6 ms·

Cloak: Censorship Circumvention Tool

148 points by xanthine 4y ago

luckylion 4y ago
This probably needs a good way to cover its tracks, or it'll just get blocked like other VPN-services. As far as I understand, you can make pretty educated guesses at the type of content even with SSL, because e.g. Videos are loaded in bursts. I'm sure web and other traffic has similar characteristics, and it would be easy enough to say that something isn't a normal HTTPS connection because of how the data flow looks. Does this tool defend against that, are the connections being dropped when not in use to mimic browser-behavior?
- totetsu 4y ago
  Why not hide traffic in an actual video stream..
  - luckylion 4y ago
    That's what I was thinking as well, but I guess there's little demand for one-way traffic, and you'd need to make a complicated system to make it two way (i.e. you request something off-channel, a new video gets created and uploaded which also contains your response) via an established platform. Would be easier to do on a custom platform, but I'm not sure how well that'd work if you stand up a video site that suddenly gets a lot of traffic in $heavilyCensoredArea -- feels like something that'll get attention. For individual users it would probably work though.
    - graderjs 4y ago
      The traffic pattern sounds like a remote browser. One way sends the video (and audio) stream (over WSS or WebRTC), the other way sends the UI interactions (clicks, pointer movements, scrolling, typing etc).
    - noduerme 4y ago
      Just off my own experience living for a year in Vietnam, which was far less sophisticated at this than China... once your apartment has raised red flags, any suspicious traffic is going to lead to a temporary 15-minute to 1 hour internet shutoff. Any ports or domains you accessed will be blacklisted to trigger longer shutoffs in the future, just in case you didn't get the message the first time. The third or fourth time, someone from the police will politely ask you some questions. (I work for a western corporation that requires a VPN and is considering investment is the correct answer). Maybe we're at a point now where traffic analysis weighs into the decision-making process, but that would actually mean freedom of information was winning and breaking through if they had to winnow down their target list that way. In other words, there's no rhyme or reason to one service or IP being blocked and another being left open. It's done completely by fiat with the main intention not being to prevent you from access, but rather to frighten you so you censor yourself and think thrice before trying to connect again.
      - dtx1 4y ago
        Good to know i'll never visit vietnam
        noduerme 4y ago
        I'd say this is the wrong reaction. Vietnam is great. The people are incredibly friendly (even to an American who assumed I would be shunned). The culture is ancient, proud and endlessly intricate. It's an amazing place to visit and learn about. They were wildly mistreated by the French and Americans, and still have a confidence and pride that is lacking in most of the 30-odd countries I've visited in the world. Dealing with oppressive governments as a visitor is the rule around the world, not the exception. Not that I'd support stepping foot in or giving a cent to some of the worst (like Burma or Russia). But it would be wrong to say you'd never visit; especially a place like Vietnam which is worthy of a lot of latitude and respect for what they've built out of the ashes of nearly 100 years of anti-colonial warfare.
        dtx1 4y ago
        > Dealing with oppressive governments as a visitor is the rule around the world, not the exception. It may be, but I'm happy to have the choice not to visit such places.
  - nonrandomstring 4y ago
    Steganographic overlays are a thing, and look set for wider use as vile regimes tighten their grip. But they are slow - fine for text based reporting, egress of intelligence, protest coordination, or the dissemination of smaller videos maybe, but not meeting the expectations of a generation raised on interactive media.
- ignoramous 4y ago
  Things just got more tricky: https://github.com/net4people/bbs/issues/129 https://github.com/net4people/bbs/issues/129
netheril96 4y ago
If the goal is to emulate TLS, why not use real TLS? Trojan, V2ray and GOST all do this.
jkhdigital 4y ago
I've spent the last four years reading a lot of research papers in this area as part of my PhD research, and while I'm all for increasing the available options for censorship circumvention it's not clear that Cloak does anything novel when compared to existing systems. The real weakness of all such systems is setup and rendezvous: how do clients find friendly servers, and how do you prevent the censoring regime from finding and blocking them? It's not an easy problem to solve.
- yieldcrv 4y ago
  Does it need to do anything novel? I always ask my tech cohort people this. They get alot of peer clout from pursuing “original”, when often times their vertical just needs “additional”. Like an additional grocery store in the area. It doesnt need to innovate.
- jasode 4y ago
  >it's not clear that Cloak does anything novel when compared to existing systems. I'm not an expert on the current state of censorship-circumvention utilities but I found this recent comment when browsing the Cloak source repository that may partially answer your question: https://github.com/cbeuw/Cloak/issues/169#issuecomment-1257480837 https://github.com/cbeuw/Cloak/issues/169#issuecomment-12574... >, and how do you prevent the censoring regime from finding and blocking them? The tools like Cloak try to work on the principle "collateral freedom" which hides censored data inside of "internet services that are too big block" : https://en.wikipedia.org/wiki/Collateral_freedom https://en.wikipedia.org/wiki/Collateral_freedom And the effectiveness of that strategy depends on the hackability of those internet services as they can sometimes change the rules which close the loopholes of "collateral freedom" : https://en.wikipedia.org/wiki/Domain_fronting#Disabling https://en.wikipedia.org/wiki/Domain_fronting#Disabling
- junofan 4y ago
  Cloak doesn’t appear to be a research project, so novelty may not be a goal. It appears to be extremely simple; that alone may be valuable for some users.
- lallysingh 4y ago
grondilu 4y ago
Isn't the problem of censorship much more than technical? I mean, censorship doesn't seem like something everybody agrees is bad. Free speech is not absolute at all : there is a demand to regulate, prohibit and prosecute for instance pornography, defamation, so-called "hate speech", "disinformation" and so-on. Whether we agree with these policies or not, the fact remains that these impediments to free speech can be seen as a form of censorship. At the end of the day, I think what makes censorship acceptable is very much subjective, and tied to political beliefs. I can't help noticing for instance that on this github page, there are a few flags illustrating "censoring regimes", and the Russian one is there, but not the European Union one, even though the European Council blocked RT and Sputnik throughout the whole EU after the Russian special military operations in Ukraine. This blocking, regardless of what one can think of its legitimacy, is hard not to consider as censorship. If it's not, how is it called then?
- baumschubser 4y ago
  This. A lot anti-censorship technology assumes a censored space surrounded by a non-censored space. However, we should we thinking about different areas with different blocks, and therefore bi-directional circumvention. Show BBC to Russia, and Russia Today to EU.
- RobotToaster 4y ago
  Around 4,000 websites are blocked by Hadrian's firewall in the UK, for instance. https://www.openrightsgroup.org/app/uploads/2020/03/Internet_Regulation_Part_I_Internet_Censorship_in_the_UK_today-web-1.pdf https://www.openrightsgroup.org/app/uploads/2020/03/Internet...
  - genewitch 4y ago
    is the actual list anywhere?
- illuminerdy 4y ago
  Censorship anywhere is bad. Especially when it is purely for political reasons. Most European nations have very strict Holocaust denial laws. And as much as I personally think people who deny the Holocaust happened are idiots, that's clearly "thoughtcrime" type of censorship. What someone thinks or believes about history is none of the government's (or anyone else's) business.
RichardCNormos 4y ago
The vast majority of censorship today happens server-side, not in the transport layer.
- qvrjuec 4y ago
  How platitudinal.
vmoore 4y ago
> Cloak also supports tunneling through an intermediary CDN server such as Amazon Cloudfront. Such services are so widely used, attempts to disrupt traffic to them can lead to very high collateral damage for the censor. I once blacklisted a bunch of Amazon IPs that I found in some random Gist on Github, and surfed the web, and so much stuff was broken. It's staggering just how entangled AWS is with the web. The dream of the 'decentralized web' would be hard to implement. You would need to root out any dependence on AWS, Google, Cloudflare etc But if this means we can reliably hide traffic in these centralized networks, then maybe it's a good thing they exist. Sort of like steganography with cloud services.
- THENATHE 4y ago
  The problem with the “decentralized web” that everyone dreams of is that there is no way for it to truly work. Either everyone has a home/office server for everything and then a company makes routers that “automatically” set up a DMZ and firewall rules and whatever, OR Everything is just on a conglomeration of smaller hosts, which is still not ideal because that means each user pays higher prices and gets less performance, lower bandwidth, higher latency, etc because of the lack of hardware scalability with mom-and-pop server hosts. Some level of single player (or few large players) is necessary for the modern internet.
  - nine_k 4y ago
    I don't think that decentralized web is about not depending on cloud providers. I think it's mostly about having many independently controlled web sites,, as opposed to most content living in a few corporate silos with their own rules of access control, like FB, IG, Youtube, Twitter. Physically a large chunk of decentralized web could live on one huge server, and still remain acceptably decentralized. OTOH if every home had a separate p2p-networked appliance from Google or Meta, but Google's lawyers and Meta's algorithms running on each node decided what you see on your newsfeed, and what is downplayed or taken down, it would still be centralized, as it is now.
MasterYoda 4y ago
Why is shadowsock needed to go thru cloak? I thought shadowsock did sort of the same thing; to masquerading proxied traffic as normal web browsing activities. What does cloak do that shadowsock does not to not get the traffic censord?
Haemm0r 4y ago
I really like the tool; I use it on my devices when I'm abroad. It worked very well in China (2019) with a Japan based VPS. The peering China-Japan-Europe is much better than China-Europe btw. First time I could not connect successfully from a public Wifi to my server was Qatar airport this summer... Maybe they work with whitelists for access control.
justshowpost 4y ago
Looks like a toy for me. Also written in Go which itself means its not serious. When tampering gubment censorship, one should apply the usual opsec rules and thus stick to mature and proven solutions and refrain from experimenting. This means Tor or reputable commercial VPN provider, not yet-another-tor-killer. And the developers in general should invest more efforts into low-level attacks like GoodbyeDPI instead.

148 points by xanthine 4y ago

This probably needs a good way to cover its tracks, or it'll just get blocked like other VPN-services. As far as I understand, you can make pretty educated guesses at the type of content even with SSL, because e.g. Videos are loaded in bursts. I'm sure web and other traffic has similar characteristics, and it would be easy enough to say that something isn't a normal HTTPS connection because of how the data flow looks. Does this tool defend against that, are the connections being dropped when not in use to mimic browser-behavior?

totetsu 4y ago
Why not hide traffic in an actual video stream..
- luckylion 4y ago
  That's what I was thinking as well, but I guess there's little demand for one-way traffic, and you'd need to make a complicated system to make it two way (i.e. you request something off-channel, a new video gets created and uploaded which also contains your response) via an established platform. Would be easier to do on a custom platform, but I'm not sure how well that'd work if you stand up a video site that suddenly gets a lot of traffic in $heavilyCensoredArea -- feels like something that'll get attention. For individual users it would probably work though.
  - graderjs 4y ago
    The traffic pattern sounds like a remote browser. One way sends the video (and audio) stream (over WSS or WebRTC), the other way sends the UI interactions (clicks, pointer movements, scrolling, typing etc).
  - noduerme 4y ago
    Just off my own experience living for a year in Vietnam, which was far less sophisticated at this than China... once your apartment has raised red flags, any suspicious traffic is going to lead to a temporary 15-minute to 1 hour internet shutoff. Any ports or domains you accessed will be blacklisted to trigger longer shutoffs in the future, just in case you didn't get the message the first time. The third or fourth time, someone from the police will politely ask you some questions. (I work for a western corporation that requires a VPN and is considering investment is the correct answer). Maybe we're at a point now where traffic analysis weighs into the decision-making process, but that would actually mean freedom of information was winning and breaking through if they had to winnow down their target list that way. In other words, there's no rhyme or reason to one service or IP being blocked and another being left open. It's done completely by fiat with the main intention not being to prevent you from access, but rather to frighten you so you censor yourself and think thrice before trying to connect again.
    - dtx1 4y ago
      Good to know i'll never visit vietnam
      - noduerme 4y ago
        I'd say this is the wrong reaction. Vietnam is great. The people are incredibly friendly (even to an American who assumed I would be shunned). The culture is ancient, proud and endlessly intricate. It's an amazing place to visit and learn about. They were wildly mistreated by the French and Americans, and still have a confidence and pride that is lacking in most of the 30-odd countries I've visited in the world. Dealing with oppressive governments as a visitor is the rule around the world, not the exception. Not that I'd support stepping foot in or giving a cent to some of the worst (like Burma or Russia). But it would be wrong to say you'd never visit; especially a place like Vietnam which is worthy of a lot of latitude and respect for what they've built out of the ashes of nearly 100 years of anti-colonial warfare.
        dtx1 4y ago
        > Dealing with oppressive governments as a visitor is the rule around the world, not the exception. It may be, but I'm happy to have the choice not to visit such places.
- nonrandomstring 4y ago
  Steganographic overlays are a thing, and look set for wider use as vile regimes tighten their grip. But they are slow - fine for text based reporting, egress of intelligence, protest coordination, or the dissemination of smaller videos maybe, but not meeting the expectations of a generation raised on interactive media.
ignoramous 4y ago
Things just got more tricky: https://github.com/net4people/bbs/issues/129 https://github.com/net4people/bbs/issues/129

netheril96 4y ago

If the goal is to emulate TLS, why not use real TLS? Trojan, V2ray and GOST all do this.

jkhdigital 4y ago

I've spent the last four years reading a lot of research papers in this area as part of my PhD research, and while I'm all for increasing the available options for censorship circumvention it's not clear that Cloak does anything novel when compared to existing systems. The real weakness of all such systems is setup and rendezvous: how do clients find friendly servers, and how do you prevent the censoring regime from finding and blocking them? It's not an easy problem to solve.

yieldcrv 4y ago
Does it need to do anything novel? I always ask my tech cohort people this. They get alot of peer clout from pursuing “original”, when often times their vertical just needs “additional”. Like an additional grocery store in the area. It doesnt need to innovate.
jasode 4y ago
>it's not clear that Cloak does anything novel when compared to existing systems. I'm not an expert on the current state of censorship-circumvention utilities but I found this recent comment when browsing the Cloak source repository that may partially answer your question: https://github.com/cbeuw/Cloak/issues/169#issuecomment-1257480837 https://github.com/cbeuw/Cloak/issues/169#issuecomment-12574... >, and how do you prevent the censoring regime from finding and blocking them? The tools like Cloak try to work on the principle "collateral freedom" which hides censored data inside of "internet services that are too big block" : https://en.wikipedia.org/wiki/Collateral_freedom https://en.wikipedia.org/wiki/Collateral_freedom And the effectiveness of that strategy depends on the hackability of those internet services as they can sometimes change the rules which close the loopholes of "collateral freedom" : https://en.wikipedia.org/wiki/Domain_fronting#Disabling https://en.wikipedia.org/wiki/Domain_fronting#Disabling
junofan 4y ago
Cloak doesn’t appear to be a research project, so novelty may not be a goal. It appears to be extremely simple; that alone may be valuable for some users.
lallysingh 4y ago

grondilu 4y ago

Isn't the problem of censorship much more than technical? I mean, censorship doesn't seem like something everybody agrees is bad. Free speech is not absolute at all : there is a demand to regulate, prohibit and prosecute for instance pornography, defamation, so-called "hate speech", "disinformation" and so-on. Whether we agree with these policies or not, the fact remains that these impediments to free speech can be seen as a form of censorship. At the end of the day, I think what makes censorship acceptable is very much subjective, and tied to political beliefs. I can't help noticing for instance that on this github page, there are a few flags illustrating "censoring regimes", and the Russian one is there, but not the European Union one, even though the European Council blocked RT and Sputnik throughout the whole EU after the Russian special military operations in Ukraine. This blocking, regardless of what one can think of its legitimacy, is hard not to consider as censorship. If it's not, how is it called then?

baumschubser 4y ago
This. A lot anti-censorship technology assumes a censored space surrounded by a non-censored space. However, we should we thinking about different areas with different blocks, and therefore bi-directional circumvention. Show BBC to Russia, and Russia Today to EU.
RobotToaster 4y ago
Around 4,000 websites are blocked by Hadrian's firewall in the UK, for instance. https://www.openrightsgroup.org/app/uploads/2020/03/Internet_Regulation_Part_I_Internet_Censorship_in_the_UK_today-web-1.pdf https://www.openrightsgroup.org/app/uploads/2020/03/Internet...
- genewitch 4y ago
  is the actual list anywhere?
illuminerdy 4y ago
Censorship anywhere is bad. Especially when it is purely for political reasons. Most European nations have very strict Holocaust denial laws. And as much as I personally think people who deny the Holocaust happened are idiots, that's clearly "thoughtcrime" type of censorship. What someone thinks or believes about history is none of the government's (or anyone else's) business.

RichardCNormos 4y ago

The vast majority of censorship today happens server-side, not in the transport layer.

qvrjuec 4y ago
How platitudinal.

vmoore 4y ago

> Cloak also supports tunneling through an intermediary CDN server such as Amazon Cloudfront. Such services are so widely used, attempts to disrupt traffic to them can lead to very high collateral damage for the censor. I once blacklisted a bunch of Amazon IPs that I found in some random Gist on Github, and surfed the web, and so much stuff was broken. It's staggering just how entangled AWS is with the web. The dream of the 'decentralized web' would be hard to implement. You would need to root out any dependence on AWS, Google, Cloudflare etc But if this means we can reliably hide traffic in these centralized networks, then maybe it's a good thing they exist. Sort of like steganography with cloud services.

THENATHE 4y ago
The problem with the “decentralized web” that everyone dreams of is that there is no way for it to truly work. Either everyone has a home/office server for everything and then a company makes routers that “automatically” set up a DMZ and firewall rules and whatever, OR Everything is just on a conglomeration of smaller hosts, which is still not ideal because that means each user pays higher prices and gets less performance, lower bandwidth, higher latency, etc because of the lack of hardware scalability with mom-and-pop server hosts. Some level of single player (or few large players) is necessary for the modern internet.
- nine_k 4y ago
  I don't think that decentralized web is about not depending on cloud providers. I think it's mostly about having many independently controlled web sites,, as opposed to most content living in a few corporate silos with their own rules of access control, like FB, IG, Youtube, Twitter. Physically a large chunk of decentralized web could live on one huge server, and still remain acceptably decentralized. OTOH if every home had a separate p2p-networked appliance from Google or Meta, but Google's lawyers and Meta's algorithms running on each node decided what you see on your newsfeed, and what is downplayed or taken down, it would still be centralized, as it is now.

MasterYoda 4y ago

Why is shadowsock needed to go thru cloak? I thought shadowsock did sort of the same thing; to masquerading proxied traffic as normal web browsing activities. What does cloak do that shadowsock does not to not get the traffic censord?

Haemm0r 4y ago

I really like the tool; I use it on my devices when I'm abroad. It worked very well in China (2019) with a Japan based VPS. The peering China-Japan-Europe is much better than China-Europe btw. First time I could not connect successfully from a public Wifi to my server was Qatar airport this summer... Maybe they work with whitelists for access control.

justshowpost 4y ago

Looks like a toy for me. Also written in Go which itself means its not serious. When tampering gubment censorship, one should apply the usual opsec rules and thus stick to mature and proven solutions and refrain from experimenting. This means Tor or reputable commercial VPN provider, not yet-another-tor-killer. And the developers in general should invest more efforts into low-level attacks like GoodbyeDPI instead.