Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VPN access being disabled in China

rendezvous.blogs.nytimes.com

Post reply on HN
Print view View original

51–60 of 62 posts

Re: VPN access being disabled in China

#51

Post by seanmcdirmid »

theatrus2 wrote: post #42
rossjudson wrote: post #8

Before travel to China, create a throwaway email account on a service, possibly Yahoo. Don't touch your real email accounts while you're there, if possible. The only time I've ever had an email account hacked is following use in China.

My employer (smartly) prohibits bringing any corporate equipment into China - including cell phones which access company email, and generally suggest not touching the Internet (at least any of your accounts) at all. Having been there, this is honestly very good advice.

I heard Google does that. I work for Microsoft and am based in China, so obviously this is not an option for me. It turns out not to be a problem in practice, everything is encrypted well enough, the only annoying thing are GFW-instigated DOS attacks on secure connections.

Re: VPN access being disabled in China

#52

Post by austenallred »

seanmcdirmid wrote: post #50
austenallred wrote: post #13

This sucks for travelers and ex-pats, but for China's future this is a very, very, very big deal. I lived in Shanghai last year, and Chinese Internet surveillance is unreal. I could use gmail chat to talk about tiananman square, but as soon as I did all of my Google apps would suddenly be unavailable. I can only assume that when i used certain keywords my every chat was being monitored. A VPN was the only way I could…

It is not illegal for foreigners to talk about the three Ts with Chinese nationals, its just not very wise. China technically has the right of free speech in their constitution, so you wouldn't go to jail for this (but you could still get in trouble, lose your job, get deported, etc...)

True, illegal isn't the correct word.

Re: VPN access being disabled in China

#53

Post by aneth4 »

ryan-c wrote: post #38
aneth4 wrote: post #14

I'm in Shanghai where I've lived off and on for 8 years. I've been using an ec2 image with Poptop installed. The problem is the IP addresses of the major vpns become known and blocked. Any suggestions of software that would deploy images to various cloud services on behalf of users? I don't think China would be able to block all of ec2 and Rackspace, though they do sometimes seem to throttle ec2.

I hope you're aware that pptp connections (including via poptop) can be broken easily. https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-cha...

Thanks. Fortunately I don't really care if it's cracked - I only care if I can have access to the western internet, and that works just fine.

Re: VPN access being disabled in China

#54

Post by culturestate »

theatrus2 wrote: post #45
culturestate wrote: post #39

Earlier quoted context omitted.

Many of us on the mainland ("us" being the type of people who would read HN) have switched to SSH proxies over port 443. Sshuttle [1] is highly recommended. 1. https://github.com/apenwarr/sshuttle

Interesting that SSH is getting through still. I wonder how much longer till Chinese avoidance VPN tech needs to resort to stenography in images to transfer data. Masking data as cat pictures would be slow but not automatically detectable.

China has enough outsourced development teams that blocking SSH would be, I'd think, a measurable drag on that economy. We SSH over 443 as a "just-in-case" since it looks alot like HTTPS.

Re: VPN access being disabled in China

#55

Post by rdl »

enraged_camel wrote: post #44
austenallred wrote: post #13

This sucks for travelers and ex-pats, but for China's future this is a very, very, very big deal. I lived in Shanghai last year, and Chinese Internet surveillance is unreal. I could use gmail chat to talk about tiananman square, but as soon as I did all of my Google apps would suddenly be unavailable. I can only assume that when i used certain keywords my every chat was being monitored. A VPN was the only way I could…

How were they able to sniff your keywords on Gmail chat? I thought as long as you are connected via HTTPS, your packets are encrypted. Or does China not allow connecting to foreign websites via HTTPS?

China owns at least one CA.

Cert pinning should prevent some of this, but I suspect a lot of Chinese use web browsers downloaded locally (which could compromise pinning; rather than pinning fake certs, I'd just pull the pinning entirely), or browsers which don't support pinning.

I don't think the GFW routinely MITMs HTTPS, but I would be amazed if they didn't do it on a targeted basis against specific sites and users.

And of course if you're using a phone from a state-controlled carrier or a webcafe from someone who complies with pressure, you can be attacked even easier.

Re: VPN access being disabled in China

#56

Post by log0 »

sea6ear wrote: post #43
jimworm wrote: post #33

Earlier quoted context omitted.

The lulz does not seem like a fair reward when the adversary's not even slightly squeamish about abducting you and your family and selling your organs.

That's a pretty strong statement (not that I disagree with it), just that it's strong enough that I'd love to see a citation for evidence of that history.

Just go google for the news, one of the latest victim is the families of Guangcheng Chen (http://en.wikipedia.org/wiki/Chen_Guangcheng), whose family members gets sued for protecting himself (as "attacking ferociously), etc.

And take a look at the whereabouts of human rights lawyers at the sensitive dates.

You can't miss that.

Re: VPN access being disabled in China

#57

Post by girzel »

newhouseb wrote: post #35
jcampbell1 wrote: post #17

This is nothing new. They have added more IPs to the VPN blocklist. I have no idea why this is news. This happens several times per year. This cat and mouse game has been going on for years. Every time this happens it is just a pain in the ass to find a new VPN that isn't blocked. If you are technical, it is best to just setup your own VPN on linode or amazon. That way you have less problems with blocked IPs.

This is what they used to do, but they've gotten more sophisticated - I've been running VPNs for China for my family on EC2 for a while. As far as I can tell, they almost never flat out block an IP. Initially they block a DNS hostname from resolving to a specific IP, then they start filtering out various different ports (including the default VPN ones). You can normally change to a random port and get OpenVPN to star…

Exactly my experience. I've been running a private OpenVPN instance for a couple of years now -- a month ago they started blocking it. Switching ports works for approximately three hours.

Re: VPN access being disabled in China

#58

Post by stevendaniels »

The thing about the great firewall... It only affects expats or visitors to China.

Any Chinese person who wants to read the NYTimes can get access to it. Anyone who wants to read about the "Three T's" can find away (good luck finding anyone). Chinese people who want to spend all day on the Facebook or the Twitter, will.

But the rest of the Chinese internet, the 99% of them, being disconnected from the rest of the world's internet, doesn't matter that much. They have neither the desire nor the interest to look at blocked pages. They're happy with the Chinese-language internet they have.

Personally, I'm starting to believe the Great Firewall is mostly there to annoy expats like me.

Re: VPN access being disabled in China

#59

Post by trevelyan »

contingencies wrote: post #47
trevelyan wrote: post #46

Earlier quoted context omitted.

Out of curiosity, what was the startup?

'Dajiudianwang' hotel reservation, ~2007-2009. We reached the same property network size as CTrip and ELong (3300+ individual property contracts across China), but also provided services in (non-broken) English, Japanese Korean, Thai and Vietnamese. We were highly automated, running a call center and paperless, digital fax workflow on a custom diskless Linux and asterisk on an E1 over private fibre. I gave up on it b…

Hey -- we chatted a couple of times actually -- I remember you ran into some pretty hardcore this-is-China experiences down south that I'm glad I never went through as well. Happy to hear you're doing well and that things have worked out. Let me know when/if you're coming back and we can meet up for drinks.

p.s. mostly asked the question just because I like to keep track of people who've done various things from here. Funny to think it really is such a small world.

Re: VPN access being disabled in China

#60

Post by SkyMarshal »

austenallred wrote: post #13

This sucks for travelers and ex-pats, but for China's future this is a very, very, very big deal. I lived in Shanghai last year, and Chinese Internet surveillance is unreal. I could use gmail chat to talk about tiananman square, but as soon as I did all of my Google apps would suddenly be unavailable. I can only assume that when i used certain keywords my every chat was being monitored. A VPN was the only way I could…

>I was literally minutes away from being on a bullet train from Shanghai to Beijing that killed "x" people. Chinese authorities cite incredibly low numbers for a train traveling at 300 km/h. Most non-state observers cited hundreds of deaths. China slowly grew its number from 20-40.

I'm unfamiliar with this, is it a reference to bullet trains running over people who somehow got on the tracks?

Post reply on HN