Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How the great firewall of China detects and blocks fully encrypted traffic [pdf]

gfw.report

Post reply on HN
Print view View original

141–150 of 289 posts

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#141

Post by wahnfrieden »

pdntspa wrote: post #133
noduerme wrote: post #123

Earlier quoted context omitted.

Just a small personal anecdote from another country with tight restrictions: When I rented a furnished apartment in Saigon back in 2008, there was an ethernet cable on the table and a piece of paper in English that said "Do not visit websites of anti-government propaganda, or pornography, or news such as the New York Times." Naturally, as the police held my passport for the entire year I was in Vietnam, I was cautiou…

Wait, the police held your passport? Why?

[flagged]

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#142

Post by mrguyorama »

balder1991 wrote: post #136
pantalaimon wrote: post #53

Earlier quoted context omitted.

I think China doesn’t care if foreigners use a VPN, it’s their own people they want to keep under control.

I keep contact with a girl in China and from her reports using VPNs is kinda common for young people with college education. She would do it sometimes to access YouTube, and would laugh it off when I would say she should be careful doing such things. I suppose for the government, as long as it isn’t the majority of people doing something that would cause trouble, it isn’t worth tracking down all things, as expected.

This is intentional; "Oh it's not authoritarian/bad, people use VPNs all the time and get away with it".

Except for that muslim chick another commenter pointed out, or anyone else the party decides is undesirable.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#143

Post by [deleted] »

pantalaimon wrote: post #53
helen___keller wrote: post #50

Earlier quoted context omitted.

When I was in China in 2019, the VPN built into google fi actually got me around the GFW with zero effort. I didn’t even realize it until I caught myself checking American social media unhindered. My experience is most younger and tech savvy people have a VPN. It’s common / casual, like speeding your car by 10mph on the highway. Most people are not persecuted for using a VPN, I assume that’s reserved for people who t…

I think China doesn’t care if foreigners use a VPN, it’s their own people they want to keep under control.

[deleted]

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#144

Post by hinkley »

noduerme wrote: post #123
WinstonSmith84 wrote: post #3

I was wondering about simply using VPNs, which is not mentioned in the article at all, but checking GFW on Wikipedia, it tells: > The use of VPNs in China can provide individuals access to the international internet, but in China, it can be a potential legal risk. In 2017, the Chinese government declared all unauthorized VPN services to be illegal.[94] An example of the use of this punishment is Vera Zhou, a student…

Just a small personal anecdote from another country with tight restrictions: When I rented a furnished apartment in Saigon back in 2008, there was an ethernet cable on the table and a piece of paper in English that said "Do not visit websites of anti-government propaganda, or pornography, or news such as the New York Times." Naturally, as the police held my passport for the entire year I was in Vietnam, I was cautiou…

    In fact, the US Department of State recommends that all US citizens have a photocopy of their passport with them, when traveling abroad.
Supposedly you get in shorter lines at the consulate if you have at least a photocopy of your passport available. You should be able to petition the consulate of your home country to issue you a new passport.

I think it may be illegal, but I've heard from people who travel to places where it's sketchy for Americans to travel, that they report their passport as destroyed, get a second copy issued, then keep the first one.

The reasoning is that certain immigration departments see red flags if they see visa stamps from certain other countries, and you may get grief for having visited them. Cuba and the US used to be one, but cross-border rivalries are another. Knowing who hates who and presenting the right passport to receive the stamp would save you grief. Also if you encounter corruption/extortion you can schedule the next flight out and run.

With the electronic ones now I don't know how many places that still works.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#145

Post by noduerme »

pdntspa wrote: post #133
noduerme wrote: post #123

Earlier quoted context omitted.

Just a small personal anecdote from another country with tight restrictions: When I rented a furnished apartment in Saigon back in 2008, there was an ethernet cable on the table and a piece of paper in English that said "Do not visit websites of anti-government propaganda, or pornography, or news such as the New York Times." Naturally, as the police held my passport for the entire year I was in Vietnam, I was cautiou…

Wait, the police held your passport? Why?

If you're an American and you rent an apartment, the local police keep your passport until you leave. You keep a xerox. That's how it was at the time. I don't know if that's still the case.

I didn't feel good about it when I found out (actually, the moment I signed the lease), but there was nothing I could do about it.

My exit from Vietnam was almost humorous. I had about 50 DVDs in my suitcase, mostly encrypted backups and burned movies, and every single one was inspected by sight, holding it up to the light (to see how far the burn went?), then left on the floor of the airport for me to pick up. Upon re-entering the US, the customs officers did almost the same thing, and then just confiscated all my discs.

Weirdly, no one on either side checked my laptop.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#146

Post by ktta »

computerfriend wrote: post #68
helen___keller wrote: post #50

Earlier quoted context omitted.

When I was in China in 2019, the VPN built into google fi actually got me around the GFW with zero effort. I didn’t even realize it until I caught myself checking American social media unhindered. My experience is most younger and tech savvy people have a VPN. It’s common / casual, like speeding your car by 10mph on the highway. Most people are not persecuted for using a VPN, I assume that’s reserved for people who t…

That's roaming, not a VPN.

Google Fi offers a VPN as well: https://support.google.com/fi/answer/9040000?hl=en

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#147

Post by synergy20 »

helen___keller wrote: post #50
WinstonSmith84 wrote: post #3

I was wondering about simply using VPNs, which is not mentioned in the article at all, but checking GFW on Wikipedia, it tells: > The use of VPNs in China can provide individuals access to the international internet, but in China, it can be a potential legal risk. In 2017, the Chinese government declared all unauthorized VPN services to be illegal.[94] An example of the use of this punishment is Vera Zhou, a student…

When I was in China in 2019, the VPN built into google fi actually got me around the GFW with zero effort. I didn’t even realize it until I caught myself checking American social media unhindered. My experience is most younger and tech savvy people have a VPN. It’s common / casual, like speeding your car by 10mph on the highway. Most people are not persecuted for using a VPN, I assume that’s reserved for people who t…

That's because the GFW allowed it, GFW has no problems to block any VPN at will.

GFW is sophisticated beyond imagination, one way to detect VPN traffic(or SSL, or SSH) is to observe its patterns and where the traffic is going. It's not too hard to have a blacklist of all VPN vendors too.

shadowsocks was designed to bypass it(to make traffic looking random), I recall its developers were visited by cops and warned to stop doing that.

It's said China built the largest LAN on earth, the government is just too scared by its people to get educated, it's a true parallel universe.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#149

Post by m-p-3 »

nonethewiser wrote: post #122
bitwize wrote: post #108

Earlier quoted context omitted.

Get used to it; we will soon be a part of China's "community of common destiny".

I wouldn’t say that. But Western countries would absolutely replicate the surveillance and censorship if they could. And they do in some ways, but there are many structural things stopping them.

They let the private sector do it for them instead.

Re: How the great firewall of China detects and blocks fully encrypted traffic [pdf]

#150

Post by colanderman »

JPLeRouzic wrote: post #7

The algorithm found seems so unintuitive that I wonder if it was not found by the AI. " Allow a connection to continue if the first TCP payload (pkt) sent by the client satisfies any of the following exemptions: Ex1: popcount(pkt) len(pkt) ≤ 3.4 or popcount(pkt) len(pkt) ≥ 4.6. Ex2: The first six (or more) bytes of pkt are [0x20,0x7e]. Ex3: More than 50% of pkt’s bytes are [0x20,0x7e]. Ex4: More than 20 contiguous by…

Ex1 is just excepting low-entropy packets (distribution of 1s and 0s tends toward the mean for high-entropy data). Encrypted data presents as high-entropy. This is a crude method (errs on the side of not excepting) but is very efficient for embedded hardware to compute.

Ex2-4 are just excepting ASCII text, which is used by many unencrypted protocols (e.g. IMAP), but which are high enough entropy that they statistically will fail the first test often.

Ex5 is necessary because TLS is high-entropy (by nature of being encrypted). HTTP is also excepted presumably so e.g. compressed uploads (e.g. images/video) aren't flagged.

That "low entropy" is the key to bypassing the GFW isn't surprising at all -- high entropy is all but a necessary feature of most cryptography schemes. (I say "all but" because -- encryption isn't adding information, so unless you compress before you encrypt, it's possible for a (hypothetical) encryption scheme to preserve entropy, according to several objective metrics. I don't know of any that do this, beside the meta scheme of compression before encrypting, followed by steganographically padding the encrypted data afterward. This of course leaks some information through the encryption -- equal to the negentropy of the message -- but it would typically be information that can't be gleaned from context, e.g. that the message is HTML+text.)

So... base64-encode your TLS?

Post reply on HN