4 ms·

The first hop, "SSH Client -> Iranian Datacenter" seems extremely vulnerable to surveillance, and would create an incriminating list of people involved. With th

by _yb2s 4y ago

The first hop, "SSH Client -> Iranian Datacenter" seems extremely vulnerable to surveillance, and would create an incriminating list of people involved. With this discussion in the open, you can bet Iranian authorities are going to specifically look for anything discussed here, so the only viable solutions should have no measurable deviation from normal behavior that would allow them to detect which datacenter was doing this. To make this happen, you should have a minimum number of connections from inside Iran into the datacenter. For a small group of trusted people with always on connections, you could just create a linear chain of SSH forwards connecting everyone. For widespread connectivity, a TOR bridge through the path you describe would be workable.

LinuxBender 4y ago
I considered that, but the small group of trusted people is a bit of a double-edged sword. If one person is taken and they do not have good OpSec they could expose that entire group of trusted friends and that would be a more valuable target to authorities. So in that case I would stick with having an accidentally exposed SSH in that datacenter.
nimbius 4y ago
maybe lorawan can be used to launder the traffic? IoT traffic obfuscators running on battery power
- ozfive 4y ago
  Here's a project exploring large data transfer over LoRaWAN https://stuartsprojects.github.io/2021/02/26/Large-Data-Transfers-with-LoRa-Part1.html https://stuartsprojects.github.io/2021/02/26/Large-Data-Tran...
- anakaine 4y ago
  You'll fill the airwaves very quickly with Lora devices. They're quite terrible at anything more than very simple text data. Time in air is high, bandwidth is very low, and signal clashes in crowded areas are a big issue.
mariojv 4y ago
Could individuals run a public internet gateway that doesn't keep logs with something similar to mosh but running the equivalent of an SSH tunnel? Think a SOCKS proxy on one end, but running as a public web application/forward proxy on the other end. The ISP would still be able to see any traffic to the gateway, but if you had enough links outside of government monitored net infrastructure to the gateway (hard lines you take down or obfuscate when the patrol does their rounds, wireless point to point connections), the risk would be on the gateway operator. (Please do not take my advice without evaluation. This is speculation from a SWE, not advice for life or death situations.) Edit: I suppose if your ingress traffic is over links not monitored by government anyway, it doesn't matter if you use SSH or a web application forwarding traffic to a SOCKS proxy behind the scenes. Not sure if the idea presented above would be useful in other scenarios. Edit2: I guess usability is a benefit, even without security benefits. "Plug in this cable and type this URL into your browser" is easier than "open a terminal and establish an SSH connection."
- LinuxBender 4y ago
  something similar to mosh Something that looks similar to mosh being UDP and encrypted but that allows proxied traffic would be Tinc Open Source VPN [1] The nicest thing about Tinc is that it does user-space dynamic mesh routing without requiring packet forwarding being enabled. I would call it a middle ground to onion routing if set up right. It has configurable compression. The reason I did not suggest this is that it is not simple to set up and get OpSec right the first time out of the gate unless the people involved are already very experienced with it. That's why I suggested SSH. SSH is relatively simple, well known and will blend in with all the legit SSH traffic and more people have experience with SSH. SSH egress from a datacenter is normal, expected and likely already permitted to AWS without making logged firewall changes. [1] - https://www.tinc-vpn.org/ https://www.tinc-vpn.org/
  - mariojv 4y ago
    Bookmarked. Thanks! Agreed on the utility of SSH. I work on a product that offers SSH certificate authorities as a service, among other things, and have read some of the RFCs. I mainly mentioned the web forward proxy as a response to the "SSH traffic to Iranian datacenters from residential connections is suspicious," comment, but SSH is a great basis to build on. I doubt the SSH egress from the datacenters would draw much attention, but again, I wouldn't use my advice in a life-threatening situation, especially as I have never seen these type of monitoring systems in action.

by _yb2s 4y ago

LinuxBender 4y ago

I considered that, but the small group of trusted people is a bit of a double-edged sword. If one person is taken and they do not have good OpSec they could expose that entire group of trusted friends and that would be a more valuable target to authorities. So in that case I would stick with having an accidentally exposed SSH in that datacenter.

nimbius 4y ago

maybe lorawan can be used to launder the traffic? IoT traffic obfuscators running on battery power

ozfive 4y ago
Here's a project exploring large data transfer over LoRaWAN https://stuartsprojects.github.io/2021/02/26/Large-Data-Transfers-with-LoRa-Part1.html https://stuartsprojects.github.io/2021/02/26/Large-Data-Tran...
anakaine 4y ago
You'll fill the airwaves very quickly with Lora devices. They're quite terrible at anything more than very simple text data. Time in air is high, bandwidth is very low, and signal clashes in crowded areas are a big issue.

mariojv 4y ago

Could individuals run a public internet gateway that doesn't keep logs with something similar to mosh but running the equivalent of an SSH tunnel? Think a SOCKS proxy on one end, but running as a public web application/forward proxy on the other end. The ISP would still be able to see any traffic to the gateway, but if you had enough links outside of government monitored net infrastructure to the gateway (hard lines you take down or obfuscate when the patrol does their rounds, wireless point to point connections), the risk would be on the gateway operator. (Please do not take my advice without evaluation. This is speculation from a SWE, not advice for life or death situations.) Edit: I suppose if your ingress traffic is over links not monitored by government anyway, it doesn't matter if you use SSH or a web application forwarding traffic to a SOCKS proxy behind the scenes. Not sure if the idea presented above would be useful in other scenarios. Edit2: I guess usability is a benefit, even without security benefits. "Plug in this cable and type this URL into your browser" is easier than "open a terminal and establish an SSH connection."

LinuxBender 4y ago
something similar to mosh Something that looks similar to mosh being UDP and encrypted but that allows proxied traffic would be Tinc Open Source VPN [1] The nicest thing about Tinc is that it does user-space dynamic mesh routing without requiring packet forwarding being enabled. I would call it a middle ground to onion routing if set up right. It has configurable compression. The reason I did not suggest this is that it is not simple to set up and get OpSec right the first time out of the gate unless the people involved are already very experienced with it. That's why I suggested SSH. SSH is relatively simple, well known and will blend in with all the legit SSH traffic and more people have experience with SSH. SSH egress from a datacenter is normal, expected and likely already permitted to AWS without making logged firewall changes. [1] - https://www.tinc-vpn.org/ https://www.tinc-vpn.org/
- mariojv 4y ago
  Bookmarked. Thanks! Agreed on the utility of SSH. I work on a product that offers SSH certificate authorities as a service, among other things, and have read some of the RFCs. I mainly mentioned the web forward proxy as a response to the "SSH traffic to Iranian datacenters from residential connections is suspicious," comment, but SSH is a great basis to build on. I doubt the SSH egress from the datacenters would draw much attention, but again, I wouldn't use my advice in a life-threatening situation, especially as I have never seen these type of monitoring systems in action.