Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How the great firewall of China detects and blocks fully encrypted traffic [pdf]

gfw.report

Post reply on HN
Print view View original

121–130 of 289 posts

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#121

Post by kotaKat »

Roark66 wrote: post #93
gruez wrote: post #86

Earlier quoted context omitted.

There's a more straightforward way: roam with a foreign sim card. Roaming traffic is tunneled to your home telco and for whatever reason the tunnel isn't inspected at all. With the advent of esims you can buy a roaming sim and use it on your phone within minutes.

Can you activate it while abroad though? After I moved away from the UK I still had to have a UK mobile phone for various things. My UK sim would stop working after about a year away. When buying a new one I had to get someone in UK to put it in their phone to let it at least once connect to the home network. Without it the card would be useless. Is using foreign sim cards now easier?

eSIMs just need a data connection back to the SM-DP server and that can be done over Wi-Fi. I don't think that protocol is blocked that they talk to it, and the SM-DP vendors on the market are typically "global" providers that work with multiple operators.

EDIT: I checked myself to be sure. It's "RAM over HTTP(s)" -- "Remote Application Management" of the eSIM. GFW doesn't block HTTPS, so you should be able to get provisioned to any carrier worldwide while inside the firewall.

https://www.sharetechnote.com/html/Handbook_LTE_eSIM.html

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#122

Post by nonethewiser »

bitwize wrote: post #108
mensetmanusman wrote: post #98

China doesn't realize how much they are being held back by meaningless investments of time and expertise on this. They spend almost the same %GDP as the US does on the US military as on their internal suppression forces. Maybe it's good for the world that they burn so much talent and wealth on adding inefficiency to their internal information exchange.

Get used to it; we will soon be a part of China's "community of common destiny".

I wouldn’t say that. But Western countries would absolutely replicate the surveillance and censorship if they could. And they do in some ways, but there are many structural things stopping them.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#123

Post by noduerme »

WinstonSmith84 wrote: post #3

I was wondering about simply using VPNs, which is not mentioned in the article at all, but checking GFW on Wikipedia, it tells: > The use of VPNs in China can provide individuals access to the international internet, but in China, it can be a potential legal risk. In 2017, the Chinese government declared all unauthorized VPN services to be illegal.[94] An example of the use of this punishment is Vera Zhou, a student…

Just a small personal anecdote from another country with tight restrictions:

When I rented a furnished apartment in Saigon back in 2008, there was an ethernet cable on the table and a piece of paper in English that said "Do not visit websites of anti-government propaganda, or pornography, or news such as the New York Times."

Naturally, as the police held my passport for the entire year I was in Vietnam, I was cautious. But after a few days, I just went ahead and openly browsed the NYT for a few minutes. My internet was shut off for about 3 hours. The next time I did it, it was shut off for 24 hours, and then I knew it wasn't a glitch. It wasn't exactly immediate, either; it took a few minutes. I was pretty sure there was a semi-dedicated person assigned to watch my traffic.

That wasn't over a VPN. I wanted them to see my traffic. But I knew running over a VPN would just raise suspicion. When I opened up VPNs to check email after that, I did it from cafes, and I did it in short spurts.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#124

Post by throwaway290 »

H8crilA wrote: post #111
jcarrano wrote: post #101

Earlier quoted context omitted.

It is not the goal of the CCP to advance China as it is to keep themselves in power.

I would disagree. The leading organization is much more aligned with the needs of the nation than the likes of Iran or Russia, which probably wouldn't mind bombing the shit out of their own city if it was necessary to stay in power. For example they actually bow to American pressure and try to avoid sanctions or other trade problems. As of today their navy could be completely destroyed with like 30% of the US Navy, s…

I didn't downvote you but if a government

- offers no way of replacing itself democratically

- extends own term indefinitely

- blocks free exchange of information

- censors specific speech that shows its failures or desire of people to replace it

- suppresses internal protests with murders and disappearings of people (1989 Tiananmen, 2019+ Hong Kong, blank paper movement, ...)

etc then it's super clear its primary goal is maintaining power.

Sure, it cannot maintain power without at least seeming to be "aligned with nation". But it takes second place to maintaining power.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#125

Post by mcpackieh »

praash wrote: post #29
6LLvveMx2koXfwn wrote: post #26

Earlier quoted context omitted.

> And ssh tunneling web traffic looks quite different from normal ssh usage anyways. Could you explain this further, this seems counter to my understanding of encrypted traffic!

I assume the timing patterns and amounts of data would likely be distinct between SSH and web. "Normal" SSH usage would mostly consist of much lighter packets, such as user keystrokes and terminal screenfuls of text. Typing tiny commands and getting a few kilobytes of output. SSH file transfers happen occasionally, sometimes with a large bulk of data. Active web browsing requires downloading a crapton of files with w…

Forget using a real web browser over an SSH proxy. What using elinks on a remote host with ssh? I bet somebody using elinks across ssh is virtually indistinguishable from somebody using a text editor.

Not much good for images or video, but you could easily read https://text.npr.org/

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#126

Post by monetus »

hutzlibu wrote: post #67
fundatus wrote: post #51

Earlier quoted context omitted.

Last time I went to China (2018) you could simply get a China Unicom Hong Kong SIM card and then use that to roam in mainland China. With that you'd get the Hong Kong censorship level, which is much much less restrictive. No VPN or anything needed apart from the SIM card itself.

"you'd get the Hong Kong censorship level, which is much much less restrictive." Didn’t that changed since 2018?

It was really sad seeing all the bookstores close.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#127

Post by edvards »

beebmam wrote: post #96

Deeply unethical stuff. Why are Chinese people not currently trying to overthrow this garbage?

Pragmatism, I suppose. The country does well enough economically for people to accept it, not to mention they're used to it all already.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#128

Post by nirimda »

Herring wrote: post #109
mensetmanusman wrote: post #98

China doesn't realize how much they are being held back by meaningless investments of time and expertise on this. They spend almost the same %GDP as the US does on the US military as on their internal suppression forces. Maybe it's good for the world that they burn so much talent and wealth on adding inefficiency to their internal information exchange.

I wouldn't be so sure that it's a bad idea. Look how social media has damaged democracy around the world. US democracy is stuck in a bit of a death spiral - https://www.theatlantic.com/ideas/archive/2021/04/how-stop-m... . I hate repression, but they've been at it for thousands of years and I'm no longer super confident we have something better (see citizens united, roe v wade, affirmative action). China's life expec…

The US doesn't have a minority rule death spiral because of social media, it has a minority rule cycle because the constitution literally entrenches minority rule via mechanisms like senatorial malapportionment, supermajorities, the electoral college and judicial review of policy (see citizens united, roe v wade, affirmative action) rather than merely procedure. It has experienced this before, sometimes devolving into outright civil war, without actually reaching death.

The technologies for resolving America's problems are well understood - majority decision making, parliamentarism, representation and participation of electoral minorities rather than inhibiting the work of the majority, a narrower scope of judicial review and/or a more flexible constitution. But as long as people say, as you do, "it isn't the thing that caused the problem that is the problem, it is some fancy gadget that is the problem", then you will be unable to solve the problems

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#129

Post by throwaway290 »

H8crilA wrote: post #110
nikanj wrote: post #90

Earlier quoted context omitted.

If it’s over https, an outside observer has no way of knowing your stream started with a GET. Unless they’ve tapped ssl certificates, but that would be major news

They are tapped into SSL certificates, those that are generated in China. Plus wherever the Chinese intelligence managed to install their "plugins".

Are any of those tappable certificates still considered trusted by wider internet? Which CAs are those? They should be removed from trusted ASAP.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#130

Post by thaumasiotes »

WinstonSmith84 wrote: post #3

I was wondering about simply using VPNs, which is not mentioned in the article at all, but checking GFW on Wikipedia, it tells: > The use of VPNs in China can provide individuals access to the international internet, but in China, it can be a potential legal risk. In 2017, the Chinese government declared all unauthorized VPN services to be illegal.[94] An example of the use of this punishment is Vera Zhou, a student…

> The use of VPNs in China can provide individuals access to the international internet, but in China, it can be a potential legal risk. In 2017, the Chinese government declared all unauthorized VPN services to be illegal. An example of the use of this punishment is Vera Zhou, a student at the University of Washington, who, when visiting her Hui parents in Xinjiang, China, used a VPN to access her school homework. She was arrested and sent to a Xinjiang internment camp from October 2017 until March 2018, followed by house arrest after her release. She was not able to return to the US until September 2019.

Use of VPNs is... universal... among middle-to-upper-class Chinese. This is obviously not an example of legal risk associated with using a VPN. Rather, it's an example of a punishment coming down on someone who was targeted for other reasons.

An immediate implication is that, if you repealed all the laws against VPNs, nothing about anything would change.

Post reply on HN