10 ms·

I'm an Alaska (relatively) frequent flyer. That airline offers a free "messaging" plan, that lets you send and receive messages on apps like iMessage, Facebook

I'm an Alaska (relatively) frequent flyer. That airline offers a free "messaging" plan, that lets you send and receive messages on apps like iMessage, Facebook Messenger and Whatsapp. Though, it somehow prevents images/attachments from coming through on those platforms. I've always wondered how this is implemented technically, and if it might be possible to setup some kind of protocol/wrapper to send data that looks like it's being sent over those protocols, but offers access to other parts of the internet.

sixstringtheory 3y ago
Could always send base64 data strings!
phantom784 3y ago
I'd suspect it kills TCP connections once a threshold of data has been transferred, and the threshold is enough to let text through but not enough for attachments.
- grishka 3y ago
  Good luck doing that against Telegram. It would simply reconnect and resume the download where it left off.
alexfoo 3y ago
https://news.ycombinator.com/item?id=33568994 https://news.ycombinator.com/item?id=33568994
organsnyder 3y ago
United wifi is similar. I've found that notifications work for most things, including my Home Assistant instance—they must all use the same Apple push service.
- atourgates 3y ago
  I noticed the same on Alaska flying last weekend. As soon as I activated the "Free Messaging" service, I got a bunch of notifications from my Apple Home and Google Nest devices.
  - snazz 3y ago
    Yes, APNs (Apple Push Notification service) has to be allowed for notifications to come through from messaging apps and the network operator can’t tell whether it’s an allowed messaging app or any other kind of notification.
    - mcast 3y ago
      The scale of Apple’s notification service must be pretty large. Granted, most notifications don’t have strong SLA guarantees but I don’t remember it having any downtime either.
      - Klonoar 3y ago
        They don't really make guarantees about the reliability of push notifications (IIRC), so it's unlikely you'd see anything about downtime unless it was sustained for some time.
- SirMaster 3y ago
  On iOS all notifications have to use Apple's Push service. And the WiFi essentially has to allow the Apple push notification system entirely in order for iMessage to work fully the way people expect. So it's really a side effect. But yeah for example with the free iMessage connection on Southwest, I can see all the notifications come in on Discord, but of course I cannot connect within the discord app to actually load all those messages. I can only read them as they come in as push notifications.
  - Xeamek 3y ago
    >On iOS all notifications have to use Apple's Push service. Have to? Isn't there an option to send 'offline' notification? I mean, coming from the app itself, rather then external callback? With that, app could ommit the official way of using Apple Push service, no?
    - SirMaster 3y ago
      Well, apps can only "run in the background" for up to 10 minutes. So sure, an app can generate a notification popup itself, but it's pretty limited as it won't be able to generate a notification after being backgrounded for more than 10 minutes. And the 10 minutes is also only if the app is designed to extend the duration as long as possible. Normally it would get cut off after 1 minute. So because of this it seems that in the vast, vast majority of cases apps choose to send their notifications from the Apple Push notification service.
    - WirelessGigabit 3y ago
      Yea but those mean the app has to be running. The main advantage of Apple's Push is that the app can be put to sleep and only wake up when you tap a notification.
gouggoug 3y ago
I've been wondering the same. I wonder if they just do some rudimentary packet inspection and drop packets above a certain size. My thinking being that short text messages result in very small packets, while large images will result in many large packets. Dropping large packets is most likely OK. I'd need to test this hypothesis by sending a very large text message (resulting in many large packets)
TRiG_Ireland 3y ago
I've come across wifi zones which allow normal web browsing, WhatsApp messaging (including pictures), but not WhatsApp calls. I saw it first in Hollyhead Port while waiting for a ferry. WhatsApp threw up an error message saying that calls were disallowed by the wifi network.
miki123211 3y ago
Do they allow Telegram? If so, that would be the easiest, Telegram has a really good bot API.
- Karrot_Kream 3y ago
  Many do but some don't. I wrote an HTTP Proxy for Telegram and it works fine for those situations but is very slow. I prefer using an NNCP proxy I wrote because the protocol doesn't have online liveness requirements.
dag11 3y ago
Hi fellow Alaska frequent flier. So about that! There's this iOS app called Flightly that does a brilliant little hack where the app updates itself in (almost) real time on the "free messaging" plan. The way it works (according to a friend) is that their servers send your phone a push notification every couple of minutes from take-off until landing, containing some serialized info such as lat,long,alt,eta,etc. And then the app immediately swallows the notification and deserializes its content without you ever seeing it. The notification works because in order for Alaska to give you notifications at all for your messaging apps, it needs to give you access to _all_ push notifications as they all get sent over an encrypted connected through Apple's server and it can't pick and choose which apps' notifications it lets through. I've often wondered if it'd be possible to pipe any sort of internet over notifications but I'm not sure if e.g. inline responses are viable, and also that'd probably be heavy enough usage of push notifications I'm sure it's violate someone's TOS.
- dgellow 3y ago
  Really hoping someone implements this, it’s the funniest project idea I’ve seen in a while :)
- el_benhameen 3y ago
  I’ve always wondered why I get slack and email notifications when I’m on a Southwest flight with free messaging without paying for wifi. You’ve finally solved my mystery!
- keanebean86 3y ago
  I had an idea to use Facebook messanger as a proxy. Specifically to use the cheap messaging plan on a cruise ship for real internet access. My home computer would be a gateway that monitors fb and fetches/returns websites. I never even tried because it just sounds like a violation of multiple ToSes. Not to mention message size limitations, throttling, my fb messages being pages of encoded text, etc. I feel like it would need to work like Opera mini to maybe be usable. Even then interactions would be uncomfortably slow. https://en.m.wikipedia.org/wiki/Opera_Mini https://en.m.wikipedia.org/wiki/Opera_Mini
matsemann 3y ago
How does that fly (pun intended) with regards to net neutrality? Where I live, some mobile operators gave you "unlimited streaming" in their data plan, but only for certain popular services (spotify, youtube, netflix basically). Since this would make it harder for others to disrupt the big ones, it was quickly forbidden.
- hot_gril 3y ago
  Is net neutrality even law anymore? T-Mobile has had Binge on for a long time, which zero-rates certain video streaming services. And part of that was even under the old net neutrality laws.
  - technothrasher 3y ago
    No, but the now Democratic majority at the FCC is currently actively trying to bring it back.
  - toast0 3y ago
    Binge On doesn't fall under strict net neutrality, but they are at least publicly open to all lawful and licensed content audio/video providers, and the technical requirements are not very high. I don't know what the actual onboarding process is like, but they've got a lot of providers signed up...
    - hot_gril 3y ago
      https://www.t-mobile.com/tv-streaming/binge-on/apps-list.html https://www.t-mobile.com/tv-streaming/binge-on/apps-list.htm... doesn't list all that many providers if we're talking about all video streaming services worldwide. I notice a large one under the gaming category missing, Twitch.
      - toast0 3y ago
        I think they've got to be licensed for US customers, or T-Mobile USA isn't going to include them. Twitch does seem to be a notable missing provider; Amazon video is on the program though, so maybe there's some technical or product thing on Twitch's side.
tuetuopay 3y ago
some options: - attachments are likely stored in a different part of the infra than raw messages (like on some s3 bucket somewhere), so it's pretty easy to allow the WA/iMessage/Signal/Messenger API while blocking their CDN through dns blocking, ip range blocking, sni inspection, etc. - they cut the tcp connection once more than e.g. 1MB has been transferred. it would result in slightly degraded user experience (the message tcp stream needs to be periodically reopened), and may not be foolproof is apps are smart and resume the download where it failed instead of from the start I lean for the first option as it's both the simplest and most foolproof option.
danielfoster 3y ago
I've also wondered why Grindr but not Tinder works on the "messaging only" plan. Someone at Alaska must have had fun with that one. Flightaware.com also works, presumably because Alaska uses Flightaware for its tracking map.
- 0_____0 3y ago
  Grindr is a logistics app, Tinder is entertainment :p
- noahtallen 3y ago
  > Flightaware.com also works Unfortunately, I couldn't get it to load on my Alaskan flight a few days ago on the free messaging plan. Maybe they've changed it
dannyfritz07 3y ago
Google Voice always works for me too FYI.
teeray 3y ago
Time to implement IP over FB Messenger
- falcor84 3y ago
  Absolutely. And I'll just put this here for anyone who's looking for inspiration: https://www.rfc-editor.org/rfc/rfc2549 https://www.rfc-editor.org/rfc/rfc2549
godelski 3y ago
On my recent United flight, where they had the same policy I was sending image messages to friends through Signal. But it was rather slow, so my best guess is rate limiting.
hot_gril 3y ago
I always assumed they have a whitelist of iMessage/Whatsapp/whatever IP addresses. It doesn't seem to work for all messaging apps in general.
gsich 3y ago
SNI or IP lists.
RandallBrown 3y ago
Probably 10-15 years ago when wifi on airlines was still pretty brand new I remember a fun hack for free Internet that involved Google Translate. Because the wifi landing pages used Google Analytics, they allowed traffic through from many of the Google domains. You could then go to Google translate and translate the website from English to English and use it as sort of a proxy server to get free Internet.
- smegger001 3y ago
  You could probably have used googels cache to read arbitrary pages as well.
- spike021 3y ago
  I'll probably show my age, but around 15 years ago I was in high school and they blocked most websites as well. This "hack" using Google Translate was how some of us got around the blocklist for many things. It was nice because it didn't involve having to install anything special or try to change configurations that were probably monitored by library/school admin.
- noman-land 3y ago
  This hack often works today to get around paywalls.
technothrasher 3y ago
Many years ago, when hotels first started having and charging for WiFi connections, I wrote a simple little tunnel using the DNS port back to my server. Since the hotels didn't block that port or even bother to check what traffic was going over it, it worked like a charm. I tried it on a trip to Tokyo and immediately got completely blocked. It took me a few minutes to figure out they'd blacklisted my MAC address. I changed the MAC of that interface and then behaved.
- someotherperson 3y ago
  Reminds me of using VPNs in hotels in China some years ago. Traffic would work for a few minutes and then the Great Firewall kicks in, fingerprints the traffic as VPN and the IP address and the MAC gets blocked. I'd rotate the endpoint and the MAC address and get a few more minutes, rinse and repeat. I think I had to use Shadowsocks or something at the end to completely bypass it.
  - superkuh 3y ago
    Shadowsocks(-libev) is great. I use it in the USA with Comcast to prevent their MITM attacks on HTTP connections.
justapassenger 3y ago
I don’t think they have any sophisticated solution for sniffing traffic. It’s most likely simple firewall + deals with Apple/Meta. Many airlines offer basic Wi-Fi for messages nowadays, so it’s very likely that big tech developed solution for it (especially, as they have initiative to do that, so their apps can work).
toast0 3y ago
I used to work at WhatsApp (until the end of 2019) on many things, including special pricing (aka zero rating); we did not work with airlines, and would not have participated in a project where messages and attachments where treated differently. That said, technically there's two pretty easy ways to do it for WhatsApp traffic, and then there's the way I suspect they're doing it... a) chat runs on different ips than attachments; always has, most likely always will (other than some transitional HAProxy at the old hosting when nearly everything had been moved to the new hosting). b) WA chat is not HTTPS (or even TLS) and attachments are. Chat also cycles between different ports, so you could just block port 443 and be good. c) I actually suspect, based on poking around a little that it's mostly just killing connections that use a lot of data. Maybe in combination with some other things. Being on a plane doesn't really put me in a debug the network kind of mood, so I never got to the bottom of it, but I'd regularly be able to make short connections to my home network while on the messaging plan, at least when this stuff was new. OTOH, I think I recall being able to connect through the WA VPN while on a plane on the messaging plan, but that was when we had a publicly available, but not publicly linked list of IP addresses on our website; I have no doubt that DPI vendors had that list.
- dgellow 3y ago
  > WA chat is not HTTPS (or even TLS) If you don’t mind, could you expend on this? Are there specific reasons to not be using TLS?
  - blapp 3y ago
    It's based on the Noise Protocol Framework in the outermost layer, which encrypts a compressed XMPP stream. The end-to-end encryption is done within various XMPP message payloads using the Signal Protocol, which encrypts message data serialized using Protocol Buffers, with different formats depending on the message type (text, image, video, sticker, etc).
  - toast0 3y ago
    I should probably refer you to the encryption whitepaper [1], but the basics are that Chat uses the Noise Protocol rather than TLS. All things being equal, the security properties are about equivalent, however all things aren't equal. The Noise handshake is smaller than the TLS handshake, and Noise doesn't have extraneous features WhatsApp doesn't use. Additionally, at the time of Noise adoption, TLS lacked a means for 0-RTT data (now available with TLS 1.3 Early Data), which meant using TLS would have added at least one round trip; possibly two, depending on which TLS library used. [2] You can use TLS without x.509, but it's not very common; avoiding x.509 was a definite plus. I wasn't much involved in anything on the chat channel, and I didn't do any implementation work on Noise, but I did some later prototype work with it, and if I recall correctly, it had much simpler framing than TLS as well; although maybe that was mostly TLS options getting me down --- the SNI header has 9 bytes of overhead, 5 of which are lengths, Noise didn't have anything like that as I recall. Do you really two bytes of versioning on every application data packet, like TLS has? I'm not sure you really need a type indicator byte either, context says you're sending a handshake packet initially, and then application data after that, but I'm pretty rusty on this now, so maybe there's a justification. For users paying for internet by the byte, every byte counts. For users on networks with large delays, every round trip counts. For attachments, it's less critical (if your data access costs were high, you could configure attachments not to load) and that infrastructure was always built around http(s), so while there would have been an efficiency improvement to move that off https, it would be hard to justify the engineering time; especially post the move to FB infrastructure with its CDN that was easily configured for our attachments. OTOH, chat never ran on TLS, so adopting Noise vs adopting TLS was a choice we could consider, and we picked the best solution for us. Unfortunately, it's pretty easy to identify Noise vs TLS --- OTOH, the service IPs are already identifiable, so a little more blending on the protocol level wouldn't help much. [1] https://www.whatsapp.com/security/WhatsApp-Security-Whitepaper.pdf https://www.whatsapp.com/security/WhatsApp-Security-Whitepap... [2] Also using system TLS libraries is fraught with peril. It's fine, but not super great, for http, but using it for a custom binary protocol is going to be terrible. You'll need to debug all of the edge cases that the system https library doesn't hit, and will then have to craft workarounds that just work, even if you can't reliably identify the underlying versions because Android OEMs do weird stuff.
c7DJTLrn 3y ago
You could try iodine, which is an IP-over-DNS tunnel. This should work unless the gateway has very restrictive rules on where DNS traffic can go. https://github.com/yarrick/iodine https://github.com/yarrick/iodine
- jedberg 3y ago
  Most captive portals have gotten wise to this trick and block large DNS requests.
  - roygbiv2 3y ago
    Yeah I recently found this out. It never really did work that well, I did manage to telnet into an SMTP server and manually send an email but for anything else it struggled. I wonder if TCP over ICMP would work better.
dheera 3y ago
IP-over-Facebook. So that's what the world has come to ...
kayson 3y ago
I can't seem to find it, but there was a blog post on HN a while back about how someone set up a proxy to browse Wikipedia by sending and receiving WhatsApp messages. I'm sure you could extend that to be a web proxy.
aantix 3y ago
Hussein Nasser covered this. His videos are great. How Airline WIFI allows Texting but not Media in WhatsApp/iMessage https://www.youtube.com/watch?v=AYSxxO2yZp8 https://www.youtube.com/watch?v=AYSxxO2yZp8
deleted 3y ago
[deleted]
aabhay 3y ago
So so surprised that nobody has found out the hack for free wifi on alaska flights. (At risk of losing awesome free wifi) 1. Open browser with iOS user agent and ios sized h/w. 2. Click on t-mobile free wifi link 3. Enter _any_ t mobile number you may know.

sixstringtheory 3y ago

Could always send base64 data strings!

phantom784 3y ago

I'd suspect it kills TCP connections once a threshold of data has been transferred, and the threshold is enough to let text through but not enough for attachments.

grishka 3y ago
Good luck doing that against Telegram. It would simply reconnect and resume the download where it left off.

alexfoo 3y ago

https://news.ycombinator.com/item?id=33568994 https://news.ycombinator.com/item?id=33568994

organsnyder 3y ago

United wifi is similar. I've found that notifications work for most things, including my Home Assistant instance—they must all use the same Apple push service.

atourgates 3y ago
I noticed the same on Alaska flying last weekend. As soon as I activated the "Free Messaging" service, I got a bunch of notifications from my Apple Home and Google Nest devices.
- snazz 3y ago
  Yes, APNs (Apple Push Notification service) has to be allowed for notifications to come through from messaging apps and the network operator can’t tell whether it’s an allowed messaging app or any other kind of notification.
  - mcast 3y ago
    The scale of Apple’s notification service must be pretty large. Granted, most notifications don’t have strong SLA guarantees but I don’t remember it having any downtime either.
    - Klonoar 3y ago
      They don't really make guarantees about the reliability of push notifications (IIRC), so it's unlikely you'd see anything about downtime unless it was sustained for some time.
SirMaster 3y ago
On iOS all notifications have to use Apple's Push service. And the WiFi essentially has to allow the Apple push notification system entirely in order for iMessage to work fully the way people expect. So it's really a side effect. But yeah for example with the free iMessage connection on Southwest, I can see all the notifications come in on Discord, but of course I cannot connect within the discord app to actually load all those messages. I can only read them as they come in as push notifications.
- Xeamek 3y ago
  >On iOS all notifications have to use Apple's Push service. Have to? Isn't there an option to send 'offline' notification? I mean, coming from the app itself, rather then external callback? With that, app could ommit the official way of using Apple Push service, no?
  - SirMaster 3y ago
    Well, apps can only "run in the background" for up to 10 minutes. So sure, an app can generate a notification popup itself, but it's pretty limited as it won't be able to generate a notification after being backgrounded for more than 10 minutes. And the 10 minutes is also only if the app is designed to extend the duration as long as possible. Normally it would get cut off after 1 minute. So because of this it seems that in the vast, vast majority of cases apps choose to send their notifications from the Apple Push notification service.
  - WirelessGigabit 3y ago
    Yea but those mean the app has to be running. The main advantage of Apple's Push is that the app can be put to sleep and only wake up when you tap a notification.

gouggoug 3y ago

I've been wondering the same. I wonder if they just do some rudimentary packet inspection and drop packets above a certain size. My thinking being that short text messages result in very small packets, while large images will result in many large packets. Dropping large packets is most likely OK. I'd need to test this hypothesis by sending a very large text message (resulting in many large packets)

TRiG_Ireland 3y ago

I've come across wifi zones which allow normal web browsing, WhatsApp messaging (including pictures), but not WhatsApp calls. I saw it first in Hollyhead Port while waiting for a ferry. WhatsApp threw up an error message saying that calls were disallowed by the wifi network.

miki123211 3y ago

Do they allow Telegram? If so, that would be the easiest, Telegram has a really good bot API.

Karrot_Kream 3y ago
Many do but some don't. I wrote an HTTP Proxy for Telegram and it works fine for those situations but is very slow. I prefer using an NNCP proxy I wrote because the protocol doesn't have online liveness requirements.

dag11 3y ago

Hi fellow Alaska frequent flier. So about that! There's this iOS app called Flightly that does a brilliant little hack where the app updates itself in (almost) real time on the "free messaging" plan. The way it works (according to a friend) is that their servers send your phone a push notification every couple of minutes from take-off until landing, containing some serialized info such as lat,long,alt,eta,etc. And then the app immediately swallows the notification and deserializes its content without you ever seeing it. The notification works because in order for Alaska to give you notifications at all for your messaging apps, it needs to give you access to _all_ push notifications as they all get sent over an encrypted connected through Apple's server and it can't pick and choose which apps' notifications it lets through. I've often wondered if it'd be possible to pipe any sort of internet over notifications but I'm not sure if e.g. inline responses are viable, and also that'd probably be heavy enough usage of push notifications I'm sure it's violate someone's TOS.

dgellow 3y ago
Really hoping someone implements this, it’s the funniest project idea I’ve seen in a while :)
el_benhameen 3y ago
I’ve always wondered why I get slack and email notifications when I’m on a Southwest flight with free messaging without paying for wifi. You’ve finally solved my mystery!
keanebean86 3y ago
I had an idea to use Facebook messanger as a proxy. Specifically to use the cheap messaging plan on a cruise ship for real internet access. My home computer would be a gateway that monitors fb and fetches/returns websites. I never even tried because it just sounds like a violation of multiple ToSes. Not to mention message size limitations, throttling, my fb messages being pages of encoded text, etc. I feel like it would need to work like Opera mini to maybe be usable. Even then interactions would be uncomfortably slow. https://en.m.wikipedia.org/wiki/Opera_Mini https://en.m.wikipedia.org/wiki/Opera_Mini

matsemann 3y ago

How does that fly (pun intended) with regards to net neutrality? Where I live, some mobile operators gave you "unlimited streaming" in their data plan, but only for certain popular services (spotify, youtube, netflix basically). Since this would make it harder for others to disrupt the big ones, it was quickly forbidden.

hot_gril 3y ago
Is net neutrality even law anymore? T-Mobile has had Binge on for a long time, which zero-rates certain video streaming services. And part of that was even under the old net neutrality laws.
- technothrasher 3y ago
  No, but the now Democratic majority at the FCC is currently actively trying to bring it back.
- toast0 3y ago
  Binge On doesn't fall under strict net neutrality, but they are at least publicly open to all lawful and licensed content audio/video providers, and the technical requirements are not very high. I don't know what the actual onboarding process is like, but they've got a lot of providers signed up...
  - hot_gril 3y ago
    https://www.t-mobile.com/tv-streaming/binge-on/apps-list.html https://www.t-mobile.com/tv-streaming/binge-on/apps-list.htm... doesn't list all that many providers if we're talking about all video streaming services worldwide. I notice a large one under the gaming category missing, Twitch.
    - toast0 3y ago
      I think they've got to be licensed for US customers, or T-Mobile USA isn't going to include them. Twitch does seem to be a notable missing provider; Amazon video is on the program though, so maybe there's some technical or product thing on Twitch's side.

tuetuopay 3y ago

some options: - attachments are likely stored in a different part of the infra than raw messages (like on some s3 bucket somewhere), so it's pretty easy to allow the WA/iMessage/Signal/Messenger API while blocking their CDN through dns blocking, ip range blocking, sni inspection, etc. - they cut the tcp connection once more than e.g. 1MB has been transferred. it would result in slightly degraded user experience (the message tcp stream needs to be periodically reopened), and may not be foolproof is apps are smart and resume the download where it failed instead of from the start I lean for the first option as it's both the simplest and most foolproof option.

danielfoster 3y ago

I've also wondered why Grindr but not Tinder works on the "messaging only" plan. Someone at Alaska must have had fun with that one. Flightaware.com also works, presumably because Alaska uses Flightaware for its tracking map.

0_____0 3y ago
Grindr is a logistics app, Tinder is entertainment :p
noahtallen 3y ago
> Flightaware.com also works Unfortunately, I couldn't get it to load on my Alaskan flight a few days ago on the free messaging plan. Maybe they've changed it

dannyfritz07 3y ago

Google Voice always works for me too FYI.

teeray 3y ago

Time to implement IP over FB Messenger

falcor84 3y ago
Absolutely. And I'll just put this here for anyone who's looking for inspiration: https://www.rfc-editor.org/rfc/rfc2549 https://www.rfc-editor.org/rfc/rfc2549

godelski 3y ago

On my recent United flight, where they had the same policy I was sending image messages to friends through Signal. But it was rather slow, so my best guess is rate limiting.

hot_gril 3y ago

I always assumed they have a whitelist of iMessage/Whatsapp/whatever IP addresses. It doesn't seem to work for all messaging apps in general.

gsich 3y ago

SNI or IP lists.

RandallBrown 3y ago

Probably 10-15 years ago when wifi on airlines was still pretty brand new I remember a fun hack for free Internet that involved Google Translate. Because the wifi landing pages used Google Analytics, they allowed traffic through from many of the Google domains. You could then go to Google translate and translate the website from English to English and use it as sort of a proxy server to get free Internet.

smegger001 3y ago
You could probably have used googels cache to read arbitrary pages as well.
spike021 3y ago
I'll probably show my age, but around 15 years ago I was in high school and they blocked most websites as well. This "hack" using Google Translate was how some of us got around the blocklist for many things. It was nice because it didn't involve having to install anything special or try to change configurations that were probably monitored by library/school admin.
noman-land 3y ago
This hack often works today to get around paywalls.

technothrasher 3y ago

Many years ago, when hotels first started having and charging for WiFi connections, I wrote a simple little tunnel using the DNS port back to my server. Since the hotels didn't block that port or even bother to check what traffic was going over it, it worked like a charm. I tried it on a trip to Tokyo and immediately got completely blocked. It took me a few minutes to figure out they'd blacklisted my MAC address. I changed the MAC of that interface and then behaved.

someotherperson 3y ago
Reminds me of using VPNs in hotels in China some years ago. Traffic would work for a few minutes and then the Great Firewall kicks in, fingerprints the traffic as VPN and the IP address and the MAC gets blocked. I'd rotate the endpoint and the MAC address and get a few more minutes, rinse and repeat. I think I had to use Shadowsocks or something at the end to completely bypass it.
- superkuh 3y ago
  Shadowsocks(-libev) is great. I use it in the USA with Comcast to prevent their MITM attacks on HTTP connections.

justapassenger 3y ago

I don’t think they have any sophisticated solution for sniffing traffic. It’s most likely simple firewall + deals with Apple/Meta. Many airlines offer basic Wi-Fi for messages nowadays, so it’s very likely that big tech developed solution for it (especially, as they have initiative to do that, so their apps can work).

toast0 3y ago

I used to work at WhatsApp (until the end of 2019) on many things, including special pricing (aka zero rating); we did not work with airlines, and would not have participated in a project where messages and attachments where treated differently. That said, technically there's two pretty easy ways to do it for WhatsApp traffic, and then there's the way I suspect they're doing it... a) chat runs on different ips than attachments; always has, most likely always will (other than some transitional HAProxy at the old hosting when nearly everything had been moved to the new hosting). b) WA chat is not HTTPS (or even TLS) and attachments are. Chat also cycles between different ports, so you could just block port 443 and be good. c) I actually suspect, based on poking around a little that it's mostly just killing connections that use a lot of data. Maybe in combination with some other things. Being on a plane doesn't really put me in a debug the network kind of mood, so I never got to the bottom of it, but I'd regularly be able to make short connections to my home network while on the messaging plan, at least when this stuff was new. OTOH, I think I recall being able to connect through the WA VPN while on a plane on the messaging plan, but that was when we had a publicly available, but not publicly linked list of IP addresses on our website; I have no doubt that DPI vendors had that list.

dgellow 3y ago
> WA chat is not HTTPS (or even TLS) If you don’t mind, could you expend on this? Are there specific reasons to not be using TLS?
- blapp 3y ago
  It's based on the Noise Protocol Framework in the outermost layer, which encrypts a compressed XMPP stream. The end-to-end encryption is done within various XMPP message payloads using the Signal Protocol, which encrypts message data serialized using Protocol Buffers, with different formats depending on the message type (text, image, video, sticker, etc).
- toast0 3y ago
  I should probably refer you to the encryption whitepaper [1], but the basics are that Chat uses the Noise Protocol rather than TLS. All things being equal, the security properties are about equivalent, however all things aren't equal. The Noise handshake is smaller than the TLS handshake, and Noise doesn't have extraneous features WhatsApp doesn't use. Additionally, at the time of Noise adoption, TLS lacked a means for 0-RTT data (now available with TLS 1.3 Early Data), which meant using TLS would have added at least one round trip; possibly two, depending on which TLS library used. [2] You can use TLS without x.509, but it's not very common; avoiding x.509 was a definite plus. I wasn't much involved in anything on the chat channel, and I didn't do any implementation work on Noise, but I did some later prototype work with it, and if I recall correctly, it had much simpler framing than TLS as well; although maybe that was mostly TLS options getting me down --- the SNI header has 9 bytes of overhead, 5 of which are lengths, Noise didn't have anything like that as I recall. Do you really two bytes of versioning on every application data packet, like TLS has? I'm not sure you really need a type indicator byte either, context says you're sending a handshake packet initially, and then application data after that, but I'm pretty rusty on this now, so maybe there's a justification. For users paying for internet by the byte, every byte counts. For users on networks with large delays, every round trip counts. For attachments, it's less critical (if your data access costs were high, you could configure attachments not to load) and that infrastructure was always built around http(s), so while there would have been an efficiency improvement to move that off https, it would be hard to justify the engineering time; especially post the move to FB infrastructure with its CDN that was easily configured for our attachments. OTOH, chat never ran on TLS, so adopting Noise vs adopting TLS was a choice we could consider, and we picked the best solution for us. Unfortunately, it's pretty easy to identify Noise vs TLS --- OTOH, the service IPs are already identifiable, so a little more blending on the protocol level wouldn't help much. [1] https://www.whatsapp.com/security/WhatsApp-Security-Whitepaper.pdf https://www.whatsapp.com/security/WhatsApp-Security-Whitepap... [2] Also using system TLS libraries is fraught with peril. It's fine, but not super great, for http, but using it for a custom binary protocol is going to be terrible. You'll need to debug all of the edge cases that the system https library doesn't hit, and will then have to craft workarounds that just work, even if you can't reliably identify the underlying versions because Android OEMs do weird stuff.

c7DJTLrn 3y ago

You could try iodine, which is an IP-over-DNS tunnel. This should work unless the gateway has very restrictive rules on where DNS traffic can go. https://github.com/yarrick/iodine https://github.com/yarrick/iodine

jedberg 3y ago
Most captive portals have gotten wise to this trick and block large DNS requests.
- roygbiv2 3y ago
  Yeah I recently found this out. It never really did work that well, I did manage to telnet into an SMTP server and manually send an email but for anything else it struggled. I wonder if TCP over ICMP would work better.

dheera 3y ago

IP-over-Facebook. So that's what the world has come to ...

kayson 3y ago

I can't seem to find it, but there was a blog post on HN a while back about how someone set up a proxy to browse Wikipedia by sending and receiving WhatsApp messages. I'm sure you could extend that to be a web proxy.

aantix 3y ago

Hussein Nasser covered this. His videos are great. How Airline WIFI allows Texting but not Media in WhatsApp/iMessage https://www.youtube.com/watch?v=AYSxxO2yZp8 https://www.youtube.com/watch?v=AYSxxO2yZp8

deleted 3y ago

[deleted]

aabhay 3y ago

So so surprised that nobody has found out the hack for free wifi on alaska flights. (At risk of losing awesome free wifi) 1. Open browser with iOS user agent and ios sized h/w. 2. Click on t-mobile free wifi link 3. Enter _any_ t mobile number you may know.