamax 15y ago
    > Businesses of any size can't run without encrypted channels. Sure they can - they did before the internet. (No, the postal mail is not secure.) > Proceeding with this seems sure way to smother any economic development and relegate the country to third-world backwater status for the foreseeable future. And is any world leader crazy enough to do that besides Kim Jong-il? Pretty much every "world leader" in the last 100 years (if not longer) has shown that s\he is willing to give up some economic development in return for control and other benefits. (They arguably give up more than they think that they're giving up, but that's a separate issue.) Disagree? Name three exceptions. Besides, the effect on economic development in the short term will be almost unnoticable.
    - dasil003 15y ago
      My wording was ambiguous, I should have said of any significant size. Anyway, "some economic benefit" is the understatement of the year. A multinational simply can not do business without secure communications. History is irrelevant; Wells Fargo wrote out every transaction on a slip of paper and manually reconciled it every night 50 years ago, but to do so today would be utterly impossible. In todays global economy, countries need to be able to do business with foreign companies or they will be a backwater plain and simple. China certainly makes some of the tradeoffs you are talking about, but do they outright ban secure communications? Of course not, because that would be suicidal.
    - lukeschlather 15y ago
      >Sure they can - they did before the internet. (No, the postal mail is not secure.) It's several orders of magnitude more secure than plain http. >Besides, the effect on economic development in the short term will be almost unnoticable. India has to be chock full of nationalistic script kiddies and legitimate hackers who will have a field day wrecking Pakistan's online economy if they actually try to implement this plan.
reginaldo 15y ago
The goal of the Pakistani government seems to be the complete obliteration of all private communications. But the only way to do that is by banning all communication. With the ban on VPNs, steganographic[1] techniques that make encrypted traffic look like regular traffic will become more and more common. The troubling thing is the fact that these techniques are somewhat hungry for bandwidth. [1] http://en.wikipedia.org/wiki/Steganography http://en.wikipedia.org/wiki/Steganography
- omouse 15y ago
  Psh, you can still spread messages person to person, you know, in REAL LIFE. It's sad how we're all tied to the Internet and try to make it the first and foremost way in which we communicate.
  - lallysingh 15y ago
    Most governments only go to controlling online activity after controlling real-life activity. I don't know about Pakistan specifically, but typically the domestic "security" organizations are rather adept at tracking down groups who organize in meatspace.
  - ItsTrueYouKnow 15y ago
    Because anonymous, rapid, long distance communication is obviously easy to do person to person.
  - Jach 15y ago
    Why do the cops win? A network of instant communication. If you can't communicate quickly, or at least as fast as your enemies, in many cases you might as well not communicate at all. There are benefits of sneakernets but they don't win on their own.
- 77ko 15y ago
  Simple explanation of Steganography: http://www.economist.com/node/17248872 http://www.economist.com/node/17248872
- 15y ago
emilsedgh 15y ago
In Iran, in the days we had protests, they dropped all encrypted connections as well. That makes internet simply unusable. I hope this would never come to Iran, although I believe it will. Soon.
- RexRollman 15y ago
  I am sorry to hear that, my friend. Godspeed.
- qq66 15y ago
  What about the possibility of encrypted traffic that doesn't look encrypted? Perhaps "Liking" public Facebook status updates such that the first letter of each status liked, in chronological order, is the datastream.
  - derwiki 15y ago
    While not encrypted, Iodine (http://code.kryo.se/iodine/ http://code.kryo.se/iodine/) does a similar thing by putting data payload in DNS requests/responses.
77ko 15y ago
SSL works in most ISP's in Pakistan, though anti-state and very bad for the children websites like the Rolling Stones are blocked. Nice, Pakistani friendly sites like redtube or child porn remain unblocked of course. VPN's work too, so far. I'm on one right now. As to why - the filtration system the government is using is so brain dead - there is basically one Juniper router and a couple of Cisco routers (last time I looked) - through which the entire country's traffic is routed. Using a VPN makes web browsing much faster, with no annoying "waiting" moments - which I presume is the routers locking up under massive load. The day VPN's are blocked is going to be a sad day indeed. I am going to explore for alternatives to VPN's. Way back in the days of super slow dial up I used these services which would take a link and email the page or entire site to you depending on the command you sent, in a zip file.
sturadnidge 15y ago
I am not sure this is that much more disturbing than the British Government even thinking about restricting the use of social media apps during times of civil disobedience. And this is extremely disturbing. How can any global company now do business in Pakistan? Surely there is some kind of back door in there.
- 77ko 15y ago
  There is, businesses can 'register' their vpn's and continue using them.
jasonjei 15y ago
Apple obviously uses VPN in its non-Cupertino locations, presumably too with its production lines in China. I know that China allows the use of VPN for businesses with a legitimate need. Even though Pakistan was never an ideal location for doing business anyway, they've essentially banned any technical business from conducting operations in Pakistan.
- 77ko 15y ago
  They are asking companies and banks etc. to register their VPN's with the govt. Basically, if you're a multinational or a large local corporation you get to use VPN's. Private citizens need not apply.
  - toyg 15y ago
    More red tape, exactly what businesses need! <sarcasm> Even multinationals don't enjoy having to spend extra resources to keep track of such arbitrary requirements. Will they need to register only the IP of their VPN gateways, or also the client IPs? Will they need to specify the type of software they use? What are the chances that they'll also be asked for certificates, so that spooks can snoop anyway? If I have a website running on servers in Jamaica, selling paper planes, and I use SSL because it's the right thing to do, will Pakistani customers be able to buy anything from me? Obviously I haven't registered with the Pakistani government, chances are that I don't even know what Pakistan is! This is unbelievable. (On the other hand, it's a wet dream for the likes of RIAA...)
- mcantelon 15y ago
  ...and obliterated their domestic cybersecurity. Stupid.
mhlakhani 15y ago
They're doing this under the pre-text of monitoring all internet usage so that they can 'search traffic for terrorist communication'. At my university, students are required to browse through an authenticated proxy (which we have to sign in to using our university IDs), which logs our browsing history. This is done so that they can comply with the PTA's requirement that an ISP should be able to provide browsing history of all users for the last 45 days upon request. Never mind that it's trivial to get around that proxy, all it actually does is mess up most stuff like Windows updates, gaming, etc.
77ko 15y ago
Besides censorship, another reason is the local telephone monopoly, PTCL is trying to shut off all voice gateways into Pakistan, which are causing it to lose money and are hard to tap into as they are routed over VPN's to a local gateway connected to a bunch of landlines or cellphones which connects the local call. Though of course they could just tap into the local last mile...
praptak 15y ago
If Pakistani government can easily spy on the communications of their citizens, so can other organizations. Israel, India, Iran, to name a few of them.
- panacea 15y ago
  "to name a few of them." I'm guessing the extended set contains countries with names that don't start with "I"?
maeon3 15y ago
I'm not sure how banning VPN's is going to stop the terrorists. Don't they use cellphones to coordinate their strikes? You would have to stop the internet and all forms of communication to slow them down, and then still you wouldn't slow them down much. We gotta get "Right to bear encryption" next to "Right to bear arms" in the constitution/bill of rights.
- Estragon 15y ago
  Americans don't have a monopoly on using bogeymen to justify unpopular and stupid policies.
lurkinggrue 15y ago
On the plus side: It's much easier to steal credit cards there.
- 77ko 15y ago
  You are assuming people have credit cards here. Some do, yes, nut over 99% don't.
rorrr 15y ago
So no more online banking? Everyone's accounts are in danger.
thethimble 15y ago
This does nothing to stop people who are intent on communicating privately (SSL, SSH, public key encrypted messages, etc.) and everything to hamper internet progress in Pakistan. Why would a tech company even consider spreading/outsourcing to Pakistan after this?
- noarchy 15y ago
  For the same reason that they spread, for example, to China? If they think there is money to be made, you can't underestimate the concessions that a company will make to the local government.
mkup 15y ago
OpenVPN sessions look like SSL traffic to the eavesdropper. So there's a good reason to use OpenVPN in Pakistan. They'll have to ban SSL at the state level as well.
joeycfan 15y ago
I saw this coming. I saw it coming HERE, I mean.

161 points by molecule 15y ago

To do this, wouldn't they have to effectively block SSL and SSH connections as well? SSL is used in OpenVPN and some Cisco implementations. And we all know that you can tunnel any port over ssh. Or is the plan that the punishment for stepping outside the lines be enough to keep people from experimenting with these technologies?

pavel_lishin 15y ago
From the article, it sounds more like Pakistan has banned all encryption than VPNs specifically - VPNs were just one example cited.
- swombat 15y ago
  So, your answer is actually yes, even though it looks like a 'no' - i.e. they have banned SSL and SSH along with VPNs.
- kijin 15y ago
  Hmm, that would mean no Gmail for anyone in Pakistan. Any service that uses SSL for logins would also become unusable if SSL was banned. I don't see any mention of a wholesale ban on encryption, only the use of encryption for privacy purposes. So, port 443 might still be open. It's still pretty easy to distinguish between HTTPS traffic and VPN traffic, though.
  - pavel_lishin 15y ago
    Well, the article said: > Authority prohibited usage of all such mechanisms including encrypted virtual private networks (EVPNs) which conceal communication to the extent that prohibits monitoring. They sure can't monitor your email if you're using SSL, so I'd wager that yes, if you have gmail and live in Pakistan, now would be a great time to back it all up.
    - pohl 15y ago
      They sure can't monitor your email if you're using SSL... That would have been my gut feeling until I saw this yesterday: http://news.ycombinator.com/item?id=2938516 http://news.ycombinator.com/item?id=2938516
  - jevinskie 15y ago
    They could proxy the SSL connections and still let people log in while monitoring the traffic. Of course, your browser will complain if they rewrap it in SSL unless they get a cert like Iran did.
    - jm4 15y ago
      They don't need to do what Iran did. What Iran did was get a cert that was automatically trusted by nearly every web browser in the world because the issuer was a trusted CA by default. You only need a trusted cert if you don't want users to get a warning. Iran was trying to be sneaky. Pakistan is up front about wanting to monitor traffic. They can use any cert they want. They could use a self signed cert to proxy SSL. Sure, the browser will complain that it's not a trusted cert, but the government is already saying they are going to monitor everything. If users add the cert to the "trusted" list they won't get the warning anymore.
- rahoulb 15y ago
  So no SSH and no accessing git servers. In other words goodbye to any software development industry in PK
ArtemZ 15y ago
I think they just blocked standart VPN ports as it has been done here, in China. To effectively block users from accessing unwanted content censors have to block all (or most) foreign ip addresses, but I don't think it will ever happen anywhere.
dasil003 15y ago
Yes, I think they would need to block those as well in order to be effective. Frankly I don't see how they could possibly get away with it. Businesses of any size can't run without encrypted channels. Proceeding with this seems sure way to smother any economic development and relegate the country to third-world backwater status for the foreseeable future. And is any world leader crazy enough to do that besides Kim Jong-il?
- anamax 15y ago
  > Businesses of any size can't run without encrypted channels. Sure they can - they did before the internet. (No, the postal mail is not secure.) > Proceeding with this seems sure way to smother any economic development and relegate the country to third-world backwater status for the foreseeable future. And is any world leader crazy enough to do that besides Kim Jong-il? Pretty much every "world leader" in the last 100 years (if not longer) has shown that s\he is willing to give up some economic development in return for control and other benefits. (They arguably give up more than they think that they're giving up, but that's a separate issue.) Disagree? Name three exceptions. Besides, the effect on economic development in the short term will be almost unnoticable.
  - dasil003 15y ago
    My wording was ambiguous, I should have said of any significant size. Anyway, "some economic benefit" is the understatement of the year. A multinational simply can not do business without secure communications. History is irrelevant; Wells Fargo wrote out every transaction on a slip of paper and manually reconciled it every night 50 years ago, but to do so today would be utterly impossible. In todays global economy, countries need to be able to do business with foreign companies or they will be a backwater plain and simple. China certainly makes some of the tradeoffs you are talking about, but do they outright ban secure communications? Of course not, because that would be suicidal.
  - lukeschlather 15y ago
    >Sure they can - they did before the internet. (No, the postal mail is not secure.) It's several orders of magnitude more secure than plain http. >Besides, the effect on economic development in the short term will be almost unnoticable. India has to be chock full of nationalistic script kiddies and legitimate hackers who will have a field day wrecking Pakistan's online economy if they actually try to implement this plan.

reginaldo 15y ago

The goal of the Pakistani government seems to be the complete obliteration of all private communications. But the only way to do that is by banning all communication. With the ban on VPNs, steganographic[1] techniques that make encrypted traffic look like regular traffic will become more and more common. The troubling thing is the fact that these techniques are somewhat hungry for bandwidth. [1] http://en.wikipedia.org/wiki/Steganography http://en.wikipedia.org/wiki/Steganography

omouse 15y ago
Psh, you can still spread messages person to person, you know, in REAL LIFE. It's sad how we're all tied to the Internet and try to make it the first and foremost way in which we communicate.
- lallysingh 15y ago
  Most governments only go to controlling online activity after controlling real-life activity. I don't know about Pakistan specifically, but typically the domestic "security" organizations are rather adept at tracking down groups who organize in meatspace.
- ItsTrueYouKnow 15y ago
  Because anonymous, rapid, long distance communication is obviously easy to do person to person.
- Jach 15y ago
  Why do the cops win? A network of instant communication. If you can't communicate quickly, or at least as fast as your enemies, in many cases you might as well not communicate at all. There are benefits of sneakernets but they don't win on their own.
77ko 15y ago
Simple explanation of Steganography: http://www.economist.com/node/17248872 http://www.economist.com/node/17248872
15y ago

emilsedgh 15y ago

In Iran, in the days we had protests, they dropped all encrypted connections as well. That makes internet simply unusable. I hope this would never come to Iran, although I believe it will. Soon.

RexRollman 15y ago
I am sorry to hear that, my friend. Godspeed.
qq66 15y ago
What about the possibility of encrypted traffic that doesn't look encrypted? Perhaps "Liking" public Facebook status updates such that the first letter of each status liked, in chronological order, is the datastream.
- derwiki 15y ago
  While not encrypted, Iodine (http://code.kryo.se/iodine/ http://code.kryo.se/iodine/) does a similar thing by putting data payload in DNS requests/responses.

77ko 15y ago

SSL works in most ISP's in Pakistan, though anti-state and very bad for the children websites like the Rolling Stones are blocked. Nice, Pakistani friendly sites like redtube or child porn remain unblocked of course. VPN's work too, so far. I'm on one right now. As to why - the filtration system the government is using is so brain dead - there is basically one Juniper router and a couple of Cisco routers (last time I looked) - through which the entire country's traffic is routed. Using a VPN makes web browsing much faster, with no annoying "waiting" moments - which I presume is the routers locking up under massive load. The day VPN's are blocked is going to be a sad day indeed. I am going to explore for alternatives to VPN's. Way back in the days of super slow dial up I used these services which would take a link and email the page or entire site to you depending on the command you sent, in a zip file.

sturadnidge 15y ago

I am not sure this is that much more disturbing than the British Government even thinking about restricting the use of social media apps during times of civil disobedience. And this is extremely disturbing. How can any global company now do business in Pakistan? Surely there is some kind of back door in there.

77ko 15y ago
There is, businesses can 'register' their vpn's and continue using them.

jasonjei 15y ago

Apple obviously uses VPN in its non-Cupertino locations, presumably too with its production lines in China. I know that China allows the use of VPN for businesses with a legitimate need. Even though Pakistan was never an ideal location for doing business anyway, they've essentially banned any technical business from conducting operations in Pakistan.

77ko 15y ago
They are asking companies and banks etc. to register their VPN's with the govt. Basically, if you're a multinational or a large local corporation you get to use VPN's. Private citizens need not apply.
- toyg 15y ago
  More red tape, exactly what businesses need! <sarcasm> Even multinationals don't enjoy having to spend extra resources to keep track of such arbitrary requirements. Will they need to register only the IP of their VPN gateways, or also the client IPs? Will they need to specify the type of software they use? What are the chances that they'll also be asked for certificates, so that spooks can snoop anyway? If I have a website running on servers in Jamaica, selling paper planes, and I use SSL because it's the right thing to do, will Pakistani customers be able to buy anything from me? Obviously I haven't registered with the Pakistani government, chances are that I don't even know what Pakistan is! This is unbelievable. (On the other hand, it's a wet dream for the likes of RIAA...)
mcantelon 15y ago
...and obliterated their domestic cybersecurity. Stupid.

mhlakhani 15y ago

They're doing this under the pre-text of monitoring all internet usage so that they can 'search traffic for terrorist communication'. At my university, students are required to browse through an authenticated proxy (which we have to sign in to using our university IDs), which logs our browsing history. This is done so that they can comply with the PTA's requirement that an ISP should be able to provide browsing history of all users for the last 45 days upon request. Never mind that it's trivial to get around that proxy, all it actually does is mess up most stuff like Windows updates, gaming, etc.

77ko 15y ago

Besides censorship, another reason is the local telephone monopoly, PTCL is trying to shut off all voice gateways into Pakistan, which are causing it to lose money and are hard to tap into as they are routed over VPN's to a local gateway connected to a bunch of landlines or cellphones which connects the local call. Though of course they could just tap into the local last mile...

praptak 15y ago

If Pakistani government can easily spy on the communications of their citizens, so can other organizations. Israel, India, Iran, to name a few of them.

panacea 15y ago
"to name a few of them." I'm guessing the extended set contains countries with names that don't start with "I"?

maeon3 15y ago

I'm not sure how banning VPN's is going to stop the terrorists. Don't they use cellphones to coordinate their strikes? You would have to stop the internet and all forms of communication to slow them down, and then still you wouldn't slow them down much. We gotta get "Right to bear encryption" next to "Right to bear arms" in the constitution/bill of rights.

Estragon 15y ago
Americans don't have a monopoly on using bogeymen to justify unpopular and stupid policies.

lurkinggrue 15y ago

On the plus side: It's much easier to steal credit cards there.

77ko 15y ago
You are assuming people have credit cards here. Some do, yes, nut over 99% don't.

rorrr 15y ago

So no more online banking? Everyone's accounts are in danger.

thethimble 15y ago

This does nothing to stop people who are intent on communicating privately (SSL, SSH, public key encrypted messages, etc.) and everything to hamper internet progress in Pakistan. Why would a tech company even consider spreading/outsourcing to Pakistan after this?

noarchy 15y ago
For the same reason that they spread, for example, to China? If they think there is money to be made, you can't underestimate the concessions that a company will make to the local government.

mkup 15y ago

OpenVPN sessions look like SSL traffic to the eavesdropper. So there's a good reason to use OpenVPN in Pakistan. They'll have to ban SSL at the state level as well.

joeycfan 15y ago

I saw this coming. I saw it coming HERE, I mean.