Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Russia Starts Blocking VPN Protocols

vpncentral.com

Post reply on HN
Print view View original

81–90 of 166 posts

Re: Russia Starts Blocking VPN Protocols

#81

Post by o1y32 »

plxx7733 wrote: post #45
coldtea wrote: post #40

Earlier quoted context omitted.

> Wasn't Rust supposed to be the language that should be used to write all security-critical software? What happened? What does "supposed" mean in this case? There's no one dictating what language "security-critical" or other software will be written. So, if it was "supposed", it was incorrectly supposed, by people reading some enthusiast posts about Rust and thinking it's adoption is inevitable or that it applies to…

Who would use unsafe Java to write "security-critical" software?

I don't think you understand the words written yourself. At least provide some relevant, convincing examples instead of throwing these claims around.

Re: Russia Starts Blocking VPN Protocols

#82

Post by o1y32 »

0xDEF wrote: post #18
gsa wrote: post #14

I have been researching VPN protocols that work in China and found that Xray [0] is the most recommended route to escape the GFW. An ideal VPN setup is one where packets appear as normal https traffic. Some VPN setups take it a step further and proxy the traffic through Cloudflare. Setting all this up is nowhere as easy as Wireguard. Coincidentally, I came across this project on Github earlier today which is an obfus…

I have noticed many new security and privacy oriented projects use Go and even C/C++. Wasn't Rust supposed to be the language that should be used to write all security-critical software? What happened? Are crates like rustls/ring still intentionally sabotaging Rust's cryptographic ecosystem with their "we will always be pre-1.0.0 and never have a stable API" philosophy?

I don't know where you get your information from, but I don't think anyone links specific languages with security oriented projects.

Re: Russia Starts Blocking VPN Protocols

#83

Post by zikduruqe »

inrussianow wrote: post #21
zikduruqe wrote: post #16

Earlier quoted context omitted.

Are you using port 51820 or a different port for your Wireguard endpoint? Just curious as I have read where others have used different ports to circumvent DPI.

Yes im using 51820, but good idea to change it. I actually have 2 setups. One is a home router within a wireguard server builtin, the second is my Tailscale mesh network using an exit node at home in USA.

Ha. I run WireGuard and a Tailscale network also.

I've read that some people have used port 853 to mimic encrypted DNS or other ports less than 1024 to circumvent some WireGuard limits. I've yet to run into that.

Might want to check out https://yggdrasil-network.github.io for fun. I used to use it to connect to various networks.

Re: Russia Starts Blocking VPN Protocols

#84

Post by Aerbil313 »

lifty wrote: post #60
nabogh wrote: post #13

I'm a little confused what Russia has to gain from this. My impression was previously that Russia was somewhat of a wild west when it came to piracy and internet restrictions. To make things weirder, the article claims that only mobile networks are affected. I wonder why that is. Is this just the decisions of a handful of telcos and it's being reported as a state-imposed restriction? Edit: also in my opinion, "blocki…

This isn't about cracking down on piracy or anything of that sort. It's about slowly getting control of the media and information channels that Russian people have access to. The same playbook that China has been using since forever. Authorities have been encouraging popular Internet celebrities to start posting their content on local networks/apps, so in time Western media sources like Youtube and Twitter will be bl…

I don't live in China. Yet I'd very much like my country having its own national software stack (OS, search engine, browser, social media apps). All is fine for you guys in the US, but you forget when our national interests conflict with yours or big tech corporations or when the privacy of our citizens is concerned, it happens to be a national security issue. I trust my own government to not spy on me unnecessarily, and even if I'm to be spied by someone, I'd prefer my own government who is far more likely to act in my best interests than the three letter agencies of US.

Re: Russia Starts Blocking VPN Protocols

#85

Post by codedokode »

nabogh wrote: post #13

I'm a little confused what Russia has to gain from this. My impression was previously that Russia was somewhat of a wild west when it came to piracy and internet restrictions. To make things weirder, the article claims that only mobile networks are affected. I wonder why that is. Is this just the decisions of a handful of telcos and it's being reported as a state-imposed restriction? Edit: also in my opinion, "blocki…

> what Russia has to gain from this

People won't be able to read anything contradicting government's point of view. It is important for stability in society that there is only correct and truthful information and no falseful foreign propaganda seeding distruct in government (e.g. by falsefully claiming that high-ranked officials own expensive villas in Europe that they cannot afford with their salary).

> only mobile networks are affected. I wonder why that is.

Because it is only testing stage now.

> Is this just the decisions of a handful of telcos

Why would telecoms spend money on censorship by themselves? It doesn't increase their profit.

> Wireguard for example is just UDP packets.

WireGuard packets are not obfuscated and can be easily detected. And even if it was obfuscated, everything that doesn't look like HTTPS can be blocked without causing much troubles.

Re: Russia Starts Blocking VPN Protocols

#86

Post by fruitreunion1 »

codedokode wrote: post #80

All decent VPN protocols should masquerade as HTTP/2 or HTTP/3. For this reason WireGuard is pretty useless as it can be easily detected (and it is not secure because requires running code at the kernel).

I disagree. I think it's good that implementing a secure network tunnel and obfuscation are separate. WireGuard can handle the secure tunnel functionality while I can apply any sort of obfuscation protocol on top of it without worrying about its security or having to reconfigure the network, like udp2raw, iodine, shadowsocks, websockets, etc.

Re: Russia Starts Blocking VPN Protocols

#87

Post by fruitreunion1 »

littlestymaar wrote: post #34
vbezhenar wrote: post #28

Earlier quoted context omitted.

DPI. Popular VPN protocols are easily identified by first connection packet signature.

Wasn't Wireguard explicitly designed to avoid that? (IIRC it took lots of inspiration from state of the art data exfiltration methods used by malware)

No. https://www.wireguard.com/known-limitations/

>Deep Packet Inspection

>WireGuard does not focus on obfuscation. Obfuscation, rather, should happen at a layer above WireGuard, with WireGuard focused on providing solid crypto with a simple implementation. It is quite possible to plug in various forms of obfuscation, however.

>TCP Mode

>WireGuard explicitly does not support tunneling over TCP, due to the classically terrible network performance of tunneling TCP-over-TCP. Rather, transforming WireGuard's UDP packets into TCP is the job of an upper layer of obfuscation (see previous point), and can be accomplished by projects like udptunnel and udp2raw.

Re: Russia Starts Blocking VPN Protocols

#88

Post by dist-epoch »

nabogh wrote: post #13

I'm a little confused what Russia has to gain from this. My impression was previously that Russia was somewhat of a wild west when it came to piracy and internet restrictions. To make things weirder, the article claims that only mobile networks are affected. I wonder why that is. Is this just the decisions of a handful of telcos and it's being reported as a state-imposed restriction? Edit: also in my opinion, "blocki…

> I'm a little confused what Russia has to gain from this.

You misspelled Putin.

Re: Russia Starts Blocking VPN Protocols

#89

Post by fruitreunion1 »

est wrote: post #4

sadly, wireguard/openvpn does not not provide any obfuscation mechanism at protocol level

I think this is a good thing. Apply obfuscation on top of WireGuard, that way you can have the functionality and security of the WireGuard tunnel and swap between different obfuscation techniques as needed.

Re: Russia Starts Blocking VPN Protocols

#90

Post by RyEgswuCsn »

lifty wrote: post #60
nabogh wrote: post #13

I'm a little confused what Russia has to gain from this. My impression was previously that Russia was somewhat of a wild west when it came to piracy and internet restrictions. To make things weirder, the article claims that only mobile networks are affected. I wonder why that is. Is this just the decisions of a handful of telcos and it's being reported as a state-imposed restriction? Edit: also in my opinion, "blocki…

This isn't about cracking down on piracy or anything of that sort. It's about slowly getting control of the media and information channels that Russian people have access to. The same playbook that China has been using since forever. Authorities have been encouraging popular Internet celebrities to start posting their content on local networks/apps, so in time Western media sources like Youtube and Twitter will be bl…

"Never stop fighting for the control of the agenda, for all your enemies are doing the same."

--- Chairman Mao

Post reply on HN