21–30 of 63 posts
The goal of the Pakistani government seems to be the complete obliteration of all private communications. But the only way to do that is by banning all communication. With the ban on VPNs, steganographic[1] techniques that make encrypted traffic look like regular traffic will become more and more common. The troubling thing is the fact that these techniques are somewhat hungry for bandwidth. [1] http://en.wikipedia.o…
I am not sure this is that much more disturbing than the British Government even thinking about restricting the use of social media apps during times of civil disobedience. And this is extremely disturbing. How can any global company now do business in Pakistan? Surely there is some kind of back door in there.
Earlier quoted context omitted.
Hmm, that would mean no Gmail for anyone in Pakistan. Any service that uses SSL for logins would also become unusable if SSL was banned. I don't see any mention of a wholesale ban on encryption, only the use of encryption for privacy purposes. So, port 443 might still be open. It's still pretty easy to distinguish between HTTPS traffic and VPN traffic, though.
They could proxy the SSL connections and still let people log in while monitoring the traffic. Of course, your browser will complain if they rewrap it in SSL unless they get a cert like Iran did.
Though of course they could just tap into the local last mile...
The goal of the Pakistani government seems to be the complete obliteration of all private communications. But the only way to do that is by banning all communication. With the ban on VPNs, steganographic[1] techniques that make encrypted traffic look like regular traffic will become more and more common. The troubling thing is the fact that these techniques are somewhat hungry for bandwidth. [1] http://en.wikipedia.o…
Stego is detectable. They will move on to scanning for and flagging those communications eventually.
Only in the sense that "Crypto is breakable."
The entire point of steganography is that it isn't detectable. If it can be detected, you need a better algorithm.
The goal of the Pakistani government seems to be the complete obliteration of all private communications. But the only way to do that is by banning all communication. With the ban on VPNs, steganographic[1] techniques that make encrypted traffic look like regular traffic will become more and more common. The troubling thing is the fact that these techniques are somewhat hungry for bandwidth. [1] http://en.wikipedia.o…
Is there a steganography package as easy to use as https or ssh?
What I know is that, as https is so easy to use, there are plans to make it serve covert traffic. So you would make a request to https://www.friendlyproxy.com with an extra header somewhat like What-I-Want: http://www.bannedsite.com and have "friendlyproxy.com" serve you the document you originally wanted.
I forgot the name of the project, though. I believe it was from an American university
Besides, with this new wave of government carrying MITM attacks, I don't know how useful this techniques will be.
EDIT: I was able to find a link explaining the Telex project from University of Michigan: http://ns.umich.edu/htdocs/releases/story.php?id=8505
To do this, wouldn't they have to effectively block SSL and SSH connections as well? SSL is used in OpenVPN and some Cisco implementations. And we all know that you can tunnel any port over ssh. Or is the plan that the punishment for stepping outside the lines be enough to keep people from experimenting with these technologies?
Yes, I think they would need to block those as well in order to be effective. Frankly I don't see how they could possibly get away with it. Businesses of any size can't run without encrypted channels. Proceeding with this seems sure way to smother any economic development and relegate the country to third-world backwater status for the foreseeable future. And is any world leader crazy enough to do that besides Kim Jo…
Sure they can - they did before the internet. (No, the postal mail is not secure.)
> Proceeding with this seems sure way to smother any economic development and relegate the country to third-world backwater status for the foreseeable future. And is any world leader crazy enough to do that besides Kim Jong-il?
Pretty much every "world leader" in the last 100 years (if not longer) has shown that s\he is willing to give up some economic development in return for control and other benefits. (They arguably give up more than they think that they're giving up, but that's a separate issue.) Disagree? Name three exceptions.
Besides, the effect on economic development in the short term will be almost unnoticable.
The goal of the Pakistani government seems to be the complete obliteration of all private communications. But the only way to do that is by banning all communication. With the ban on VPNs, steganographic[1] techniques that make encrypted traffic look like regular traffic will become more and more common. The troubling thing is the fact that these techniques are somewhat hungry for bandwidth. [1] http://en.wikipedia.o…
Crypto is currently usable in practice. Its a bit hard for many users, but its doable, especially with modern VPN implementations. If any encrypted tunnel is allowed, you can put all your traffic through it, and no one knows whether you are surfing banned websites, or working on the corporate VPN. And you can be pretty confident your modern crypto implementation isn't going to be broken.
But steganography isn't really usable, in practice. If nothing else, the government can do traffic analysis, and see suspiciously large traffic volumes going to a small collection of servers (which are accepting the steg'd communication, and proxying your requests, presumably).
And even if the traffic looks like normal HTTP, with images in it, that's simply not good enough to use, in a regime where the secret police can arrest you if they suspect you are trying to hide your traffic content. And they will be able to find users, because eventually the servers accepting steg'd traffic, which the population are using, will become known.
So, while I think it'd be very hard to remove the ability to send small amounts of text data, from the Internet, I think it'd be possible to make private communication unworkable, in practice, for most people.
I don't see how this would be worked around, without building a massive distributed network of computers that all accepted and routed steg'd communication; something like if every webserver would accept, and onion-route, incoming steg'd traffic.
That doesn't exist, so I think their initiative will work, if they push it enough; hopefully rules like this remain isolated to relatively repressive regimes, and not gain widespread adoption; the widespread commercial use of encrypted communications is probably the best defence against global crypto bans.
Earlier quoted context omitted.
Is there a steganography package as easy to use as https or ssh?
Not that I know of. What I know is that, as https is so easy to use, there are plans to make it serve covert traffic. So you would make a request to https://www.friendlyproxy.com with an extra header somewhat like What-I-Want: http://www.bannedsite.com and have "friendlyproxy.com" serve you the document you originally wanted. I forgot the name of the project, though. I believe it was from an American university Besid…
The goal of the Pakistani government seems to be the complete obliteration of all private communications. But the only way to do that is by banning all communication. With the ban on VPNs, steganographic[1] techniques that make encrypted traffic look like regular traffic will become more and more common. The troubling thing is the fact that these techniques are somewhat hungry for bandwidth. [1] http://en.wikipedia.o…
I disagree with the spirit of this comment. You don't need to ban all communication, to remove privacy in practice. Crypto is currently usable in practice. Its a bit hard for many users, but its doable, especially with modern VPN implementations. If any encrypted tunnel is allowed, you can put all your traffic through it, and no one knows whether you are surfing banned websites, or working on the corporate VPN. And y…
Let us remember that normal HTTP traffic follows a power-law, with relatively few sites getting the majority of the traffic, so there might be a way, if many of the high-traffic sites on the internet collaborate, of making "covert" traffic look just like "innocent" traffic.
that's simply not good enough to use, in a regime where the secret police can arrest you if they suspect you are trying to hide your traffic content
Even if we accept the premise of undetectable steganography, which is not possible by any possible means today, the arrests will continue to happen. However, I hope they will tend to happen less, as the large number of false-positive arrests would certainly cause high commotion in the general population.
* So, while I think it'd be very hard to remove the ability to send small amounts of text data, from the Internet, I think it'd be possible to make private communication unworkable, in practice, for most people.*
You are correct. Under the current situation, it'll be hard to make all your communication private under the restrictions imposed by, for instance, the Pakistani government, but dissidents don't need all communication to be private, and small amounts of text data might be all that's needed.