26 ms·

Tunneling Wikipedia through WhatsApp to (maybe?) get around WiFi restrictions

369 points by otras 4y ago

Shadonototra 4y ago
here an idea: take a screenshot of the website and send it back as a compressed base64 text or what ever will produce smallest result then decode that image from the text on your phone
- kilroy123 4y ago
  Yeah this seems much better. Very doable over WhatsApp.
Group_B 4y ago
These are my favorite kind of projects.
hamiltonians 4y ago
cool hack
Drblessing 4y ago
Had this exact same idea on my last flight! If Telegram is an approved messenger you could also create a pretty unrestricted bot there too. Very cool.
- xeromal 4y ago
  On the planes I've flown with messaging enabled, I usually only see IMessage, whatsapp, and facebook messenger.
  - Drblessing 4y ago
    Shockingly Signal was working on my last flight - maybe telegram works but they don't advertise?
    - nyuszika7h 4y ago
      Maybe it has to do something with WhatsApp also using the Signal protocol, though you'd think generally they'd whitelist IPs or hostnames rather than doing DPI.
      - Drblessing 4y ago
        What's DPI? I have no idea how this whitelisting works but I'm curious!
        blacksmith_tb 4y ago
        Deep Packet Inspection: https://www.fortinet.com/resources/cyberglossary/dpi-deep-packet-inspection https://www.fortinet.com/resources/cyberglossary/dpi-deep-pa...
5- 4y ago
nice! next up: encapsulate ip to provide full networking (with terrible latency) also just in case someone is wondering, a more ergonomic solution specifically for reading wikipedia on a plane is https://kiwix.org https://kiwix.org
MauranKilom 4y ago
Wait, is this filtering based on IP or DNS? How do they make sure their whitelist remains up to date? (I assume it's HTTPS, so those are basically the only two options...) If it's DNS based, there should be simpler workarounds, so I guess it's just IP based?
- cortesoft 4y ago
  It is pretty simple... your filter just makes periodic DNS requests to the desired allowed host and updates it's IP restrictions to the returned address. You also need to run the DNS resolver to return that same cached IP to prevent having the upstream DNS server return a different address. You also need to make sure the DNS server will only resolve the domains you want it to, because if you allow unfiltered dns requests to arbitrary domains, anyone can then tunnel their traffic over DNS, as another comment on this thread pointed out.
  - stefan_ 4y ago
    I don't understand, what's the domain of.. WhatsApp? Not to mention you are just as likely to hit some Round-Robin configuration.
    - axiosgunnar 4y ago
      This is a very good question. I would also assume that Whatsapp might change the servers used with updates of the app. How would Delta deal with that? Just wait for the complaints to come in?
      - cranekam 4y ago
        WhatsApp (now, since it moved into FB's infra) connects to g.whatsapp.net, which is a CNAME to chat.cdn.whatsapp.net, which in turn is an A record to a VIP on Facebook's edge network. The A record you're returned can change — it's intended to be one that's closest to you (as determined by your DNS resolver's location and probably EDNS Client Subnet) but traffic engineering policies might cause different responses over time. Since on a flight it's likely everyone will use the same resolver on the ground somewhere in Delta's infrastructure a simple mechanism to resolve the IP periodically and update a whitelist (or to cache one VIP location and always return that) might work. Alternatively, as other commenters have suggested, it'd be better to identify traffic with SNI or other profiling. Updates to the app almost certainly won't change the address it connects to.
userbinator 4y ago
I wonder if anyone has stated a general law along the lines of "if you can send and receive a bit, you can send and receive anything." The only issues ended up being that 1) WhatsApp messages are limited to 1600 characters Concidentally, that's not much bigger than the MTU of standard Ethernet. I don't know how "transparent" the data channel is with respect to non-ASCII (and probably Unicode), but if you use one of the various binary-to-text encodings that exist, you could probably implement Ethernet over WhatsApp. ;-)
- EMIRELADERO 4y ago
  > I wonder if anyone has stated a general law along the lines of "if you can send and receive a bit, you can send and receive anything." In my country we have a telecom service provider law, which states, among other things: ARTICLE 57. - Network neutrality. Prohibitions. Service Providers shall not: a) Block, interfere, discriminate, hinder, degrade or restrict the use, sending, reception, offering or access to any content, application, service or protocol except by court order or explicit request of the user.
  - lolinder 4y ago
    I think OP meant "law" as in "law of gravity" not as in legality.
- cortesoft 4y ago
  I don't think that is necessarily a law. There would be ways to actually restrict access in better ways... you would likely be right if you amended it to the ability to send a bit to an endpoint you control.
  - iratewizard 4y ago
    After writing code for locking down tablets used by prison inmates, I definitely agree that it's not much of a law.
    - 4y ago
Egrodo 4y ago
I think about creating this project every time I'm on a Delta flight, great to see someone actually did it.
mmh0000 4y ago
Many years ago (2012) Delta inflight wifi would allow DNS queries out without paying. Being a very frequent flyer I used to run an ip-over-dns tunnel using Iodine[1]. It was slow but worked. I wonder if they’ve blocked that hole yet. [1] https://code.kryo.se/iodine/ https://code.kryo.se/iodine/
- deleted 4y ago
  [deleted]
- zamadatix 4y ago
  When selecting my personal use domain I ended spent some time finding a short domain partly because it's convenient but partly because it meant more goodput via Iodine. I ended up on "ds.gy" as ds are my initials and it was the only TLD that domain wasn't sat on by squatters wanting to charge thousands.The ratio of people wanting to sell you short domains vs actually using them in any capacity was surprising.
- siraben 4y ago
  I can confirm that this still works on several US airlines especially if they have a free messaging option.
- iforgotpassword 4y ago
  I did the same on trains in the 00s, but built application specific tunnels which were much faster, funnily enough among them was one that would fetch Wikipedia pages. The client would piece together the replies and render the markup to html again.
- Macuyiko 4y ago
  I also used this a lot while travelling to access the internet through captive wifi portals. Especially in asia this worked very well, given the huge amount of telco wifi providers in cities.
- kache_ 4y ago
  lol holy shit I'm never going to have an unproductive flight again
hegzploit 4y ago
Would it be possible to spoof the host and get free internet, that's something I've always thought about when facing such limits.
- cortesoft 4y ago
  No, because they aren't basing it on the host header or something.
joshvm 4y ago
My experience with in-flight message-only WiFi is that they're just really slow and the ping times are long. Some services are actively blocked, e.g. Skype wouldn't work at all even for text messages, but browsing the internet is usually allowed. My VPN wouldn't work, but I suspect it might have if I used an obfuscated connection instead of OpenVPN or whatever the default is (e.g. over SSL). I could load GMail in the browser and Wikipedia probably would have worked. It's strongly website dependent. Hacker News is extraordinarily resilient to lousy connections and generally the index would always load without any trouble. It works even on a 3 second ping over satellite internet. Very few websites are that tolerant. The flight crew (BA) knew what's up. They specifically warned us to check which package we were getting, because evidently they get a lot of complaints when people buy the message-only bundle and are surprised that nothing works. Singapore gave out free passes for single devices last time I flew with them. It was possible to rotate MAC addresses by forgetting the connection and then re-joining. The connection was quite good, you could watch YouTube in potato resolution. It's quite fun to chat to people and send them photos out of the window.
- jjeaff 4y ago
  I carry one of those tiny wireless routers in my carry on wherever I go. If I have to buy internet on the plane or if I am in a hotel that limits the number of devices, I always connect through the router and use it as an access point for all the other devices. The other added benefit is that all my other devices already have my AP's wifi creds and will connect to it automatically.
  - darig 4y ago
  - t-0 4y ago
    I've been thinking about doing somethign similar and am really interested in what hardware you're using for this and what your setup looks like. Do you run a VPN service directly on your router, for example?
    - 4y ago
aledalgrande 4y ago
On a recent flight I bought a "streaming" package, was either the most expensive or second most. Could barely navigate to web pages.
smashah 4y ago
You'd be surprised what kind of automations people build on top of WhatsApp. Also, you can use free alternatives to the Twilio API to do more than just text-based automation.
timetraveller26 4y ago
In a good world we would have free wikipedia access anywhere, no cost. Then we could learn anything we needed. https://xkcd.com/548/ https://xkcd.com/548/
- deleted 4y ago
  [deleted]
- aero-glide2 4y ago
  That doesn't follow net neutrality though.
quelltext 4y ago
This is basically a chat bot interface. Google used to have a way to ask for searches via SMS a while ago: https://www.youtube.com/watch?v=J937N9m-XtE https://www.youtube.com/watch?v=J937N9m-XtE But "tunneling" to me implies some transparent layer allowing you to browse Wikipedia via the same way of interaction.
rschachte 4y ago
One thing that would be interesting is scanning for open ports. Once you find an open port, make a Twilio API and text the number (Since most airlines enable texting via SMS/Whats APP) that triggers opening the port on your VPS that is opened on the airplane. Once you do that, you can tunnel into your VPS through the airlines open port or SSH into the machine. If you create a SOCKS5 proxy, then all traffic in your browser will tunnel through the VPS. Haven't tried this, but just a thought.
- 2Gkashmiri 4y ago
  Back in 2019 when Indian government put a city of 8 million into a 9 month curfew including internet blackout, I was anxious yo get online. Then they permitted only dozen of "white listed websites", just ones that did not allow anti India propaganda. Anyways, I found amazon India worked. I went to aws, set up a vps and simply used ssh tunnel to it. It worked, for a bit. They closed the default port and I could not spend time on a dedicated public internet terminals to " test" open ports so yeah, I have done exactly that. Used foxyproxy btw
  - vgb2k18 4y ago
    >Used foxyproxy btw HAProxy is also really useful for this purpose, I dare say more-so. For my use-case it solved this problem: "Using 1 port on the remote server (port 443), how can I serve HTTPS (serve a website) and SSH or SOCKS5 (use the server as a proxy)?". HAProxy was good for the task. It could be used to tunnel SSH through HTTPS too, in the case where a corp firewall is using DPI to block standard SSH. What I'm not sure of though... can it tunnel SSH through HTTPS, and, serve a website at the same time? That's a question for the reader. The idea of serving a website at the same time was for the purpose of providing a plausible reason for traffic exists from that server. Like, you know, if the admin's see traffic on 443 from an ip/domain with no website, that's got to be a magnitude of suspicion higher than an ip/domain with an actual website being served on it.
    - toast0 4y ago
      Sure. If you run an https proxy that allows CONNECT, that can tunnel ssh, but if you do GET without a fully qualified url, that can serve whatever according to the host header. If you just wanted to tunnel ssh over tls, it's trickier because ssh is server speaks first and http is client speaks first, so as a server, you'd have to guess if your client wants one or the other.
7402 4y ago
Sure, it's always interesting to investigate vulnerabilities and design deficiencies, and it can be beneficial especially when the goal is improving security for everyone. But it's hard for me to celebrate someone whose motivation seems to be that they are simply too cheap to pay for something that other, more honest, people are willing to pay for. In this case, it probably doesn't affect anyone else if the author only downloads a few articles, but in general, if internet bandwidth on an airplane is a limited resource, then using large amounts up in this way to the detriment of others would just be stealing.
- redox99 4y ago
  Most people wouldn't mind some kind of throttling, as long as it is net neutral. The problem here is the lack of net neutrality.
1vuio0pswjnm7 4y ago
Of all the possible websites to choose as an example, Wikipedia is a strange choice since, unlike most websites, one can download its database and query it offline. For example, https://en.wikipedia.org/wiki/Wikipedia:Database_download https://en.wikipedia.org/wiki/Wikipedia:Database_download https://download.kiwix.org/zim/ https://download.kiwix.org/zim/ Some other ways to search and read Wikipedia offline: XOWA: (S: XOWA) WikiTaxi: S: WikiTaxi (for Windows) aarddict: S: Aard Dictionary BzReader: S: BzReader and MzReader (for Windows) Selected Wikipedia articles as a printed document: Help:Printing Wiki as E-Book: S: E-book WikiFilter: S: WikiFilter Wikipedia on rockbox: S: Wikiviewer for Rockbox
- ngcc_hk 4y ago
  Saw that page: https://en.m.wikipedia.org/wiki/Wikipedia:Database_download https://en.m.wikipedia.org/wiki/Wikipedia:Database_download and where which will be suitable for ebook reader for free.
mgarciaisaia 4y ago
The real, important value of implementing IP over WhatsApp (in a proper, transparent way as other commenters are stating, and not from a chatbot as in the article) is not to avoid paying $5 for WiFi on a plane, but to protest the lack of net neutrality in an effective way.
DeathArrow 4y ago
I fail to see the practicality of this. Since the reason presented was not to pay for WiFi but you still have to pay a service like Twillio if you want to construct a Whatsapp to whatever gateway. Also, why not construct a Whatsapp to HTTP gateway, since pictures and other binary data can be transformed with ease into text by something like base64 encoding. Sure, it would still not be practical, but it would be a better proof of concept.
jamal-kumar 4y ago
I've tried this before, it's a fucking nightmare lol it's not full-duplex at all so this severely limits your ability to do things at a reasonable speed for most shit. For me it was because at the time Zuckerbutt was giving out 'free' internet in the third world, but only for whatsapp, instagram, and facebook, so me and my friends wanted to see if this was exploitable, but it was just way too slow. It really gave me an impression of how fast TCP runs at normally which I took for granted before, and ideally bidirectionally fast. For airport wifi I use a DNS tunnel or simple MAC rotation, for in-flight... well if they could make it quality someday maybe but every time I've shelled out like 50 bucks for an hour or whatever the ripoff deal is it doesn't work well enough to do anything. I hear the DNS tunnel method does work on some of them though, I should try that someday. As a side note those in-flight screens in the backs of seats are interesting in this 'why the hell would they do this' kind of way. I managed to crash one when I noticed it had a USB port (bad idea on their part)... It was super easy, I tried to read the USB key but then just removed it when it was accessing the thing and the whole thing just went down. Apparently it was running x-windows on some type of *nix because I could see that default background with an X for the cursor. They should really get rid of those because I'm sure that they could be misused for nefarious ends.
- lidder86 4y ago
  Vpn over websocket.. in Indonesia even worked when they "turn" off the internet for nyepi with a simple host file hack as you could browse the isp website was based on name not IP so yes the vpn was unencrypted but you couldn't see it was a vpn
- anaganisk 4y ago
  What nefarious needs other than probably playing shrek2 on the inflight entertainment systems?
  - jamal-kumar 4y ago
    I think someone I read about on a link from here actually demonstrated a badusb attack
xeromal 4y ago
This reminds me of back in the day when internet cost on mobile phones. An og "hacker" could text a website to some number he had set up and it would MMS him back a picture of the website. Worked in a pinch. This was in 2005-2008ish. I can't remember who did it though. So many years ago.
kgeist 4y ago
My first thought was to abuse the Web client. Run a server somewhere which hooks into JS in headless Chrome, parses commands and sends messages (requires a dummy user). The client could be based on the Web client, too. But I'm not sure if it's feasible and it's probably against the Terms of Use.
punnerud 4y ago
“WhatsApp messages are limited to 1600 characters” If that is UTF32 we have 51200 bytes or 50kB per message. “the basic free accounts I was using rate-limit to ~1QPS” That is 400kbit/s. Can we have multiple accounts? 40 accounts would give us a theoretical maximum speed of 16Mbit/. Would probably closer to 10Mbit/s in real life, enough to watch movies. Example library for sending/receiving WhatsApp text: https://github.com/open-wa/wa-automate-python https://github.com/open-wa/wa-automate-python
kmarc 4y ago
Cool pet project, admirable engineering etc. My comment is about something else: net neutrality, as someone already mentioned. I was teaching English in Laos for school kids. I was amazed that some of their families struggle with providing (nutritious enough) food for their children, yet, everyone had smartphones with always-on 4G,even in the countryside - however, no WiFi almost anywhere. The brains of these kids are like sponge. They WANT to learn, they're shy, but they want to speak, to read, to practice English. They also like to (constantly) sing (something that is badly missing from western schools), so at one point I referred them to "simple English Wikipedia", where they can research their favorite singers with easy-to-process articles. Empty stares. "so instead of Wikipedia.org, you go to simple.wikipedia.org." Still nothing. I had to realize later that even if they knew that this free, always available encyclopedia exists, it's NOT included in their 4G subscription. Yes, you guessed correctly: those subscriptions are sponsored by big US / Chinese corps, so all these kids had were Facebook, Instagram, WhatsApp and TikTok, everything else costs ~10$ which is days worth of meals for whole families there.
- 867-5309 4y ago
  in this instance a simple vpn or proxy should suffice. they could get by on free subscriptions for textual content
  - Snowworm 4y ago
    If they whitelisted only social media rather than blacklisting websites, I highly doubt a VPN or proxy would work unless it was provided by Google, Facebook or Tiktok.
  - kmarc 4y ago
    > vpn > proxy These are solutions for ME and YOU when we are there as tourists (if we really want to chop off that $10 from our travel budget). Probably not a solution for people who have never heard of websites like Wikipedia.
    - 867-5309 4y ago
can16358p 4y ago
Would this be extended to tunnel an SSH session over WhatsApp? While obviously not super convenient, it'd be interesting to type commands and get results. Of course any interactive terminal wouldn't work, but for simple commands, executing scripts and seeing logs etc. this should work.
jonathantf2 4y ago
The last time I was on an flight that had WiFi (AA about 5 years ago) I tried 2 ways to get around the captive portal, both successful: 1. Setting my useragent to iOS Safari and trying to download the Gogo Player app to watch one of the free films. If you have Android this just serves the APK but on iOS it just has to dump you to the App Store. This seemed to give me a good half hour of connectivity. 2. I went on the live chat and asked for a free connection. The agent gave it to me.
antman 4y ago
Looks like a generalizable solution. Is there an option to also embed images?
c_o_n_v_e_x 4y ago
Cool project.. reminds me of all the phreaking websites I used to read as a teen.
Nextgrid 4y ago
Almost a decade ago a French mobile carrier had their entire domain and subdomains zero-rated - one of the subdomains had a phpBB forum - someone created a little script to tunnel full layer 3 communication over the forum’s private messaging functionality. I’d imagine it would slaughter the DB if you tried to pass any significant traffic though it but as a demonstration it was cool and worked fine.
anon4da8e87f 4y ago
nice project, I've did something like this too, except I tunneled the internet traffic through SMS, so I could access the internet through my feature phone lol
umvi 4y ago
Cool project, but to me this feels like the "how to make a meal out of free condiments at restaurants" life hacks. In my opinion, just pay for the service. Satellite internet systems are not cheap to stand up or operate.
turdnagel 4y ago
For some reason I just eat these kinds of projects up. As a kid I went on a cruise with my parents with very limited internet access and discovered HTTP-over-DNS (using TXT records), which remains my favorite captive portal workaround.
anthk 4y ago
Iodine+Mosh against a VPS/Unix Tilde=huge array of text based services. IM, Mail, Text web, ebook reading...
diebeforei485 4y ago
Telegram has a lot of bots that do essentially this. But because WhatsApp is owned by Facebook, they have more business deals so you zero-rating in these situations.
Gtex555 4y ago
I actually had a very similar idea but the twist is in Africa we don't have access to affordable internet for the average student but we have greatest discounted bundles for social media apps like whatsApp, instagram and facebook. I wanted to use whatsApp to send a screenshot of googles first result page for a given query.
Abishek_Muthian 4y ago
If anyone's looking to reproduce this but in a no-code way then I have a setup to send and receive WhatsApp messages via email[1] using android VM and tasker which could be modified/extended for retrieving other data. But OP method has lesser moving parts and more easily reproducible if coding is not the barrier. [1] https://abishekmuthian.com/send-and-receive-whatsapp-messages-through-email/ https://abishekmuthian.com/send-and-receive-whatsapp-message...
dTal 4y ago
How is it technically possible for Delta to limit WhatsApp to "text and emojis"? Is media not end-to-end encrypted?

369 points by otras 4y ago

here an idea: take a screenshot of the website and send it back as a compressed base64 text or what ever will produce smallest result then decode that image from the text on your phone

kilroy123 4y ago
Yeah this seems much better. Very doable over WhatsApp.

Group_B 4y ago

These are my favorite kind of projects.

hamiltonians 4y ago

cool hack

Drblessing 4y ago

Had this exact same idea on my last flight! If Telegram is an approved messenger you could also create a pretty unrestricted bot there too. Very cool.

xeromal 4y ago
On the planes I've flown with messaging enabled, I usually only see IMessage, whatsapp, and facebook messenger.
- Drblessing 4y ago
  Shockingly Signal was working on my last flight - maybe telegram works but they don't advertise?
  - nyuszika7h 4y ago
    Maybe it has to do something with WhatsApp also using the Signal protocol, though you'd think generally they'd whitelist IPs or hostnames rather than doing DPI.
    - Drblessing 4y ago
      What's DPI? I have no idea how this whitelisting works but I'm curious!
      - blacksmith_tb 4y ago
        Deep Packet Inspection: https://www.fortinet.com/resources/cyberglossary/dpi-deep-packet-inspection https://www.fortinet.com/resources/cyberglossary/dpi-deep-pa...

5- 4y ago

nice! next up: encapsulate ip to provide full networking (with terrible latency) also just in case someone is wondering, a more ergonomic solution specifically for reading wikipedia on a plane is https://kiwix.org https://kiwix.org

MauranKilom 4y ago

Wait, is this filtering based on IP or DNS? How do they make sure their whitelist remains up to date? (I assume it's HTTPS, so those are basically the only two options...) If it's DNS based, there should be simpler workarounds, so I guess it's just IP based?

cortesoft 4y ago
It is pretty simple... your filter just makes periodic DNS requests to the desired allowed host and updates it's IP restrictions to the returned address. You also need to run the DNS resolver to return that same cached IP to prevent having the upstream DNS server return a different address. You also need to make sure the DNS server will only resolve the domains you want it to, because if you allow unfiltered dns requests to arbitrary domains, anyone can then tunnel their traffic over DNS, as another comment on this thread pointed out.
- stefan_ 4y ago
  I don't understand, what's the domain of.. WhatsApp? Not to mention you are just as likely to hit some Round-Robin configuration.
  - axiosgunnar 4y ago
    This is a very good question. I would also assume that Whatsapp might change the servers used with updates of the app. How would Delta deal with that? Just wait for the complaints to come in?
    - cranekam 4y ago
      WhatsApp (now, since it moved into FB's infra) connects to g.whatsapp.net, which is a CNAME to chat.cdn.whatsapp.net, which in turn is an A record to a VIP on Facebook's edge network. The A record you're returned can change — it's intended to be one that's closest to you (as determined by your DNS resolver's location and probably EDNS Client Subnet) but traffic engineering policies might cause different responses over time. Since on a flight it's likely everyone will use the same resolver on the ground somewhere in Delta's infrastructure a simple mechanism to resolve the IP periodically and update a whitelist (or to cache one VIP location and always return that) might work. Alternatively, as other commenters have suggested, it'd be better to identify traffic with SNI or other profiling. Updates to the app almost certainly won't change the address it connects to.

userbinator 4y ago

I wonder if anyone has stated a general law along the lines of "if you can send and receive a bit, you can send and receive anything." The only issues ended up being that 1) WhatsApp messages are limited to 1600 characters Concidentally, that's not much bigger than the MTU of standard Ethernet. I don't know how "transparent" the data channel is with respect to non-ASCII (and probably Unicode), but if you use one of the various binary-to-text encodings that exist, you could probably implement Ethernet over WhatsApp. ;-)

EMIRELADERO 4y ago
> I wonder if anyone has stated a general law along the lines of "if you can send and receive a bit, you can send and receive anything." In my country we have a telecom service provider law, which states, among other things: ARTICLE 57. - Network neutrality. Prohibitions. Service Providers shall not: a) Block, interfere, discriminate, hinder, degrade or restrict the use, sending, reception, offering or access to any content, application, service or protocol except by court order or explicit request of the user.
- lolinder 4y ago
  I think OP meant "law" as in "law of gravity" not as in legality.
cortesoft 4y ago
I don't think that is necessarily a law. There would be ways to actually restrict access in better ways... you would likely be right if you amended it to the ability to send a bit to an endpoint you control.
- iratewizard 4y ago
  After writing code for locking down tablets used by prison inmates, I definitely agree that it's not much of a law.
  - 4y ago

Egrodo 4y ago

I think about creating this project every time I'm on a Delta flight, great to see someone actually did it.

mmh0000 4y ago

Many years ago (2012) Delta inflight wifi would allow DNS queries out without paying. Being a very frequent flyer I used to run an ip-over-dns tunnel using Iodine[1]. It was slow but worked. I wonder if they’ve blocked that hole yet. [1] https://code.kryo.se/iodine/ https://code.kryo.se/iodine/

deleted 4y ago
[deleted]
zamadatix 4y ago
When selecting my personal use domain I ended spent some time finding a short domain partly because it's convenient but partly because it meant more goodput via Iodine. I ended up on "ds.gy" as ds are my initials and it was the only TLD that domain wasn't sat on by squatters wanting to charge thousands.The ratio of people wanting to sell you short domains vs actually using them in any capacity was surprising.
siraben 4y ago
I can confirm that this still works on several US airlines especially if they have a free messaging option.
iforgotpassword 4y ago
I did the same on trains in the 00s, but built application specific tunnels which were much faster, funnily enough among them was one that would fetch Wikipedia pages. The client would piece together the replies and render the markup to html again.
Macuyiko 4y ago
I also used this a lot while travelling to access the internet through captive wifi portals. Especially in asia this worked very well, given the huge amount of telco wifi providers in cities.
kache_ 4y ago
lol holy shit I'm never going to have an unproductive flight again

hegzploit 4y ago

Would it be possible to spoof the host and get free internet, that's something I've always thought about when facing such limits.

cortesoft 4y ago
No, because they aren't basing it on the host header or something.

joshvm 4y ago

My experience with in-flight message-only WiFi is that they're just really slow and the ping times are long. Some services are actively blocked, e.g. Skype wouldn't work at all even for text messages, but browsing the internet is usually allowed. My VPN wouldn't work, but I suspect it might have if I used an obfuscated connection instead of OpenVPN or whatever the default is (e.g. over SSL). I could load GMail in the browser and Wikipedia probably would have worked. It's strongly website dependent. Hacker News is extraordinarily resilient to lousy connections and generally the index would always load without any trouble. It works even on a 3 second ping over satellite internet. Very few websites are that tolerant. The flight crew (BA) knew what's up. They specifically warned us to check which package we were getting, because evidently they get a lot of complaints when people buy the message-only bundle and are surprised that nothing works. Singapore gave out free passes for single devices last time I flew with them. It was possible to rotate MAC addresses by forgetting the connection and then re-joining. The connection was quite good, you could watch YouTube in potato resolution. It's quite fun to chat to people and send them photos out of the window.

jjeaff 4y ago
I carry one of those tiny wireless routers in my carry on wherever I go. If I have to buy internet on the plane or if I am in a hotel that limits the number of devices, I always connect through the router and use it as an access point for all the other devices. The other added benefit is that all my other devices already have my AP's wifi creds and will connect to it automatically.
- darig 4y ago
- t-0 4y ago
  I've been thinking about doing somethign similar and am really interested in what hardware you're using for this and what your setup looks like. Do you run a VPN service directly on your router, for example?
  - 4y ago

aledalgrande 4y ago

On a recent flight I bought a "streaming" package, was either the most expensive or second most. Could barely navigate to web pages.

smashah 4y ago

You'd be surprised what kind of automations people build on top of WhatsApp. Also, you can use free alternatives to the Twilio API to do more than just text-based automation.

timetraveller26 4y ago

In a good world we would have free wikipedia access anywhere, no cost. Then we could learn anything we needed. https://xkcd.com/548/ https://xkcd.com/548/

deleted 4y ago
[deleted]
aero-glide2 4y ago
That doesn't follow net neutrality though.

quelltext 4y ago

This is basically a chat bot interface. Google used to have a way to ask for searches via SMS a while ago: https://www.youtube.com/watch?v=J937N9m-XtE https://www.youtube.com/watch?v=J937N9m-XtE But "tunneling" to me implies some transparent layer allowing you to browse Wikipedia via the same way of interaction.

rschachte 4y ago

One thing that would be interesting is scanning for open ports. Once you find an open port, make a Twilio API and text the number (Since most airlines enable texting via SMS/Whats APP) that triggers opening the port on your VPS that is opened on the airplane. Once you do that, you can tunnel into your VPS through the airlines open port or SSH into the machine. If you create a SOCKS5 proxy, then all traffic in your browser will tunnel through the VPS. Haven't tried this, but just a thought.

2Gkashmiri 4y ago
Back in 2019 when Indian government put a city of 8 million into a 9 month curfew including internet blackout, I was anxious yo get online. Then they permitted only dozen of "white listed websites", just ones that did not allow anti India propaganda. Anyways, I found amazon India worked. I went to aws, set up a vps and simply used ssh tunnel to it. It worked, for a bit. They closed the default port and I could not spend time on a dedicated public internet terminals to " test" open ports so yeah, I have done exactly that. Used foxyproxy btw
- vgb2k18 4y ago
  >Used foxyproxy btw HAProxy is also really useful for this purpose, I dare say more-so. For my use-case it solved this problem: "Using 1 port on the remote server (port 443), how can I serve HTTPS (serve a website) and SSH or SOCKS5 (use the server as a proxy)?". HAProxy was good for the task. It could be used to tunnel SSH through HTTPS too, in the case where a corp firewall is using DPI to block standard SSH. What I'm not sure of though... can it tunnel SSH through HTTPS, and, serve a website at the same time? That's a question for the reader. The idea of serving a website at the same time was for the purpose of providing a plausible reason for traffic exists from that server. Like, you know, if the admin's see traffic on 443 from an ip/domain with no website, that's got to be a magnitude of suspicion higher than an ip/domain with an actual website being served on it.
  - toast0 4y ago
    Sure. If you run an https proxy that allows CONNECT, that can tunnel ssh, but if you do GET without a fully qualified url, that can serve whatever according to the host header. If you just wanted to tunnel ssh over tls, it's trickier because ssh is server speaks first and http is client speaks first, so as a server, you'd have to guess if your client wants one or the other.

7402 4y ago

Sure, it's always interesting to investigate vulnerabilities and design deficiencies, and it can be beneficial especially when the goal is improving security for everyone. But it's hard for me to celebrate someone whose motivation seems to be that they are simply too cheap to pay for something that other, more honest, people are willing to pay for. In this case, it probably doesn't affect anyone else if the author only downloads a few articles, but in general, if internet bandwidth on an airplane is a limited resource, then using large amounts up in this way to the detriment of others would just be stealing.

redox99 4y ago
Most people wouldn't mind some kind of throttling, as long as it is net neutral. The problem here is the lack of net neutrality.

1vuio0pswjnm7 4y ago

Of all the possible websites to choose as an example, Wikipedia is a strange choice since, unlike most websites, one can download its database and query it offline. For example, https://en.wikipedia.org/wiki/Wikipedia:Database_download https://en.wikipedia.org/wiki/Wikipedia:Database_download https://download.kiwix.org/zim/ https://download.kiwix.org/zim/ Some other ways to search and read Wikipedia offline: XOWA: (S: XOWA) WikiTaxi: S: WikiTaxi (for Windows) aarddict: S: Aard Dictionary BzReader: S: BzReader and MzReader (for Windows) Selected Wikipedia articles as a printed document: Help:Printing Wiki as E-Book: S: E-book WikiFilter: S: WikiFilter Wikipedia on rockbox: S: Wikiviewer for Rockbox

ngcc_hk 4y ago
Saw that page: https://en.m.wikipedia.org/wiki/Wikipedia:Database_download https://en.m.wikipedia.org/wiki/Wikipedia:Database_download and where which will be suitable for ebook reader for free.

mgarciaisaia 4y ago

The real, important value of implementing IP over WhatsApp (in a proper, transparent way as other commenters are stating, and not from a chatbot as in the article) is not to avoid paying $5 for WiFi on a plane, but to protest the lack of net neutrality in an effective way.

DeathArrow 4y ago

I fail to see the practicality of this. Since the reason presented was not to pay for WiFi but you still have to pay a service like Twillio if you want to construct a Whatsapp to whatever gateway. Also, why not construct a Whatsapp to HTTP gateway, since pictures and other binary data can be transformed with ease into text by something like base64 encoding. Sure, it would still not be practical, but it would be a better proof of concept.

jamal-kumar 4y ago

I've tried this before, it's a fucking nightmare lol it's not full-duplex at all so this severely limits your ability to do things at a reasonable speed for most shit. For me it was because at the time Zuckerbutt was giving out 'free' internet in the third world, but only for whatsapp, instagram, and facebook, so me and my friends wanted to see if this was exploitable, but it was just way too slow. It really gave me an impression of how fast TCP runs at normally which I took for granted before, and ideally bidirectionally fast. For airport wifi I use a DNS tunnel or simple MAC rotation, for in-flight... well if they could make it quality someday maybe but every time I've shelled out like 50 bucks for an hour or whatever the ripoff deal is it doesn't work well enough to do anything. I hear the DNS tunnel method does work on some of them though, I should try that someday. As a side note those in-flight screens in the backs of seats are interesting in this 'why the hell would they do this' kind of way. I managed to crash one when I noticed it had a USB port (bad idea on their part)... It was super easy, I tried to read the USB key but then just removed it when it was accessing the thing and the whole thing just went down. Apparently it was running x-windows on some type of *nix because I could see that default background with an X for the cursor. They should really get rid of those because I'm sure that they could be misused for nefarious ends.

lidder86 4y ago
Vpn over websocket.. in Indonesia even worked when they "turn" off the internet for nyepi with a simple host file hack as you could browse the isp website was based on name not IP so yes the vpn was unencrypted but you couldn't see it was a vpn
anaganisk 4y ago
What nefarious needs other than probably playing shrek2 on the inflight entertainment systems?
- jamal-kumar 4y ago
  I think someone I read about on a link from here actually demonstrated a badusb attack

xeromal 4y ago

This reminds me of back in the day when internet cost on mobile phones. An og "hacker" could text a website to some number he had set up and it would MMS him back a picture of the website. Worked in a pinch. This was in 2005-2008ish. I can't remember who did it though. So many years ago.

kgeist 4y ago

My first thought was to abuse the Web client. Run a server somewhere which hooks into JS in headless Chrome, parses commands and sends messages (requires a dummy user). The client could be based on the Web client, too. But I'm not sure if it's feasible and it's probably against the Terms of Use.

punnerud 4y ago

“WhatsApp messages are limited to 1600 characters” If that is UTF32 we have 51200 bytes or 50kB per message. “the basic free accounts I was using rate-limit to ~1QPS” That is 400kbit/s. Can we have multiple accounts? 40 accounts would give us a theoretical maximum speed of 16Mbit/. Would probably closer to 10Mbit/s in real life, enough to watch movies. Example library for sending/receiving WhatsApp text: https://github.com/open-wa/wa-automate-python https://github.com/open-wa/wa-automate-python

kmarc 4y ago

Cool pet project, admirable engineering etc. My comment is about something else: net neutrality, as someone already mentioned. I was teaching English in Laos for school kids. I was amazed that some of their families struggle with providing (nutritious enough) food for their children, yet, everyone had smartphones with always-on 4G,even in the countryside - however, no WiFi almost anywhere. The brains of these kids are like sponge. They WANT to learn, they're shy, but they want to speak, to read, to practice English. They also like to (constantly) sing (something that is badly missing from western schools), so at one point I referred them to "simple English Wikipedia", where they can research their favorite singers with easy-to-process articles. Empty stares. "so instead of Wikipedia.org, you go to simple.wikipedia.org." Still nothing. I had to realize later that even if they knew that this free, always available encyclopedia exists, it's NOT included in their 4G subscription. Yes, you guessed correctly: those subscriptions are sponsored by big US / Chinese corps, so all these kids had were Facebook, Instagram, WhatsApp and TikTok, everything else costs ~10$ which is days worth of meals for whole families there.

867-5309 4y ago
in this instance a simple vpn or proxy should suffice. they could get by on free subscriptions for textual content
- Snowworm 4y ago
  If they whitelisted only social media rather than blacklisting websites, I highly doubt a VPN or proxy would work unless it was provided by Google, Facebook or Tiktok.
- kmarc 4y ago
  > vpn > proxy These are solutions for ME and YOU when we are there as tourists (if we really want to chop off that $10 from our travel budget). Probably not a solution for people who have never heard of websites like Wikipedia.
  - 867-5309 4y ago

can16358p 4y ago

Would this be extended to tunnel an SSH session over WhatsApp? While obviously not super convenient, it'd be interesting to type commands and get results. Of course any interactive terminal wouldn't work, but for simple commands, executing scripts and seeing logs etc. this should work.

jonathantf2 4y ago

The last time I was on an flight that had WiFi (AA about 5 years ago) I tried 2 ways to get around the captive portal, both successful: 1. Setting my useragent to iOS Safari and trying to download the Gogo Player app to watch one of the free films. If you have Android this just serves the APK but on iOS it just has to dump you to the App Store. This seemed to give me a good half hour of connectivity. 2. I went on the live chat and asked for a free connection. The agent gave it to me.

antman 4y ago

Looks like a generalizable solution. Is there an option to also embed images?

c_o_n_v_e_x 4y ago

Cool project.. reminds me of all the phreaking websites I used to read as a teen.

Nextgrid 4y ago

Almost a decade ago a French mobile carrier had their entire domain and subdomains zero-rated - one of the subdomains had a phpBB forum - someone created a little script to tunnel full layer 3 communication over the forum’s private messaging functionality. I’d imagine it would slaughter the DB if you tried to pass any significant traffic though it but as a demonstration it was cool and worked fine.

anon4da8e87f 4y ago

nice project, I've did something like this too, except I tunneled the internet traffic through SMS, so I could access the internet through my feature phone lol

umvi 4y ago

Cool project, but to me this feels like the "how to make a meal out of free condiments at restaurants" life hacks. In my opinion, just pay for the service. Satellite internet systems are not cheap to stand up or operate.

turdnagel 4y ago

For some reason I just eat these kinds of projects up. As a kid I went on a cruise with my parents with very limited internet access and discovered HTTP-over-DNS (using TXT records), which remains my favorite captive portal workaround.

anthk 4y ago

Iodine+Mosh against a VPS/Unix Tilde=huge array of text based services. IM, Mail, Text web, ebook reading...

diebeforei485 4y ago

Telegram has a lot of bots that do essentially this. But because WhatsApp is owned by Facebook, they have more business deals so you zero-rating in these situations.

Gtex555 4y ago

I actually had a very similar idea but the twist is in Africa we don't have access to affordable internet for the average student but we have greatest discounted bundles for social media apps like whatsApp, instagram and facebook. I wanted to use whatsApp to send a screenshot of googles first result page for a given query.

Abishek_Muthian 4y ago

If anyone's looking to reproduce this but in a no-code way then I have a setup to send and receive WhatsApp messages via email[1] using android VM and tasker which could be modified/extended for retrieving other data. But OP method has lesser moving parts and more easily reproducible if coding is not the barrier. [1] https://abishekmuthian.com/send-and-receive-whatsapp-messages-through-email/ https://abishekmuthian.com/send-and-receive-whatsapp-message...

dTal 4y ago

How is it technically possible for Delta to limit WhatsApp to "text and emojis"? Is media not end-to-end encrypted?