Didn't know you could do deep packet inspection on encrypted traffic?
Anyone who can shed some light on how they might be doing this? I'm curious.
Russia tries more precise technology to block Telegram messenger
11–20 of 111 posts
Re: Russia tries more precise technology to block Telegram messenger
#12I emigrated 15 years ago from there to the US. It's been fine, but I just visited Russia recently for a month and very much prefer Russian culture to that of the West. I'm thinking of going back permanently but probably won't.
I think blocking various internet sites/services is the only way to preserve the cultural differences and stop the brain drain.
Re: Russia tries more precise technology to block Telegram messenger
#13Didn't know you could do deep packet inspection on encrypted traffic? Anyone who can shed some light on how they might be doing this? I'm curious.
You cannot do deep packet inspection, but can identify encrypted packets and then run heuristics and statistical packet and end-point analysis on them.
If Telegram traffic has a specific signature or predictable pattern of packet sequences and sizes married with known IP addresses, quite a lot can be done at the packet inspection level (but not « deep » per se).
Re: Russia tries more precise technology to block Telegram messenger
#14Didn't know you could do deep packet inspection on encrypted traffic? Anyone who can shed some light on how they might be doing this? I'm curious.
Telegram uses it's own custom MTProto protocol.
Although the traffic is encrypted, it is identifiable as Telegram traffic (fixed structure, identifiable prefix for packets).
There's an outcry for them to use TLS but I didn't see that they said anything about that.
Here's a nice article for more info: https://blog.susanka.eu/how-telegram-obfuscates-its-mtproto-...
Re: Russia tries more precise technology to block Telegram messenger
#15I emigrated 15 years ago from there to the US. It's been fine, but I just visited Russia recently for a month and very much prefer Russian culture to that of the West. I'm thinking of going back permanently but probably won't. I think blocking various internet sites/services is the only way to preserve the cultural differences and stop the brain drain.
Oh my god.. So you really think that a totalitarian control over what the country's population is allowed to view on the Internet is somehow a good thing and a way to stop brain drain? How come other countries manage to have their cultures flourish on the age of the Internet? I just can't see this kind of blocking bringing anything good for Russia..
Re: Russia tries more precise technology to block Telegram messenger
#16Technology companies that make DPI technology for censorship should DIAF. If you work at one, you are actively making the world a shittier place. That is all.
It's not a good argument. Propaganda can always defeat morals, make people accept and do unspeakable things. Well, not all people, but still a lot of people.
Ever felt patriotic, proud of your country? That's how it starts.
Re: Russia tries more precise technology to block Telegram messenger
#17Technology companies that make DPI technology for censorship should DIAF. If you work at one, you are actively making the world a shittier place. That is all.
Didn't know you could do deep packet inspection on encrypted traffic? Anyone who can shed some light on how they might be doing this? I'm curious.
I obviously don't know how they're actually doing it, but you can perform all kinds of analysis on traffic even when it's encrypted. You can look at the distribution of packet size, the time distribution of packets, you can analyze who is sending packets to whom. Traffic analysis like this has been a field of study since at least World War I. [0]
If you want to find Telegram traffic, you're probably looking at fairly small packets, often sent in bursts. If you're observing the sender and the receiver, you might be able to correlate the the outgoing messages from one user with the corresponding incoming messages of another user.
Of course, there are corresponding countermeasures Telegram could take: pad messages, combine messages, split messages, introduce random delays, distribute messages among a number of different endpoints. It's an endless game of cat and mouse.
Re: Russia tries more precise technology to block Telegram messenger
#18I emigrated 15 years ago from there to the US. It's been fine, but I just visited Russia recently for a month and very much prefer Russian culture to that of the West. I'm thinking of going back permanently but probably won't. I think blocking various internet sites/services is the only way to preserve the cultural differences and stop the brain drain.
> I think blocking various internet sites/services is the only way to preserve the cultural differences and stop the brain drain.
If this is what your culture thinks of as music, I assure you that the brain drain will accelerate sans non-Russian influence:
Re: Russia tries more precise technology to block Telegram messenger
#19I emigrated 15 years ago from there to the US. It's been fine, but I just visited Russia recently for a month and very much prefer Russian culture to that of the West. I'm thinking of going back permanently but probably won't. I think blocking various internet sites/services is the only way to preserve the cultural differences and stop the brain drain.
Whole "West" is full of cultural differences, despite the internet is not broken. Actually, there are more well-preserved cultural differences between TN, and NY in States than between most places in Russia (except maybe Tuva, and other poorly connected regions in Siberia, and Arctic) due to centralist, paternalist, and chauvinistic policies of Moscow internet haters.
Re: Russia tries more precise technology to block Telegram messenger
#20Didn't know you could do deep packet inspection on encrypted traffic? Anyone who can shed some light on how they might be doing this? I'm curious.
Encrypted protocols are often not fully encrypted, and expose enough to determine the nature of the traffic, if not the content. Even TLS, leaving Server Name Indication (SNI) unencrypted. Fortunately there is work underway to encrypt SNI. Also, in the TLS case, domain fronting (asking for e.g. google.com from the discriminated service, to fool filters) has become one tool to evade SNI-based attacks.