6 ms·

A solution that Tor has been using with china is to host bridges on something like AWS. In order for china to block the bridges, they must also block all of AWS

A solution that Tor has been using with china is to host bridges on something like AWS. In order for china to block the bridges, they must also block all of AWS IP space. https://media.ccc.de/v/26c3-3554-de-tor_and_censorship_lessons_learned https://media.ccc.de/v/26c3-3554-de-tor_and_censorship_lesso...

dilyevsky 4y ago
That’s exactly what telegram did when they had their famous battle against rkn
- cowtools 4y ago
  Tor is not really comparable to telegram. check out that link I posted, that talk goes over a lot of details that I am currently at a loss of words for.
- defanor 4y ago
  And large subnets were blocked back then, blocking many unrelated websites/services at once. IIRC even some of RKN's own services were temporarily disrupted by that, but generally they don't shy away from inflicting collateral damage. There's no shortage of cases of blocking large websites for humorous or silly pictures and texts (not even political), too.
  - dilyevsky 4y ago
    Yes and eventually rkn had to back down and walk that back (maybe less of a concern for them today tho)
    - Andrew_nenakhov 4y ago
      RKN only backed down only because it was a PR stunt where it played the role of an inept villain.
      - markdestouches 4y ago
        So you're implying that Telegram is essentially Kremlin's project. Any other reasons you believe this is the case?
        sudosysgen 4y ago
        Probably because Telegram wasn't removed from the App Store.
        jacooper 4y ago
        Telegram is already shady, it has no clear funding source while having the highest operating cost of any of the main stream chat apps due to it storing everything you send with no limits. There is no e2e encryption, it has access to everything you do, its often said to be an alternative to WhatsApp, but its mostly worse in privacy, WhatsApp has proven encryption at least, and encrypted backups on android, while on apple its basically a back door. And the explanation up to now is that durov is paying for everything for the faint of heart, which I really don't believe. Matrix on paper is a good alternative, but its clients are not even close, and I speak as a daily matrix user.
        dilyevsky 4y ago
        Technically telegram does have optional e2e but group chats weren’t supported last i checked. Source on operational costs? Dont they have “telegram premium” thing to earn money now?
        jacooper 4y ago
        > Technically telegram does have optional e2e but group chats weren’t supported last i checked. And aren't supported on desktop either, no body uses them, they are severely limited on purpose. > Source on operational costs? Telegram saves everything you do on the platform, every message, every picture, every video, every file with no limit. They market it as a feature, on their twitter they often say you can use it as cloud storage. This absolutely costs more than WhatsApp or signal, which only use servers as relays. > Dont they have “telegram premium” thing to earn money now? Its a very recent thing, and it has a very minimal effect, and the previous years didn't just pay for themselves.
- Andrew_nenakhov 4y ago
  When they had their famous PR campaign closely coordinated with RKN. Telegram wasn't even removed from appstores, unlike Navalny'a app a bit later or LinkedIn a bit earlier.
WaitWaitWha 4y ago
AWS is required to provide all data flowing in and out of datacenters to the Government.
- cowtools 4y ago
  Doesn't matter, it is just a bridge node. Tor is resilient to that mode of attack.
- moffkalast 4y ago
  American yes, Chinese no.
  - metadat 4y ago
    And even then, only with a warrant.
    - trasz 4y ago
      Not true - a secret kangaroo “FISA court” can arbitrarily force them to do anything and there’s no rea oversight thanks to gag orders.
  - viraptor 4y ago
    Depends on the region. us-east-1 - us. cn-north-1 - both.
  - nazka 4y ago
    Wait so does it mean that technically right the internet of China is more open than Russia?
    - anticensor 4y ago
      Great Firewall has a protocol and destination whitelisting, so no.
  - WaitWaitWha 4y ago
    If you are stating that AWS is required to provide all data flowing in and out of datacenters to the USA Government, but not the Chinese government, then you are 100% wrong. This is why Chinese regions have to replicate nearly all services in their own regions. No intermingling with other regions.
Andrew_nenakhov 4y ago
Roskomnadzor can block whole AWS and there will be neither rioting not even a significant outrage. They can even turn to whitelisting. The only reason they don't do it is that it is still considered unnecessary.
- cowtools 4y ago
  Will they ban every VPS provider?
  - n4bz0r 4y ago
    They've already got their hands on ProtonVPN, Nord VPN, Opera VPN and a number (about 8-10, I think?) of others. Their system analyzes all the traffic and tries to identify VPN packets, so I don't really see why wouldn't they block all the providers should they need to. There are still ways to mask the traffic, but a regular user can only be bothered so much. Yes, many businesses rely on VPN, but I can imagine that RKN might just come up with some great white-list idea.
    - yardstick 4y ago
      > Yes, many businesses rely on VPN, but I can imagine that RKN might just come up with some great white-list idea. Plus with the sanctions it’s unlikely there is much need for western businesses to run VPNs into Russia.
      - johannes1234321 4y ago
        Not for businesses, but for human rights organisations, foreign governments, idealists, ...
    - Dracophoenix 4y ago
      Is something like Algo or GoodbyeDPI a more workable solution? https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-that-works/ https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-th... https://github.com/ValdikSS/GoodbyeDPI https://github.com/ValdikSS/GoodbyeDPI
inglor_cz 4y ago
China also does not seem to be willing to burn all the bridges to the rest of the world just yet, so it has to accept some kind of interconnection to services like AWS that aren't under its control.
- trasz 4y ago
  “Just yet”? China is number one industrial superpower, you can’t have that with bridges burned. In fact China is going the exact opposite way, see the Belt and Road.
  - NicoJuicy 4y ago
    Belt and road it's investments have been decimated as far as I know.
    - trasz 4y ago
      I believe it’s mostly those in Russia, because it become useless from both commercial (embargoes on everything make Russian transport worthless) and political (don’t want your problematic vassal control something crucial to your economy) point or view. Funds have been shifted to countries like Kazakhstan.
schleck8 4y ago
There is also Snowflake bridges which are run by individuals using a browser extension https://community.torproject.org/relay/setup/snowflake/ https://community.torproject.org/relay/setup/snowflake/
godelski 4y ago
Didn't Signal do something like this and get in trouble?[0] I honestly don't know much about domain fronting so if this is something completely different than I'd appreciate an explanation. I do know that my friends in China are unable to use Signal, so I figure something is up. [0] https://signal.org/blog/looking-back-on-the-front/ https://signal.org/blog/looking-back-on-the-front/
- schoen 4y ago
  Domain fronting was (and to a lesser extent still is) mainly about using CDN infrastructure so that clients appear (to a network censor) to be connecting to one CDN customer, but then ask the CDN to actually let them talk to a different CDN customer. (There are various protocol-layering tricks that may enable this either by accident or on purpose.) This is a little different than using VPS services because with the VPS services you're actually connecting to the customer you appear to be connecting to, it's just very unclear who that is, because it's just one random VPS customer among a huge number of servers hosted on that same service.
  - godelski 4y ago
    Ah, thanks for the explanation. I do have a followup though. If this method is successful for Tor, why isn't it for Signal? I was under the impression that they used AWS and other servers. Or are they just not doing this and leaving an (easy?) censorship mitigation opportunity unsolved?
    - schoen 4y ago
      I believe Tor has a more active anti-censorship project than Signal does. While I don't think Signal is in any sense OK with governments blocking it, the Tor folks have something along the lines of a whole anti-censorship team (part paid and part volunteer). I don't believe Signal has a direct equivalent to that. There could also be an element of luck or differences in how strongly particular governments are trying to block particular apps and circumvention methods at a given moment. I know that varies a lot from country to country. Edit: However, Signal does have a "Censorship circumvention" feature under "Advanced" options. So there is some level of official work on that from Signal. Have your friends tried this feature?
sneak 4y ago
Why must they block all? They can just block the IPs running bridges.

dilyevsky 4y ago

That’s exactly what telegram did when they had their famous battle against rkn

cowtools 4y ago
Tor is not really comparable to telegram. check out that link I posted, that talk goes over a lot of details that I am currently at a loss of words for.
defanor 4y ago
And large subnets were blocked back then, blocking many unrelated websites/services at once. IIRC even some of RKN's own services were temporarily disrupted by that, but generally they don't shy away from inflicting collateral damage. There's no shortage of cases of blocking large websites for humorous or silly pictures and texts (not even political), too.
- dilyevsky 4y ago
  Yes and eventually rkn had to back down and walk that back (maybe less of a concern for them today tho)
  - Andrew_nenakhov 4y ago
    RKN only backed down only because it was a PR stunt where it played the role of an inept villain.
    - markdestouches 4y ago
      So you're implying that Telegram is essentially Kremlin's project. Any other reasons you believe this is the case?
      - sudosysgen 4y ago
        Probably because Telegram wasn't removed from the App Store.
      - jacooper 4y ago
        Telegram is already shady, it has no clear funding source while having the highest operating cost of any of the main stream chat apps due to it storing everything you send with no limits. There is no e2e encryption, it has access to everything you do, its often said to be an alternative to WhatsApp, but its mostly worse in privacy, WhatsApp has proven encryption at least, and encrypted backups on android, while on apple its basically a back door. And the explanation up to now is that durov is paying for everything for the faint of heart, which I really don't believe. Matrix on paper is a good alternative, but its clients are not even close, and I speak as a daily matrix user.
        dilyevsky 4y ago
        Technically telegram does have optional e2e but group chats weren’t supported last i checked. Source on operational costs? Dont they have “telegram premium” thing to earn money now?
        jacooper 4y ago
        > Technically telegram does have optional e2e but group chats weren’t supported last i checked. And aren't supported on desktop either, no body uses them, they are severely limited on purpose. > Source on operational costs? Telegram saves everything you do on the platform, every message, every picture, every video, every file with no limit. They market it as a feature, on their twitter they often say you can use it as cloud storage. This absolutely costs more than WhatsApp or signal, which only use servers as relays. > Dont they have “telegram premium” thing to earn money now? Its a very recent thing, and it has a very minimal effect, and the previous years didn't just pay for themselves.
Andrew_nenakhov 4y ago
When they had their famous PR campaign closely coordinated with RKN. Telegram wasn't even removed from appstores, unlike Navalny'a app a bit later or LinkedIn a bit earlier.

WaitWaitWha 4y ago

AWS is required to provide all data flowing in and out of datacenters to the Government.

cowtools 4y ago
Doesn't matter, it is just a bridge node. Tor is resilient to that mode of attack.
moffkalast 4y ago
American yes, Chinese no.
- metadat 4y ago
  And even then, only with a warrant.
  - trasz 4y ago
    Not true - a secret kangaroo “FISA court” can arbitrarily force them to do anything and there’s no rea oversight thanks to gag orders.
- viraptor 4y ago
  Depends on the region. us-east-1 - us. cn-north-1 - both.
- nazka 4y ago
  Wait so does it mean that technically right the internet of China is more open than Russia?
  - anticensor 4y ago
    Great Firewall has a protocol and destination whitelisting, so no.
- WaitWaitWha 4y ago
  If you are stating that AWS is required to provide all data flowing in and out of datacenters to the USA Government, but not the Chinese government, then you are 100% wrong. This is why Chinese regions have to replicate nearly all services in their own regions. No intermingling with other regions.

Andrew_nenakhov 4y ago

Roskomnadzor can block whole AWS and there will be neither rioting not even a significant outrage. They can even turn to whitelisting. The only reason they don't do it is that it is still considered unnecessary.

cowtools 4y ago
Will they ban every VPS provider?
- n4bz0r 4y ago
  They've already got their hands on ProtonVPN, Nord VPN, Opera VPN and a number (about 8-10, I think?) of others. Their system analyzes all the traffic and tries to identify VPN packets, so I don't really see why wouldn't they block all the providers should they need to. There are still ways to mask the traffic, but a regular user can only be bothered so much. Yes, many businesses rely on VPN, but I can imagine that RKN might just come up with some great white-list idea.
  - yardstick 4y ago
    > Yes, many businesses rely on VPN, but I can imagine that RKN might just come up with some great white-list idea. Plus with the sanctions it’s unlikely there is much need for western businesses to run VPNs into Russia.
    - johannes1234321 4y ago
      Not for businesses, but for human rights organisations, foreign governments, idealists, ...
  - Dracophoenix 4y ago
    Is something like Algo or GoodbyeDPI a more workable solution? https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-that-works/ https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-th... https://github.com/ValdikSS/GoodbyeDPI https://github.com/ValdikSS/GoodbyeDPI

inglor_cz 4y ago

China also does not seem to be willing to burn all the bridges to the rest of the world just yet, so it has to accept some kind of interconnection to services like AWS that aren't under its control.

trasz 4y ago
“Just yet”? China is number one industrial superpower, you can’t have that with bridges burned. In fact China is going the exact opposite way, see the Belt and Road.
- NicoJuicy 4y ago
  Belt and road it's investments have been decimated as far as I know.
  - trasz 4y ago
    I believe it’s mostly those in Russia, because it become useless from both commercial (embargoes on everything make Russian transport worthless) and political (don’t want your problematic vassal control something crucial to your economy) point or view. Funds have been shifted to countries like Kazakhstan.

schleck8 4y ago

There is also Snowflake bridges which are run by individuals using a browser extension https://community.torproject.org/relay/setup/snowflake/ https://community.torproject.org/relay/setup/snowflake/

godelski 4y ago

Didn't Signal do something like this and get in trouble?[0] I honestly don't know much about domain fronting so if this is something completely different than I'd appreciate an explanation. I do know that my friends in China are unable to use Signal, so I figure something is up. [0] https://signal.org/blog/looking-back-on-the-front/ https://signal.org/blog/looking-back-on-the-front/

schoen 4y ago
Domain fronting was (and to a lesser extent still is) mainly about using CDN infrastructure so that clients appear (to a network censor) to be connecting to one CDN customer, but then ask the CDN to actually let them talk to a different CDN customer. (There are various protocol-layering tricks that may enable this either by accident or on purpose.) This is a little different than using VPS services because with the VPS services you're actually connecting to the customer you appear to be connecting to, it's just very unclear who that is, because it's just one random VPS customer among a huge number of servers hosted on that same service.
- godelski 4y ago
  Ah, thanks for the explanation. I do have a followup though. If this method is successful for Tor, why isn't it for Signal? I was under the impression that they used AWS and other servers. Or are they just not doing this and leaving an (easy?) censorship mitigation opportunity unsolved?
  - schoen 4y ago
    I believe Tor has a more active anti-censorship project than Signal does. While I don't think Signal is in any sense OK with governments blocking it, the Tor folks have something along the lines of a whole anti-censorship team (part paid and part volunteer). I don't believe Signal has a direct equivalent to that. There could also be an element of luck or differences in how strongly particular governments are trying to block particular apps and circumvention methods at a given moment. I know that varies a lot from country to country. Edit: However, Signal does have a "Censorship circumvention" feature under "Advanced" options. So there is some level of official work on that from Signal. Have your friends tried this feature?

sneak 4y ago

Why must they block all? They can just block the IPs running bridges.