China is one black swan event away from an economic collapse and possible Arab spring. The authoritarian Chinese government is starting to have some sense of fear now.
Between the 300%+ gdp/debt ratio, second real estate bubble bursting in shanghai/tier1 cities, huge spike in shadow lending, stalled stock market, complete frozen capital control, Trump's 100 day ultimatum to China regarding trade deficit, demographics crisis, NK situation, south asia island situation, protectionisms against China in europe/US/Japan, Foreign Direct Investments leaving China, etc.
China Tells Carriers to Block Access to Personal VPNs by February
11–20 of 141 posts
Re: China Tells Carriers to Block Access to Personal VPNs by February
#12Previously, there was an implicit understanding that the Great Firewall was in place to prevent unauthorised access to the Internet by the masses. This is to prevent them from being influenced by foreign media, prevent too much information leakage of citizen info (e.g. via facebook), and to give Chinese tech companies a monopoly in China.
If, however, you had the will and ability to use VPN software, the government usually turned a blind eye. Afterall, it was only a minority of people and they usually had a genuine need. In fact, this is what made staying in China tolerable. If this block does truly come into effect, they are essentially closing the door to the outside world.
China was a country of reasonable compromises before, but with Xi Jinping's nationalism, they are starting to think "why should we compromise at all?"
Re: China Tells Carriers to Block Access to Personal VPNs by February
#13Earlier quoted context omitted.
Yes, deep packet inspection with ML, read for example here [1] [1] http://blog.zorinaq.com/my-experience-with-the-great-firewal...
DPS will give you nice and beautifully encrypted payloads. Now what? Emulating a standard browser TLS handshake is a no-brainer.
The Great Firewall blocks these no problem, not sure if you realize the scale of who and what you are dealing with.
There are enough side channels leaked trying to proxy an Internet connection through an encrypted tunnel, this is picked up on through Machine Learning or otherwise and it pretty effectively blocks many forms of escape. Read the parent article, let it soak in, and come back.
And from TFA, it looks like whatever China can't block through technology, they are blocking through politics.
Re: China Tells Carriers to Block Access to Personal VPNs by February
#14Previously, there was an implicit understanding that the Great Firewall was in place to prevent unauthorised access to the Internet by the masses. This is to prevent them from being influenced by foreign media, prevent too much information leakage of citizen info (e.g. via facebook), and to give Chinese tech companies a monopoly in China. If, however, you had the will and ability to use VPN software, the government u…
That was never the official or even the implicit position. There has always been a war with VPNs, want VPNs work and don't can change monthly, and it's been like that for the last 10 years. Xi's nationalism is nothing new here, they just think that the tech is good enough to cut off VPNS for good now.
China has been trying to close their internet since after the Olympics. It isn't surprising that they would eventually succeed at it.
Re: China Tells Carriers to Block Access to Personal VPNs by February
#15Previously, there was an implicit understanding that the Great Firewall was in place to prevent unauthorised access to the Internet by the masses. This is to prevent them from being influenced by foreign media, prevent too much information leakage of citizen info (e.g. via facebook), and to give Chinese tech companies a monopoly in China. If, however, you had the will and ability to use VPN software, the government u…
[deleted]
Re: China Tells Carriers to Block Access to Personal VPNs by February
#16Time to get funds for 443 port vpn startups. ;) Hint: TLS encrypted traffic following an appropriate browser-style handshake cannot be distinguished from "legitimate" https.
Yes, it can. By watching the size and timing of flows with 'regular HTTPS' traffic vs 'VPN HTTPS' traffic, it can be distinguished.
Re: China Tells Carriers to Block Access to Personal VPNs by February
#17China is one black swan event away from an economic collapse and possible Arab spring. The authoritarian Chinese government is starting to have some sense of fear now. Between the 300%+ gdp/debt ratio, second real estate bubble bursting in shanghai/tier1 cities, huge spike in shadow lending, stalled stock market, complete frozen capital control, Trump's 100 day ultimatum to China regarding trade deficit, demographics…
The preconditions of revolution exist in the UK, and most western countries. The number of active pre-conditions is quite stunning, from elite isolation to concentrated wealth to inadequate socialisation and education, to concentrated land holdings to loss of authority to repression of new technologies especially in relation to energy, to the atrophy of the public sector and spread of corruption, to media dishonesty, to mass unemployment of young men and on and on and on. [...] Preconditions are not the same as precipitants. We are waiting for our Tunisian fruit seller. The public will endure great repression, especially when most media outlets and schools are actively aiding the repressive meme of 'you are helpless, this is the order of things.' When we have a scandal so powerful that it cannot be ignored by the average Briton or American, we will have a revolution that overturns the corrupt political systems in both countries, and perhaps puts many banks out of business. Vaclav Havel calls this 'The Power of the Powerless.' One spark, one massive fire. - Robert David Steele, ex-Marine, ex-CIA, Open Source Intelligence Expert in The Guardian, 2014-06-19 ... from my fortune DB @ https://github.com/globalcitizen/taoup
Re: China Tells Carriers to Block Access to Personal VPNs by February
#18not being a network guru how easy is this? I have my VPN set to run over port 443 but I assume it would be easy to see enough of the traffic to see it's a VPN and not an HTTPS connection. I'm assuming that could be obscured in some way but then I've heard even if you can't see the contents you can generally tell it's not HTTPS by looking at the traffic patterns?
You can make it more difficult, but short of actually disconnecting China's network from the rest of the Internet entirely I don't think there's any way to completely prevent it. I had a run-in with a particularly aggressive captive portal last week that kept injecting ads into unencrypted pages (if I'm traveling on one of your vehicles, I don't want to buy tickets to travel with you ), but fortunately didn't firewal…
ssh sessions reveal enough that an interactive session, a file transfer (scp), and sshuttle routing someone web browsing look quite different from one another. Sure, you can multiplex and throw in extra traffic, but it's not trivial.
Re: China Tells Carriers to Block Access to Personal VPNs by February
#19Earlier quoted context omitted.
Yes, deep packet inspection with ML, read for example here [1] [1] http://blog.zorinaq.com/my-experience-with-the-great-firewal...
DPS will give you nice and beautifully encrypted payloads. Now what? Emulating a standard browser TLS handshake is a no-brainer.
The handshake is only one of the many giveaways of a VPN connection. A single HTTPS connection has a certain normal pattern of traffic that is very different from a VPN connection. VPN connections often persist, with bursts of activity as pages are loaded. Even if you repeatedly put up and tear down the VPN connection, you're exchanging large amounts of traffic with a single IP address, which is not typical of normal web browsing behavior. If you can see all of the traffic going in and out of China, you can easily tell which IP addresses and/or ranges host VPN servers. There are many, many features which you can put into an ML model that will identify users that are using VPNs just based on IP headers. Will it block 100% with no false positives? No. However, they can simply set the penalty to be not being able to connect to outside-China IP addresses for half an hour if they detect VPN usage. After tripping this a certain number of times, you get a letter, and then eventually someone pays you a visit. If for some reason this doesn't work, they'll just require everyone to install their MITM root certificate to use the internet like lots of corporations do.
Will some people find ways around it? Yes. However, it will be risky, and if any given technique becomes widespread, they will find a way to block it.
Re: China Tells Carriers to Block Access to Personal VPNs by February
#20Previously, there was an implicit understanding that the Great Firewall was in place to prevent unauthorised access to the Internet by the masses. This is to prevent them from being influenced by foreign media, prevent too much information leakage of citizen info (e.g. via facebook), and to give Chinese tech companies a monopoly in China. If, however, you had the will and ability to use VPN software, the government u…
Non-sense. Just check online articles and blogs to see when they started to block stuff like linux ipsec vpn. You may also check the reports on how/when they "talk" to the shadowsocks vpn author to force him to stop working on the project.