Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GreenTunnel: anti-censorship utility designed to bypass deep packet inspection

github.com

Post reply on HN
Print view View original

21–30 of 82 posts

Re: GreenTunnel: anti-censorship utility designed to bypass deep packet inspection

#21

Post by yjftsjthsd-h »

oedmarap wrote: post #17

It's really good to see more tools in the privacy space, resulting in more options and fallbacks for the end-user. I think the author should also try to market this as much as possible outside of the HN crowd, since this seems targeted at non-tech users — I could be wrong but my reasoning is that HN users who care about privacy would prefer a combination of a VPN and DoH to defend against traffic & DNS inspection, re…

It really depends on your threat model, but if you have a full tunnel VPN, then encrypted DNS is a lot less important.

Re: GreenTunnel: anti-censorship utility designed to bypass deep packet inspection

#23

Post by nimbius »

snvzz wrote: post #15

This is a nice workaround for those stuck under censorship regimes such as the UK, South Korea, Turkey, India or China. Now, Encrypted DNS (thanks to DNS over TLS/HTTPS) and HTTPS (thanks to Let's Encrypt and HSTS) are getting deployed somewhat widely. The next step is encrypted SNI[0], and it'll get this much harder to do any meaningful DPI, for censorship or else. [0]: https://en.wikipedia.org/wiki/Server_Name_Indi…

there are two edges to this sword.

DoH also means breaking stuff like pihole and other ad filtering. It means you trust companies like google who base their revenue off ads, or cloudflare who have censored content numerous times in the past, to serve you DNS.

its also kind of pointless if the state knows youre using it outside of a tunnel...they can just watch your next packets to see where you decided to go.

Re: GreenTunnel: anti-censorship utility designed to bypass deep packet inspection

#24

Post by ukd1 »

nimbius wrote: post #23
snvzz wrote: post #15

This is a nice workaround for those stuck under censorship regimes such as the UK, South Korea, Turkey, India or China. Now, Encrypted DNS (thanks to DNS over TLS/HTTPS) and HTTPS (thanks to Let's Encrypt and HSTS) are getting deployed somewhat widely. The next step is encrypted SNI[0], and it'll get this much harder to do any meaningful DPI, for censorship or else. [0]: https://en.wikipedia.org/wiki/Server_Name_Indi…

there are two edges to this sword. DoH also means breaking stuff like pihole and other ad filtering. It means you trust companies like google who base their revenue off ads, or cloudflare who have censored content numerous times in the past, to serve you DNS. its also kind of pointless if the state knows youre using it outside of a tunnel...they can just watch your next packets to see where you decided to go.

pihole is a short term solution; it is the wrong long term one - it only works as these holes exist. blocking needs to be done in the browser, or your computer to be done more securely

Re: GreenTunnel: anti-censorship utility designed to bypass deep packet inspection

#26

Post by hrdwdmrbl »

david_draco wrote: post #18

Why not use Tor?

Really depends on your use-case. Tor is great but easily detectable and thus blockable, and though its speed has gotten much better, it isn't as fast as other options. But again, it really depends on what your goal is.

Re: GreenTunnel: anti-censorship utility designed to bypass deep packet inspection

#27

Post by hrdwdmrbl »

__sy__ wrote: post #19

This is great if there isn't a blanket ban on VPN's, but unfortunately, it won't work in China. I've had next to zero-luck keeping my own VPN tunnels open for more than a couple of days at a time when behind the great firewall.

Check out v2ray. You'll need to have your own domain, server, and a cloudflare account, but in terms of speed it is unmatched. Unfortunately many of the best tutorials are in Chinese.

Re: GreenTunnel: anti-censorship utility designed to bypass deep packet inspection

#28

Post by snvzz »

nimbius wrote: post #23
snvzz wrote: post #15

This is a nice workaround for those stuck under censorship regimes such as the UK, South Korea, Turkey, India or China. Now, Encrypted DNS (thanks to DNS over TLS/HTTPS) and HTTPS (thanks to Let's Encrypt and HSTS) are getting deployed somewhat widely. The next step is encrypted SNI[0], and it'll get this much harder to do any meaningful DPI, for censorship or else. [0]: https://en.wikipedia.org/wiki/Server_Name_Indi…

there are two edges to this sword. DoH also means breaking stuff like pihole and other ad filtering. It means you trust companies like google who base their revenue off ads, or cloudflare who have censored content numerous times in the past, to serve you DNS. its also kind of pointless if the state knows youre using it outside of a tunnel...they can just watch your next packets to see where you decided to go.

>DoH also means breaking stuff like pihole and other ad filtering.

No, it doesn't.

e.g. I run DoH behind my home's dns cache server.

>its also kind of pointless if the state knows youre using it outside of a tunnel...they can just watch your next packets to see where you decided to go.

This is where HTTPS and eSNI further help.

Re: GreenTunnel: anti-censorship utility designed to bypass deep packet inspection

#29

Post by DanBC »

Nextgrid wrote: post #4
benbristow wrote: post #3

Doesn't work against Virgin Media UK

Virgin is censoring things now?

ISPs in the UK have to obey court orders, and there are some court orders in place for the "big 5" ISPs around certain piracy websites.

If I try to go to thepiratebay.org I get this

--- Access to this website has been blocked under an Order of the Higher Court.

Any TalkTalk customer affected by the Court Order has a right under the Court Order to apply to vary or discharge it. Any such application must: (i) clearly indicate the identity and status of the applicant; (ii) be supported by evidence setting out and justifying the grounds of the application; and (iii) be made on 10 days notice to all of the parties to the Court Order.

For further details click here. ---

On top of that there is a voluntary scheme run by the Internet Watch Foundation to provide filtering for sites that share images of child sexual abuse. Some ISPs don't participate in this, but the vast majority do. One famous example of things that get blocked (but also reasonably quickly unblocked) are the Wikipedia page for a band. NSFW link https://en.wikipedia.org/wiki/Internet_Watch_Foundation_and_...

Re: GreenTunnel: anti-censorship utility designed to bypass deep packet inspection

#30

Post by bscphil »

hrdwdmrbl wrote: post #27
__sy__ wrote: post #19

This is great if there isn't a blanket ban on VPN's, but unfortunately, it won't work in China. I've had next to zero-luck keeping my own VPN tunnels open for more than a couple of days at a time when behind the great firewall.

Check out v2ray. You'll need to have your own domain, server, and a cloudflare account, but in terms of speed it is unmatched. Unfortunately many of the best tutorials are in Chinese.

Looks interesting. From https://www.v2ray.com/en/index.html it seems that it's "just" a VPN protocol / software that can tunnel over TLS. I assume the point of using your own server + Cloudflare is that it breaks IP based blocking of most VPN providers. I guess just your own server without Cloudflare would work fine for a while, but they probably have heuristics for a lot of encrypted traffic sent to a single unknown server?

The remaining question for me is about the TLS part of all this. Does China not have agreements with most external services about stripping TLS such that a lot of TLS traffic would be suspect? Or do they not mandate their citizens to use a Government provided root cert that would allow them to "securely" MITM connections? That would be how I'd do it if I were an authoritarian government.

If not, then what's their plan for the future? I could see a Firewall kind of mostly working for now on a combination of DNS, IP, and SNI filtering, but all three are going away in the near term. DNS with DNS-over-HTTP, SNI with eSNI, and IP blocking has become less plausible already through routine use of proxies like Cloudflare.

Post reply on HN