Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

China systematically hijacks internet traffic: researchers

itnews.com.au

Post reply on HN
Print view View original

31–40 of 54 posts

Re: China systematically hijacks internet traffic: researchers

#31

Post by qubax »

jstanley wrote: post #8

It's clear that the internet is too insecure, and the world's super powers can't help themselves, they simply have to meddle with it. Maybe it's time we started using Tor hidden services for everything.

Just like programming languages can only have two out of three concepts ( soundness, completeness, decidability ), the creators of the internet had to choose two out of three concepts ( openness, robustness, security ).

It's theoretically impossible to have a language that is sound, complete and decidable. It's probably also impossible to have an internet that is open, robust and secure.

Re: China systematically hijacks internet traffic: researchers

#32

Post by jstanley »

qubax wrote: post #31
jstanley wrote: post #8

It's clear that the internet is too insecure, and the world's super powers can't help themselves, they simply have to meddle with it. Maybe it's time we started using Tor hidden services for everything.

Just like programming languages can only have two out of three concepts ( soundness, completeness, decidability ), the creators of the internet had to choose two out of three concepts ( openness, robustness, security ). It's theoretically impossible to have a language that is sound, complete and decidable. It's probably also impossible to have an internet that is open, robust and secure.

I don't think that argument holds water.

Which one of "open, robust, secure" do you think Tor doesn't meet?

You can pick any 3 concepts and group them together like that, but it doesn't mean you can't have all 3, e.g. a house can be "large, cheap, and well-decorated" (e.g. if it is in the middle of nowhere).

Re: China systematically hijacks internet traffic: researchers

#33

Post by ZeKZ »

jstanley wrote: post #32
qubax wrote: post #31

Earlier quoted context omitted.

Just like programming languages can only have two out of three concepts ( soundness, completeness, decidability ), the creators of the internet had to choose two out of three concepts ( openness, robustness, security ). It's theoretically impossible to have a language that is sound, complete and decidable. It's probably also impossible to have an internet that is open, robust and secure.

I don't think that argument holds water. Which one of "open, robust, secure" do you think Tor doesn't meet? You can pick any 3 concepts and group them together like that, but it doesn't mean you can't have all 3, e.g. a house can be "large, cheap, and well-decorated" (e.g. if it is in the middle of nowhere).

Tor lacks usability and efficiency.

Re: China systematically hijacks internet traffic: researchers

#34

Post by dangrover »

HippoBaro wrote: post #27
sethbannon wrote: post #11

As someone with a trip to Beijing on the horizon, aside from using a VPN, are there any other best practices to keep data secure while traveling there?

(I live in China) I would advise against VPN entirely. I am unsure about the state ability to decrypt the content of the connection (heavily depends on how the VPN is configured really — weak and legacy ciphers, etc.). But they will detect it and eventually you'll start dropping packets like crazy. A simple way to evade all of this is to use shadowsocks with a strong cipher and strong password between your computer i…

Used to live in China. Can vouch completely for the Shadowsocks approach. It can't be blocked yet. Set up an endpoint at home or on EC2 and configure Streisand. Works great on mobile and desktop.

Re: China systematically hijacks internet traffic: researchers

#35

Post by HippoBaro »

shawnz wrote: post #29
HippoBaro wrote: post #27

Earlier quoted context omitted.

(I live in China) I would advise against VPN entirely. I am unsure about the state ability to decrypt the content of the connection (heavily depends on how the VPN is configured really — weak and legacy ciphers, etc.). But they will detect it and eventually you'll start dropping packets like crazy. A simple way to evade all of this is to use shadowsocks with a strong cipher and strong password between your computer i…

But shadowsocks is a VPN. What makes it better than other offerings?

Shadowshocks is not a VPN at all. It's a connectionless SOCKS5 proxy. No hand-check, no key exchange, no protocol agreement. VPN is not made to be undetected, only secure in the sense of data encryption. Shodowsocks has broader objectives.

See https://shadowsocks.org/ for info.

Re: China systematically hijacks internet traffic: researchers

#36

Post by Filligree »

ZeKZ wrote: post #33
jstanley wrote: post #32

Earlier quoted context omitted.

I don't think that argument holds water. Which one of "open, robust, secure" do you think Tor doesn't meet? You can pick any 3 concepts and group them together like that, but it doesn't mean you can't have all 3, e.g. a house can be "large, cheap, and well-decorated" (e.g. if it is in the middle of nowhere).

Tor lacks usability and efficiency.

Those weren't on the list. ;-)

Re: China systematically hijacks internet traffic: researchers

#37

Post by jstanley »

ZeKZ wrote: post #33
jstanley wrote: post #32

Earlier quoted context omitted.

I don't think that argument holds water. Which one of "open, robust, secure" do you think Tor doesn't meet? You can pick any 3 concepts and group them together like that, but it doesn't mean you can't have all 3, e.g. a house can be "large, cheap, and well-decorated" (e.g. if it is in the middle of nowhere).

Tor lacks usability and efficiency.

The efficiency isn't as bad as it used to be. I browse using Tor as a matter of course now, and it's fine.

What's the usability problem? Just that you have to download Tor Browser instead of Firefox?

The usability of setting up a hidden service is actually easier than getting an SSL certificate.

Re: China systematically hijacks internet traffic: researchers

#38

Post by 68c12c16 »

sethbannon wrote: post #11

As someone with a trip to Beijing on the horizon, aside from using a VPN, are there any other best practices to keep data secure while traveling there?

FYI, the great fire wall engineers have already found ways to inspect packets sent through OpenVPN...

A couple of weeks ago, I was asked by a friend who was traveling in China at the time to set up a VPN for him so he could use Gmail and other Google services there...I went for the easy way and used the OpenVPN for him, but to our disappointment, with that VPN tunnel, he still could not access google search page while many other pages on other domains were fine...I spent a few hours trying to figure out why, and then I came across these discussion,

https://superuser.com/questions/1187525/vpn-to-avoid-the-gre...

https://www.quora.com/Can-Openvpn-still-bypass-the-GFW-of-Ch...

My friend and I haven't experimented further; but I think one way that might work is to chain multiple VPNs or perhaps obfuscate your protocol a bit (i.e. make some minor customization yourself)...

Re: China systematically hijacks internet traffic: researchers

#39

Post by walrus01 »

68c12c16 wrote: post #38
sethbannon wrote: post #11

As someone with a trip to Beijing on the horizon, aside from using a VPN, are there any other best practices to keep data secure while traveling there?

FYI, the great fire wall engineers have already found ways to inspect packets sent through OpenVPN... A couple of weeks ago, I was asked by a friend who was traveling in China at the time to set up a VPN for him so he could use Gmail and other Google services there...I went for the easy way and used the OpenVPN for him, but to our disappointment, with that VPN tunnel, he still could not access google search page whil…

It isn't that they need to inspect the contents of the packets, tcp and udp flow analysis will reveal VPN traffic patterns even if the crypto is perfect. What I've seen reported is that people using openvpn see it work for a while, then increasing latency and packet loss, then eventually total lack of ability to move traffic between the two endpoint IPs.

Re: China systematically hijacks internet traffic: researchers

#40

Post by yayana »

walrus01 wrote: post #17
anyzen wrote: post #16

Earlier quoted context omitted.

No need to decrypt SSL, there are easier ways: https://xkcd.com/538/

Or do like Uzbekistan has done, force all local computer stores to install a trusted root CA in the operating system before it gets to the hand of the end user. You can transparently MITM TLS1.2 if the system trusts the mitm operator CA. Maybe 0.01% of people even know where to look to examine their windows 10 machine's trusted CA list.

Having looked through the government CAs in preinstalled CA lists, I'm a little surprised Uzbekistan doesn't qualify.
Post reply on HN