10 ms·
Russian here. Roskomnadzor's capabilities for blocking TOR are quite sufficient to cripple TOR's capabilities to the point of making it unusable as a VPN servic
by Andrew_nenakhov 4y ago
Russian here. Roskomnadzor's capabilities for blocking TOR are quite sufficient to cripple TOR's capabilities to the point of making it unusable as a VPN service, unless you set up your own private TOR ramp, which in this case is essentially the same as personal VPN, but much more slow.
The algorithm is quite simple:
1. Attempt to connect to TOR
2. If it connects, blacklist the IP, goto 1.
3. TOR is unavailable
(If an anonymous TOR user can obtain bridge address, shared by any means, email, Signal, messenger pigeons or whatever, RKN operative can obtain it as well)
- cowtools 4y agoA solution that Tor has been using with china is to host bridges on something like AWS. In order for china to block the bridges, they must also block all of AWS IP space. https://media.ccc.de/v/26c3-3554-de-tor_and_censorship_lessons_learned https://media.ccc.de/v/26c3-3554-de-tor_and_censorship_lesso...
- dilyevsky 4y agoThat’s exactly what telegram did when they had their famous battle against rkn
- cowtools 4y agoTor is not really comparable to telegram. check out that link I posted, that talk goes over a lot of details that I am currently at a loss of words for.
- defanor 4y agoAnd large subnets were blocked back then, blocking many unrelated websites/services at once. IIRC even some of RKN's own services were temporarily disrupted by that, but generally they don't shy away from inflicting collateral damage. There's no shortage of cases of blocking large websites for humorous or silly pictures and texts (not even political), too.
- dilyevsky 4y agoYes and eventually rkn had to back down and walk that back (maybe less of a concern for them today tho)
- Andrew_nenakhov 4y agoRKN only backed down only because it was a PR stunt where it played the role of an inept villain.
- markdestouches 4y agoSo you're implying that Telegram is essentially Kremlin's project. Any other reasons you believe this is the case?
- sudosysgen 4y agoProbably because Telegram wasn't removed from the App Store.
- jacooper 4y agoTelegram is already shady, it has no clear funding source while having the highest operating cost of any of the main stream chat apps due to it storing everything you send with no limits. There is no e2e encryption, it has access to everything you do, its often said to be an alternative to WhatsApp, but its mostly worse in privacy, WhatsApp has proven encryption at least, and encrypted backups on android, while on apple its basically a back door. And the explanation up to now is that durov is paying for everything for the faint of heart, which I really don't believe. Matrix on paper is a good alternative, but its clients are not even close, and I speak as a daily matrix user.
- dilyevsky 4y agoTechnically telegram does have optional e2e but group chats weren’t supported last i checked. Source on operational costs? Dont they have “telegram premium” thing to earn money now?
- Andrew_nenakhov 4y agoWhen they had their famous PR campaign closely coordinated with RKN. Telegram wasn't even removed from appstores, unlike Navalny'a app a bit later or LinkedIn a bit earlier.
- WaitWaitWha 4y agoAWS is required to provide all data flowing in and out of datacenters to the Government.
- cowtools 4y agoDoesn't matter, it is just a bridge node. Tor is resilient to that mode of attack.
- moffkalast 4y agoAmerican yes, Chinese no.
- metadat 4y agoAnd even then, only with a warrant.
- trasz 4y agoNot true - a secret kangaroo “FISA court” can arbitrarily force them to do anything and there’s no rea oversight thanks to gag orders.
- viraptor 4y agoDepends on the region. us-east-1 - us. cn-north-1 - both.
- nazka 4y agoWait so does it mean that technically right the internet of China is more open than Russia?
- anticensor 4y agoGreat Firewall has a protocol and destination whitelisting, so no.
- WaitWaitWha 4y agoIf you are stating that AWS is required to provide all data flowing in and out of datacenters to the USA Government, but not the Chinese government, then you are 100% wrong. This is why Chinese regions have to replicate nearly all services in their own regions. No intermingling with other regions.
- Andrew_nenakhov 4y agoRoskomnadzor can block whole AWS and there will be neither rioting not even a significant outrage. They can even turn to whitelisting. The only reason they don't do it is that it is still considered unnecessary.
- cowtools 4y agoWill they ban every VPS provider?
- n4bz0r 4y agoThey've already got their hands on ProtonVPN, Nord VPN, Opera VPN and a number (about 8-10, I think?) of others. Their system analyzes all the traffic and tries to identify VPN packets, so I don't really see why wouldn't they block all the providers should they need to. There are still ways to mask the traffic, but a regular user can only be bothered so much. Yes, many businesses rely on VPN, but I can imagine that RKN might just come up with some great white-list idea.
- yardstick 4y ago> Yes, many businesses rely on VPN, but I can imagine that RKN might just come up with some great white-list idea. Plus with the sanctions it’s unlikely there is much need for western businesses to run VPNs into Russia.
- johannes1234321 4y agoNot for businesses, but for human rights organisations, foreign governments, idealists, ...
- Dracophoenix 4y agoIs something like Algo or GoodbyeDPI a more workable solution? https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-that-works/ https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-th... https://github.com/ValdikSS/GoodbyeDPI https://github.com/ValdikSS/GoodbyeDPI
- inglor_cz 4y agoChina also does not seem to be willing to burn all the bridges to the rest of the world just yet, so it has to accept some kind of interconnection to services like AWS that aren't under its control.
- trasz 4y ago“Just yet”? China is number one industrial superpower, you can’t have that with bridges burned. In fact China is going the exact opposite way, see the Belt and Road.
- NicoJuicy 4y agoBelt and road it's investments have been decimated as far as I know.
- trasz 4y agoI believe it’s mostly those in Russia, because it become useless from both commercial (embargoes on everything make Russian transport worthless) and political (don’t want your problematic vassal control something crucial to your economy) point or view. Funds have been shifted to countries like Kazakhstan.
- schleck8 4y agoThere is also Snowflake bridges which are run by individuals using a browser extension https://community.torproject.org/relay/setup/snowflake/ https://community.torproject.org/relay/setup/snowflake/
- godelski 4y agoDidn't Signal do something like this and get in trouble?[0] I honestly don't know much about domain fronting so if this is something completely different than I'd appreciate an explanation. I do know that my friends in China are unable to use Signal, so I figure something is up. [0] https://signal.org/blog/looking-back-on-the-front/ https://signal.org/blog/looking-back-on-the-front/
- schoen 4y agoDomain fronting was (and to a lesser extent still is) mainly about using CDN infrastructure so that clients appear (to a network censor) to be connecting to one CDN customer, but then ask the CDN to actually let them talk to a different CDN customer. (There are various protocol-layering tricks that may enable this either by accident or on purpose.) This is a little different than using VPS services because with the VPS services you're actually connecting to the customer you appear to be connecting to, it's just very unclear who that is, because it's just one random VPS customer among a huge number of servers hosted on that same service.
- godelski 4y agoAh, thanks for the explanation. I do have a followup though. If this method is successful for Tor, why isn't it for Signal? I was under the impression that they used AWS and other servers. Or are they just not doing this and leaving an (easy?) censorship mitigation opportunity unsolved?
- schoen 4y agoI believe Tor has a more active anti-censorship project than Signal does. While I don't think Signal is in any sense OK with governments blocking it, the Tor folks have something along the lines of a whole anti-censorship team (part paid and part volunteer). I don't believe Signal has a direct equivalent to that. There could also be an element of luck or differences in how strongly particular governments are trying to block particular apps and circumvention methods at a given moment. I know that varies a lot from country to country. Edit: However, Signal does have a "Censorship circumvention" feature under "Advanced" options. So there is some level of official work on that from Signal. Have your friends tried this feature?
- sneak 4y agoWhy must they block all? They can just block the IPs running bridges.
- stingraycharles 4y ago> (If an anonymous TOR user can obtain bridge address, shared by any means, email, Signal, messenger pigeons or whatever, RKN operative can obtain it as well) As a Tor relay operator, this always seemed like the most silly aspect of bridges: if someone really wanted to block Tor, wouldn’t they just block any bridges they encountered?! Some of the bridges are even published on public pages, wouldn’t that defeat the whole point of bridges in the first place?
- cowtools 4y agoMany private bridges are distributed privately through cell systems.
- Andrew_nenakhov 4y agoI was talking only about public bridges, because this is the use-case that RKN is trying to prevent: people have a free way to access blocked information. People who have means find/access a private bridge can have a private VPN too, and it'll work much better for this purpose. Btw, it is quite difficult now to have private bridge or VPN because of idiotic ban on Mastercard / visa payments Russians can't pay for hosting without a lot of trouble. While inside radishes Russia Mastercard/Visa work fine. Putin is happy: dissidents are cut off, his supporters didn't even notice.
- jacooper 4y agoApparently "Salmon" is intended to fix this. > Tor is also working to stop the potential abuse of bridges. In 2016, researchers proposed a system called Salmon that aims to weed out those accessing bridge details with the intent of blocking or abusing them.
- Ajedi32 4y agoPretty old, but here's the paper: https://censorbib.nymity.ch/pdf/Douglas2016a.pdf https://censorbib.nymity.ch/pdf/Douglas2016a.pdf
- hutrdvnj 4y agoCan Tor work over IPv6?
- jeroenhd 4y agoTechnically, yes. Practically, well: https://blog.torproject.org/state-of-ipv6-support-tor-network/ https://blog.torproject.org/state-of-ipv6-support-tor-networ... However, Google reports a mere 3.51% IPv6 usage (compared to 51% in the USA) so I don't know how practical IPv6 would be even if all Tor nodes were fully usable over IPv6.
- controversial97 4y agoI have a low-capacity obfs4 tor proxy, it has been running for a few months and isn't blocked in Russia yet. It has about fifteen users each day, all connecting from Russian ISPs. I set it to only be announced by the telegram bot and only for a few weekends.
- thalassophobia 4y agoThank you!
- golergka 4y agoAnother Russian here. 99% of usage of Tor and Bitcoin is Russia is to purchase drugs — darknet has almost completely replaced street dealers in the whole country, and there's an addiction epidemic going on. At the same time, most of drug trade in Russia has been managed by various branches of police and secret police (actual police, rosgvardia, fsb, fskn in the past), and large marketplaces are likely directly owned by them. So there's a huge monetary incentive to keep Tor network available, which I think is much more important to people in power than a dozen or so journalists and activists who might publish some anti-government banalities on some darknet forum that nobody (unfortunately, in my personal view) reads or gives a shit about anyway. Russians at large know perfectly well that their media is censored and the government is corrupt. They just don't care.
- deleted 4y ago[deleted]
- tomcam 4y ago> who might publish some anti-government banalities on some darknet forum that nobody (unfortunately, in my personal view) reads or gives a shit about anyway. So true, so Slavic. I love the dark Russian humor and bracing cynicism. We're getting there ever so slowly in the USA...
- int_19h 4y agoA Russian and an American sinner die and end up in Hell. As they stand before Satan, he says: "I give you the choice of your punishment: you can spend eternity either in the American Hell, or in the Russian Hell." "What's the difference?", they ask. "In the American one you're force-fed a bucket full of shit every day. In the Russian one, you're force-fed two buckets. Other than that, you're free to do as you please." "Well, that's a no-brainer; I pick the American Hell", says the American. The Russian ponders for a while longer and says, "I'd rather stay in a familiar place; I'll go to the Russian Hell". A month has passed, and the sinners meet to compare notes. The Russian asks: "So, what's it like in your place?" "It's exactly as advertised; I have to eat a bucket of shit every day, regular as clockwork, but other than that I'm enjoying life. What about yours? I can barely get through one bucket, two must be horrible!" "Pah, it's not so bad. Most days, there's a shortage of shit, and they don't have enough to feed even one bucket to most of us. And sometimes the buckets get stolen altogether. Just like home; I love it!"
- systems_glitch 4y agoHey, we came up with that same system to force folks to use our .onion address on an IRC network, years ago.
- LinuxBender 4y agoIt is interesting to me that they explicitly block Tor. Russia appears to allow several commercial VPN providers. I only know this because I watch a handful of Russian youtube vloggers that try to show how things are going in their city or in their travels around Russia. That makes me wonder if they have an arrangement with those VPN providers to provide data on some of their users. Or perhaps another theory is that the vloggers have been coerced into working for the state but try to make it look like they oppose it.