Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Russia Starts Blocking VPN Protocols

vpncentral.com

Post reply on HN
Print view View original

71–80 of 166 posts

Re: Russia Starts Blocking VPN Protocols

#71

Post by 8organicbits »

Bluecobra wrote: post #56
gsa wrote: post #14

I have been researching VPN protocols that work in China and found that Xray [0] is the most recommended route to escape the GFW. An ideal VPN setup is one where packets appear as normal https traffic. Some VPN setups take it a step further and proxy the traffic through Cloudflare. Setting all this up is nowhere as easy as Wireguard. Coincidentally, I came across this project on Github earlier today which is an obfus…

If everyone does this wouldn’t that encourage them to try to do carrier grade SSL decryption? I seem to recall that some country is already doing this and to get online you need to trust the state’s CA.

Kazakhstan? That attempt failed. I recently cataloged similar concerns[1].

[1] https://alexsci.com/blog/ca-trust/

Re: Russia Starts Blocking VPN Protocols

#72

Post by Waterluvian »

nabogh wrote: post #13

I'm a little confused what Russia has to gain from this. My impression was previously that Russia was somewhat of a wild west when it came to piracy and internet restrictions. To make things weirder, the article claims that only mobile networks are affected. I wonder why that is. Is this just the decisions of a handful of telcos and it's being reported as a state-imposed restriction? Edit: also in my opinion, "blocki…

A dictator has made some ridiculously bad moves and now fears that his time may be wrapping up. The (arguably correct) move from his perspective is to control the information space as strongly as possible. Ideas and truth are his enemy right now.

Re: Russia Starts Blocking VPN Protocols

#73

Post by dspillett »

romanzubenko wrote: post #42

I set up WireGuard server for my family back in Russia in the first days of the war and since then provided VPN access to a few more families. It’s been a lot more stable than relying on popular VPN providers who get banned one after another. Any advice on alternatives to WireGuard, if Russian gov manages to ban it on protocol level with DPI?

While working in an environment where VPN connections were pretty much all blocked⁰ a friend of mine had success using https://guacamole.apache.org/ to access a remote machine¹. Not quite the same as a direct VPN connection but worth a try if nothing else functions, it looks enough like normal HTTPS traffic that he got away with it.

To keep your wireguard setup more as-is, you could try https://kirill888.github.io/notes/wireguard-via-websocket/ to tunnel that via a web server. In fact https://github.com/erebe/wstunnel which that uses could be used just as well with any other UDP based VPN.

I once tinkered with https://github.com/yarrick/iodine and successfully connected to resources over the wireless on a train, bypassing its traffic capture and sign-up requirement, so that might be an option, though I think fully blocking external DNS is more common now so this is less likely to work²³.

--

[0] practically only HTTP(S) permitted, not even SSH, DPI in use that detected just using SSH or OpenVPN over port 443

[1] NOTE: be careful breaching restrictions like this, you are at risk of an insta-sacking if discovered, or worse if operating in some securiry environments!

[2] and the latency when it does work is significant!

[3] and that much traffic over port 53 might get noticed by the heuristics of data exfiltration scanner, encouraging sysadmins to notice and implement a way to block it

Re: Russia Starts Blocking VPN Protocols

#75

Post by Kretinsky »

dijit wrote: post #6
drbig wrote: post #5

Earlier quoted context omitted.

> Interestingly Telegram is still not blocked in Russia. Could that be taken as a sign that it is not blocked _for a reason_, or is it already too much tinfoil on the head?

It caused a lot of issues for Russians when they tried to block it, because they basically blocked entire sections of AWS and GCP. The real tinfoil hat is assuming that they allow it because it's compromised; the founder of Telegram has absolutely no love lost for the Russian state, they basically seized his company (VK; a hugely popular facebook-like which also has a music player and such) and all his assets that we…

It's likely a government honeypot with backdoors, the French have reportedly access to the convos:

https://archive.is/1LGkG In french but you translate it.

It can also be a case of convenient incompetence from the telegram team.

Re: Russia Starts Blocking VPN Protocols

#76

Post by codedokode »

hooby wrote: post #67
nabogh wrote: post #13

I'm a little confused what Russia has to gain from this. My impression was previously that Russia was somewhat of a wild west when it came to piracy and internet restrictions. To make things weirder, the article claims that only mobile networks are affected. I wonder why that is. Is this just the decisions of a handful of telcos and it's being reported as a state-imposed restriction? Edit: also in my opinion, "blocki…

> I'm a little confused what Russia has to gain from this. People use VPNs to get western news and information through other channels than state-controlled Russian media. If Russia can block these other channels, then their own propaganda becomes the sole information citizens have access to.

I think mostly people use VPN not for news but to access Instagram.

Re: Russia Starts Blocking VPN Protocols

#77

Post by rsynnott »

nabogh wrote: post #13

I'm a little confused what Russia has to gain from this. My impression was previously that Russia was somewhat of a wild west when it came to piracy and internet restrictions. To make things weirder, the article claims that only mobile networks are affected. I wonder why that is. Is this just the decisions of a handful of telcos and it's being reported as a state-imposed restriction? Edit: also in my opinion, "blocki…

If you’re a dictator who just survived an abortive coup, then, yeah, you’re probably going to want to tighten control on what people can and can’t see. Putin is very weak right now, and likely feeling extremely insecure. For good reason; like, you would not want to be his life insurance provider right now.

This sort of this is as likely to be emotional support censorship for Vlad’s benefit as anything else; hard to imagine it being very effective, certainly. Expect more and more ineffectual crackdowns on information as he deteriorates.

Re: Russia Starts Blocking VPN Protocols

#78

Post by miki123211 »

0xDEF wrote: post #18
gsa wrote: post #14

I have been researching VPN protocols that work in China and found that Xray [0] is the most recommended route to escape the GFW. An ideal VPN setup is one where packets appear as normal https traffic. Some VPN setups take it a step further and proxy the traffic through Cloudflare. Setting all this up is nowhere as easy as Wireguard. Coincidentally, I came across this project on Github earlier today which is an obfus…

I have noticed many new security and privacy oriented projects use Go and even C/C++. Wasn't Rust supposed to be the language that should be used to write all security-critical software? What happened? Are crates like rustls/ring still intentionally sabotaging Rust's cryptographic ecosystem with their "we will always be pre-1.0.0 and never have a stable API" philosophy?

Go and Rust are better at different things.

Go uses garbage collection, while Rust uses manual memory management with borrow-checking to ensure safety. Both are just as safe, but garbage collection is slower while Rust's manual memory management requires a lot more effort on the part of the developer. In particular, the performance of garbage collection is less predictable, making Go unsuitable for things like audio processing or video games, where you need to reliably deliver data every few milliseconds to avoid crackling audio or weird glitches. In Rust, you can predict exactly when memory will be freed, and if part of your code must always run in a predictable amount of time, this can be done. Go doesn't give you that guarantee. This isn't very important in traditional client-server apps, CLI tools etc, so go is usually fine for those.

In addition, Go requires a runtime, which is somewhat heavy. This makes it pretty unsuitable for kernels, software that runs on bare metal, microcontrollers etc. Rust doesn't have that problem.

However, Go is usually much faster to write in, as you don't have to worry about managing memory and proving to the borrow checker that you're doing it correctly. The fact that you have Goroutines instead of OS threads also makes it easier to handle lots of concurrent activities, like in a web app that concurrently handles many requests.

Re: Russia Starts Blocking VPN Protocols

#79

Post by gwnywg »

hooby wrote: post #67
nabogh wrote: post #13

I'm a little confused what Russia has to gain from this. My impression was previously that Russia was somewhat of a wild west when it came to piracy and internet restrictions. To make things weirder, the article claims that only mobile networks are affected. I wonder why that is. Is this just the decisions of a handful of telcos and it's being reported as a state-imposed restriction? Edit: also in my opinion, "blocki…

> I'm a little confused what Russia has to gain from this. People use VPNs to get western news and information through other channels than state-controlled Russian media. If Russia can block these other channels, then their own propaganda becomes the sole information citizens have access to.

If I was denied access to information sources I trust I would not go and swallow state propaganda..

Having said this, almost all of my Russian colleagues already talk like Russian TV and all of them use VPN this way or another..

Post reply on HN