9 ms·
Hello! I've got experience working on censorship circumvention for a major VPN provider (in the early 2020s). - First things first, you have to get your hands
by _verandaguy 1y ago
Hello! I've got experience working on censorship circumvention for a major VPN provider (in the early 2020s).
- First things first, you have to get your hands on actual VPN software and configs. Many providers who are aware of VPN censorship and cater to these locales distribute their VPNs through hard-to-block channels and in obfuscated packages. S3 is a popular option but by no means the only one, and some VPN providers partner with local orgs who can figure out the safest and most efficient ways to distribute a VPN package in countries at risk of censorship or undergoing censorship.
- Once you've got the software, you should try to use it with an obfuscation layer.
Obfs4proxy is a popular tool here, and relies on a pre-shared key to make traffic look like nothing special. IIRC it also hides the VPN handshake. This isn't a perfectly secure model, but it's good enough to defeat most DPI setups.
Another option is Shapeshifter, from Operator (https://github.com/OperatorFoundation https://github.com/OperatorFoundation). Or, in general, anything that uses pluggable transports. While it's a niche technology, it's quite useful in your case.
In both cases, the VPN provider must provide support for these protocols.
- The toughest step long term is not getting caught using a VPN. By its nature, long-term statistical analysis will often reveal a VPN connection regardless of obfuscation and masking (and this approach can be cheaper to support than DPI by a state actor). I don't know the situation on the ground in Indonesia, so I won't speculate about what the best way to avoid this would be, long-term.
I will endorse Mullvad as a trustworthy and technically competent VPN provider in this niche (n.b., I do not work for them, nor have I worked for them; they were a competitor to my employer and we always respected their approach to the space).
- azalemeth 1y agoThank you very much for a detailed answer. Might I rudely ask -- as you're knowledgeable in this space, what do you think of Mullvad's DAITA, which specifically aims to defeat traffic analysis by moving to a more pulsed constant bandwidth model?
- _verandaguy 1y agoDAITA was introduced after my time in the industry, but this isn't a new idea (though as far as I know, it's the first time this kind of thing's been commercialized). It's clever. It tries to defeat attacks against one of the tougher parts of VPN connections to reliably obfuscate, and the effort's commendable, but I'll stop short of saying it's a good solution for one big reason: with VPNs and censorship circumvention, the data often speaks for itself. A VPN provider working in this space will often have aggregate (and obviously anonymized, if they're working in good faith) stats about success rates and failure classes encountered from clients connecting to their nodes. Where I worked, we didn't publish this information. I'm not sure where Mullvad stands on this right now. In any case -- some VPN providers deploying new technology like this will partner with the research community (because there's a small, but passionate formal research community in this space!) and publish papers, studies, and other digests of their findings. Keep an eye out for this sort of stuff. UMD's Breakerspace in the US in particular had some extremely clever people working on this stuff when I was involved in the industry.
- paxcoder 1y agoHave you heard about Safing's "SPN"? Could you comment on that?
- pogue 1y agoI came across this recently too and it piqued my interest as well. The way they describe it makes it sort of sound like split tunneling and geotunneling can be done with DNS. https://safing.io/spn/ https://safing.io/spn/
- zelphirkalt 1y agoIf you are on a limited data plan, beware, DAITA produces a lot of traffic.
- hsbauauvhabzb 1y agoI’m curious about what makes it difficult to block a vpn provider long term. You said getting the software is difficult, but can a country not block known vpn ingress points?
- _verandaguy 1y agoA country can and absolutely will block known VPN ingress points. There are two tricks that we can use to circumvent this: - Host on a piece of infrastructure that's so big that you can't effectively block it without causing a major internet outage (think: S3, Cloudflare R2, etc). Bonus points if you can leverage something like ECH (ex-ESNI) to make it harder to identify a single bucket or subdomain. - Keep spawning new domains and subdomains to distribute your binaries. There are complications with both approaches. Some countries block ECH outright. Some have no problem shutting the internet down wholesale for a little bit. The domain-hopping approach presents challenges w/r/t establishing trust (though not insurmountable ones, much of the time). These are thing that have to be judged and balanced on a case-by-case basis, and having partners on the ground in these places really helps reduce risk to users trying to connect from these places, but then you have to be very careful talking to then since they could themselves get in trouble for trying to organize a VPN distribution network with you. It's layers on layers, and at some point it helps to just have someone on the team with a background in working with people in vulnerable sectors and someone else from a global affairs and policy background to try and keep things as safe as they can be for people living under these regimes.
- shawa_a_a 1y agoI've heard of domain fronting, where you host something on a subdomain of a large provider like Azure or Amazon. Is this what you're talking about when you say > - Host on a piece of infrastructure that's so big that you can't effectively block it without causing a major internet outage (think: S3, Cloudflare R2, etc). How can one bounce VPN traffic through S3? Or are you just talking about hosting client software, ingress IP address lists, etc?
- _verandaguy 1y ago
- btown 1y agoThis makes me wonder: are there "cloud drive virtual sneakernet" systems that will communicate e.g. by a client uploading URL request(s) as documents via OneDrive/SharePoint/Google Drive/Baidu etc., a server reacting to this via webhook and uploading (say) a PDF version of the rendered site, then allowing the client to download that PDF? You effectively use the CDN of that service as a (very slow) proxy. Of course, https://xkcd.com/538/ https://xkcd.com/538/ applies in full force, and I don't have any background in the space to make this a recommendation!
- jack_pp 1y agoIt doesn't apply imo as OP is probably not a high value target of the govt, he just wants to bypass his govt restrictions and I doubt the situation is so bad that the govt will send people physically to deal with people circumventing the block. Your solution could technically work over any kind of open connection / data transfer protocol that isn't blocked by the provider but it would be an absolute pain to browse the web that way and there are probably better solutions out there.
- cluckindan 1y agoHow about IPv6 over S3? https://xeiaso.net/blog/anything-message-queue/ https://xeiaso.net/blog/anything-message-queue/
- exe34 1y agoI wonder if it can be embedded in a video stream, like a video of a lava lamp that you always have open, but the lsb of ever byte is meaningful.
- _verandaguy 1y agoThat's an interesting idea, and probably something you might be able to achieve with a tool like h26forge. It's also probably more useful to just have a connection be fully dedicated to a VPN, and have the traffic volume over time mimic what you'd see in a video, rather than embedding it in a video -- thanks to letsencrypt, much of the web's served over TLS these days (asterisks for countries like KZ and TM which force the use of a state-sponsored CA), so going to great lengths to embed your VPN in a video isn't really practical.
- myshoemouth 1y agoI'm curious. How does a state actor do actual DPI without pushing certs to end user devices?
- teraflop 1y agoThe "inspection" part of DPI isn't limited to encrypted payloads. It's straightforward enough to look at application-level protocol headers and identify e.g. a Wireguard or OpenVPN or SSH connection, even if you can't decrypt the payload. That could be used as sufficient grounds to either block the traffic or punish the user.
- mr_mitm 1y agoI thought OpenVPN simply opens a TLS encrypted connection. How does it look different than HTTPS?
- oasisbob 1y agoDPI refers to a broad class of products which attempt to find signals and categorize traffic according to a ruleset, either to block it or throttle the speeds, etc. While access to plaintext is useful, it's not required for other rules which are eg looking at the timing and frequency of packets.
- mrbluecoat 1y agoNetwork fingerprinting, like https://github.com/FoxIO-LLC/ja4 https://github.com/FoxIO-LLC/ja4
- unethical_ban 1y agoPatterns of data transmission (network behavioral analysis, I just made that term up), analyzing IP and ports, inspecting SSL handshakes for destination site. In short, metadata.
- dev_l1x_be 1y agoBecause you are leaking information left and right with TCP / DNS and all these basic protocols that powering the internet today. When these were designed people were happy that it worked at all and nobody really tought that it should be state actor proof. Except maybe DJB. https://www.curvecp.org/ https://www.curvecp.org/
- teeray 1y ago> First things first, you have to get your hands on actual VPN software and configs. It would be nice if one of the big shortwave operators could datacast these packages to the world as a public service.
- downrightmike 1y agohttps://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand
- NamTaf 1y agoStreisand is extremely out of date and wouldn’t last long in China, but I don’t know how sophisticated Indonesia’s firewall is
- fsckboy 1y agoi have a few chinese friends and they say it's always easy to get a working vpn. that might not be true in a Tien An Minh type crisis, i dunno, but month in month out year upon year they surf western sites, exchange winnie the pooh pictures, etc. i suppose the people i know could be relatively upper class, i have no idea what type difference that could make. i had a chinese gf in LA who would send... my >cough< pictures... to her mother in china because she enjoyed them
- akk0 1y agoThe way you phrased this makes it sound like your ex was sending your dick pics to her mom, which I'm not sure is the intended reading (but more power to them...?)
- mfiro 1y agoThe problem is the countries, which censor Internet and block VPNs, also jam shortwave radio signals.
- 1y ago
- mulchpower 1y agoThere are some techniques like fragmented TLS and reordered packets that work in some cases. Also using vanilla HTTPS transport is a good start for many places. URnetwork is an open source, decentralized option that does all of these out of the box. You can get it on the major stores or F-Droid.
- 77pt77 1y agoObfs4proxy and Shapeshifter are an absolute PITA to install. Get your own VPS server (VPS in EU/US with 2GB of ram, 40GB of disk space and TBs/month of traffic go for $10 a year, it's that cheap). Never get anything in the UK and even USA is weird. I'd stick with EU. Install your software (wireguard + obsfuscation or even tailscale with your own DERP server) Another simpler alternative is just `ssh -D port` and use it as a SOCKS server. It's usually not blocked but very obvious.
- mrb 1y agoIn my experience, in China as of 2016, "ssh -D" vasn't reliable at all, I wrote more details at https://blog.zorinaq.com/my-experience-with-the-great-firewall-of-china/ https://blog.zorinaq.com/my-experience-with-the-great-firewa... (see "idea 1")
- jquery 1y agoI just spent 3 months in China this summer. The GFW has become much more sophisticated than I remember. I found only one method that reliably worked. That was to use Holafly (an international eSIM provider) and use its built-in VPN. China largely doesn’t care if foreigners get around the GFW, I guess. Another method that usually worked was ProtonVPN with protocol set to Wireguard. Not sure why this worked, it’s definitely a lot more detectable than other methods I tried. But as long as I rotated which US server I used every few days, this worked fine. No luck with shadowsocks, ProtonVPN “stealth” mode, Outline+Digital Ocean, or even Jump / Remote Desktop. Jump worked the longest at several hours before it became unbearably slow, I’m still not sure if I was actually throttled or my home computer started misbehaving. I didn’t get around to setting up a pure TLS proxy, or proxying traffic through a domain that serves “legitimate” traffic, so no idea if that still works.
- edm0nd 1y agoHolafly (and other "travel" eSim providers) have been caught routing traffic through China. https://www.itnews.com.au/news/travel-esims-secretly-route-traffic-over-chinese-and-undisclosed-networks-study-619659 https://www.itnews.com.au/news/travel-esims-secretly-route-t...
- ivanstepanovftw 1y agoThis is no 'nothing special' with Obfs4proxy. DPI sees it as random byte stream, thus your government can decide to block unknown protocols. Instead, you should trick DPI into thinking it sees HTTPS. Unless your government decides to block HTTPS.
- rafram 1y ago> your government can decide to block unknown protocols Has any government ever done that? Seems like it would just break everything (because the world is full of devices that use custom protocols!) at great computational expense.
- thenthenthen 1y agoChina blocked https last week: https://www.tomshardware.com/tech-industry/cyber-security/chinas-great-firewall-blocked-all-traffic-to-a-common-https-port-for-over-an-hour-with-no-hint-as-to-its-intention https://www.tomshardware.com/tech-industry/cyber-security/ch... Discussion: https://news.ycombinator.com/item?id=44958621 https://news.ycombinator.com/item?id=44958621
- rafram 1y agoThey blanket blocked connections to port 443 for an hour. There was no protocol sniffing.
- ivanstepanovftw 1y agoRussia tested this in production by blocking Shadowsocks https://habr.com/ru/news/770840/ https://habr.com/ru/news/770840/
- commandersaki 1y agoThe only VPN technology I see that blends as HTTPS is MASQUE IP Proxying, and the only implementation I know that does this is iCloud Private Relay. It is also trivial to block because blocking 443/udp doesn't really affect accessing the Internet.
- lossolo 1y agoMullvad is a bad choice for this particular case because they publish all their IPs, which makes them very easy to block. You should look into VPN providers that do not publish their IPs and that have a wide range of IP classes and multiple ASNs, which look like ordinary networks not associated with VPNs. In my experience, NordVPN and ExpressVPN have many of these.
- thenthenthen 1y agoExpress and Nord are completely useless in China. Mullvad worked fine two years ago but is getting worse, not sure if it still works currently.
- pipes 1y agoThanks for this, UK citizen/subject here I believe the UK government is likely to go down the path of banning vpns.
- kilroy123 1y agoISPs here are already blocking popular ones.
- andy_ppp 1y agoIn the UK? That’s insane
- juntoalaluna 1y agoIts also not true.
- extraisland 1y agoNo they are not. It is being talked about adding age-gating to the VPNs.
- Cypher 1y agogotta go underground, freedom is now an enemy of the crown.
- ethbr1 1y agoT minus not much until UK punk revival
- belter 1y agoIt will be done very soon.... "Dame Rachel told BBC Newsnight: "Of course, we need age verification on VPNs - it's absolutely a loophole that needs closing and that's one of my major recommendations." - https://www.bbc.com/news/articles/cn438z3ejxyo https://www.bbc.com/news/articles/cn438z3ejxyo They phrase it as age verification, but what they mean is the VPN provider needs to provide them the client list...
- pickdig 1y agomullvad with DAITA is pretty good you can also purchase mullvad with cryptocurrencies, cash, etc.
- massung 1y agoFirst, this is great information in an area I know very little about. But I’m curious - from your experience - how do you know the OP isn’t pretending in order to learn about new avenues to block or attack or to track down people who are trying to circumvent? I don’t mean that as a “be careful”. You’re the expert compared to me and for all I know these are unblockable. Or maybe those doing the blocking would already know about them? So I’m interested in just understanding more.