Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: The government of my country blocked VPN access. What should I use?

news.ycombinator.com

Post reply on HN
Print view View original

411–420 of 775 posts

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#411

Post by tiberious726 »

ivanstepanovftw wrote: post #306
_verandaguy wrote: post #97

Hello! I've got experience working on censorship circumvention for a major VPN provider (in the early 2020s). - First things first, you have to get your hands on actual VPN software and configs. Many providers who are aware of VPN censorship and cater to these locales distribute their VPNs through hard-to-block channels and in obfuscated packages. S3 is a popular option but by no means the only one, and some VPN prov…

This is no 'nothing special' with Obfs4proxy. DPI sees it as random byte stream, thus your government can decide to block unknown protocols. Instead, you should trick DPI into thinking it sees HTTPS. Unless your government decides to block HTTPS.

Exactly this. Hell, for OP's use case of accessing things like twitter, a good old fashioned https proxy would be entirely fine, and likely not even illegal.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#412

Post by protocolture »

breve wrote: post #347
protocolture wrote: post #342

Earlier quoted context omitted.

Part of that is knowing whats happening inside the country, of which they were previously using tools like discord, which have now been blocked. So the first step to using people power to make Indonesia a more open, democratic society would be to find a way to tunnel out to get and share that information. To that end the OP has created this Ask HN thread.

Nope. The outside doesn't matter. The problem is on the inside. External websites will never fix the internal problem. There are no technical solutions to what is fundamentally a problem of political culture.

>External websites will never fix the internal problem.

Except the internal problem is censoring internal information sources. They can only trust external sites to remain neutral.

Not to mention that, politically and historically speaking, there are so many examples of revolutionaries needing to go overseas to organize. The Bolshies literally got started in a London pub.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#414

Post by transcriptase »

ianburrell wrote: post #386
teeray wrote: post #242

Earlier quoted context omitted.

> First things first, you have to get your hands on actual VPN software and configs. It would be nice if one of the big shortwave operators could datacast these packages to the world as a public service.

There isn't enough bandwidth in HF to transmit data. Digital HF audio is 20 kHz wide so maybe 50kbps. The entire HF band is only 3-30 MHz.

Wait until you find out what people used to do with phone lines!

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#416

Post by gwbas1c »

ultim8k wrote: post #371
akho wrote: post #339

Earlier quoted context omitted.

Starlink, by policy, connects you through a ground station in the same country. They wouldn't be allowed to operate otherwise.

Why? Can someone block the sky? (I have 0 satellite knowledge)

It's not about blocking the sky. Starlink sends the internet connection back down to the ground somewhere in the country you are in.

That being said, if I have an American starlink account, and I go to Indonesia, what happens? Does my internet connection go back down through Indonesia or does it go through somewhere else?

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#418

Post by fn-mote »

77pt77 wrote: post #318
ailun wrote: post #265

Earlier quoted context omitted.

Mullvad worked okay in China in June for me. I imagine it will be better in Indonesia with their less sophisticated blocking.

This makes no sense. On the one hand they do DPI with ML. On the other hand a major player is open! Something is not right here...

Spell out your argument more. Find some hard evidence. Even “major player” needs to be backed up.

Do you even know how many users Mullvad has in CN? I don’t. Searching says the whole company apparently has ~500k users. I don’t think that’s enough to be a significant presence in China.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#419

Post by Hizonner »

raincole wrote: post #368
Hizonner wrote: post #182

Earlier quoted context omitted.

Hmm. People who recommend widely used approaches, and well-known, well-established providers, "don't have any experience with cenorship circumvention". So the solution is no-name providers using random ad-hoc hackery, chosen according to a criterion more or less custom designed to lead you into watering hole attacks. Right.

It's very sad that every sane and informed comment (like reisse's) has to meet this kind of snarky comment whose only purpose is being snarky on HN. Perhaps you should stop and think about why people living in countries where governments actually censor a lot hardly use these "well-established providers" to circumvent censorship. Tip: it's not because they're stupid.

Actually, my main original purpose was to call (more) attention to the fact that looking for somebody specifically advertising a VPN to your particular country, for a censorship-resistance purpose, has a vastly greater chance of getting you a honey pot than almost any other possible way of looking for a relay. Honey pots are particularly dangerous in one-hop protocols with cleartext exit.

The part about the unreliable ad-hockery is also true, albeit less critical. The fact is that you don't know what your adversary is doing now, and you definitely don't know what they're going to to roll out next. You don't have to be stupid to decide to take that risk, but you also don't have to be particularly stupid to not think about that risk in the first place, especially when people are egging you on to take it.

The greater purpose underlying both is to keep people from unknowingly getting in over their heads. I have seen lots of people do actually stupid things, up close and personal, especially when given instructions without the appropriate cautions.

And "services and providers" doesn't necessarily mean commercial VPNs. In fact those were way down the list of what I had in mind. Your own VPS is a "provider". So is Tor or I2P (not that those won't usually run into problems). So is your personal friend in another country.

Re: Ask HN: The government of my country blocked VPN access. What should I use?

#420

Post by sterlind »

incrediblesulk wrote: post #328
shawa_a_a wrote: post #190

Earlier quoted context omitted.

I've heard of domain fronting, where you host something on a subdomain of a large provider like Azure or Amazon. Is this what you're talking about when you say > - Host on a piece of infrastructure that's so big that you can't effectively block it without causing a major internet outage (think: S3, Cloudflare R2, etc). How can one bounce VPN traffic through S3? Or are you just talking about hosting client software, i…

I thought a lot of the domain-fronting approaches have largely been closed from policy changes at major CDNs (e.g. https://techcommunity.microsoft.com/blog/azurenetworkingblog... ) . Or is it still possible through other approaches?

ECH (Encrypted Client Hello) brings back a kind of domain fronting, except you don't need to front anything at all. the Client Hello itself is encrypted, so the SNI is hidden.

hopefully ECH will catch on. I suspect the corporate backlash over domain fronting was them not wanting to be caught in the crossfire if their domain was used as a front. if e.g. Signal used "giphy.com" as a front, Russia might block giphy to block Signal. but if Signal is hosted on, say, AWS, and ECH was used, Russia would have no option other than blocking the entirety of AWS, since all TLS handshakes to AWS would look the same.

though cloud providers (other than CloudFlare, respect!) don't seem to care about censorship or surveillance anymore, and might decline to adopt ECH if some lucrative market complains.

Post reply on HN