Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VPN access being disabled in China

rendezvous.blogs.nytimes.com

Post reply on HN
Print view View original

21–30 of 62 posts

Re: VPN access being disabled in China

#21

Post by andreasvc »

tcoppi wrote: post #12

Does anyone know of any work related to automatically making arbitrary "look" like, say, an HTTP session? I'm thinking of something that would automatically encode a VPN session as a valid, renderable HTML document (and not via the trivial way of just gzipping it and making it look like an HTTP compressed document, as I'm sure that would still be easy to block.) It seems like this should be possible, albeit with tons…

Such a technique is called steganography. It's possible but would require lots of bandwidth depending on how secure you need it to be. For example you can hide data in a photo by slightly changing the shades of red in it without changing the appearance of the photo noticeably.

Re: VPN access being disabled in China

#22

Post by hnolable »

tcoppi wrote: post #12

Does anyone know of any work related to automatically making arbitrary "look" like, say, an HTTP session? I'm thinking of something that would automatically encode a VPN session as a valid, renderable HTML document (and not via the trivial way of just gzipping it and making it look like an HTTP compressed document, as I'm sure that would still be easy to block.) It seems like this should be possible, albeit with tons…

http://comments.gmane.org/gmane.network.openvpn.devel/7185

Re: VPN access being disabled in China

#23

Post by austenallred »

contingencies wrote: post #20
austenallred wrote: post #13

This sucks for travelers and ex-pats, but for China's future this is a very, very, very big deal. I lived in Shanghai last year, and Chinese Internet surveillance is unreal. I could use gmail chat to talk about tiananman square, but as soon as I did all of my Google apps would suddenly be unavailable. I can only assume that when i used certain keywords my every chat was being monitored. A VPN was the only way I could…

While knowledge of VPNs is huge, their use is not as large as you posit. I would argue instead that the real reason many young Chinese don't really care what the "great firewall" does is that they're almost exclusively using the domestic Chinese internet. Browsing in simplified Chinese, there's rarely a need to access the outside internet.

Perhaps it's not; I spent most of my time among very internationally-oriented, business-minded English speakers, which is by no means a fair sample, but it's not an insignificant subset, either. I'm most concerned about VPNs as the only possible path to avoid censorship on a large scale.

Re: VPN access being disabled in China

#24

Post by tcoppi »

andreasvc wrote: post #21
tcoppi wrote: post #12

Does anyone know of any work related to automatically making arbitrary "look" like, say, an HTTP session? I'm thinking of something that would automatically encode a VPN session as a valid, renderable HTML document (and not via the trivial way of just gzipping it and making it look like an HTTP compressed document, as I'm sure that would still be easy to block.) It seems like this should be possible, albeit with tons…

Such a technique is called steganography. It's possible but would require lots of bandwidth depending on how secure you need it to be. For example you can hide data in a photo by slightly changing the shades of red in it without changing the appearance of the photo noticeably.

I'm aware of steganography, but this would be slightly different than any published steg technique that I am aware of, as it would not be hiding in a preexisting carrier signal, it would be creating its own.

Re: VPN access being disabled in China

#26

Post by tcoppi »

hnolable wrote: post #22
tcoppi wrote: post #12

Does anyone know of any work related to automatically making arbitrary "look" like, say, an HTTP session? I'm thinking of something that would automatically encode a VPN session as a valid, renderable HTML document (and not via the trivial way of just gzipping it and making it look like an HTTP compressed document, as I'm sure that would still be easy to block.) It seems like this should be possible, albeit with tons…

http://comments.gmane.org/gmane.network.openvpn.devel/7185

obfsproxy looks like exactly what I was thinking of, thanks!

Re: VPN access being disabled in China

#27

Post by Fivesheep »

stock_toaster wrote: post #18
kaptain wrote: post #11

Earlier quoted context omitted.

I'm using IPSec now without any problems. OpenVPN is blocked. China has the power to be more selective about what it blocks. For example, Wikipedia is not blocked here (yet). But trying to access an article within Wikipedia on Tiananmen results in a dropped connection. Why China completely blocks entire blocks of ip addresses (like YouTube, Blogger, Wordpress) is not clear to me. There are a number of easy heuristics…

> OpenVPN is blocked. Are just the standard ports blocked? Or are they doing some type of traffic analysis to differentiate openvpn traffic over any port, be it tcp or udp (as openvpn can of course be configured for any port over tcp or udp)?

GFW is getting more advanced. It doesn't simply block you by ports anymore, but by your accessing patterns.

Re: VPN access being disabled in China

#28

Post by nwh »

cypherpunks01 wrote: post #25

How prevalent is Tor usage in China? Is it a PITA because one has to go through bridge relays?

Somewhere around a thousand a day (which is extremely low), with spikes way beyond that. I assume that they have difficulty finding relays, as the Firewall would be very updatable. For comparison, the daily connections for Australia and the US are over 4000 and 70000 respectively. You'd assume that the only ones being able to use the onion router at the moment are those that could find bridge relays with the obfuscation proxy enabled.

The TOR project has lots of neat graphs, broken down on a country basis:

https://metrics.torproject.org/users.html?graph=direct-users...

Re: VPN access being disabled in China

#30

Post by HideNSeek »

tcoppi wrote: post #12

Does anyone know of any work related to automatically making arbitrary "look" like, say, an HTTP session? I'm thinking of something that would automatically encode a VPN session as a valid, renderable HTML document (and not via the trivial way of just gzipping it and making it look like an HTTP compressed document, as I'm sure that would still be easy to block.) It seems like this should be possible, albeit with tons…

Perhaps how Google accomplishes getting through common firewalls with their news headlines; using an encrypted javascript tunnel. It isn't blocked by a majority of residential/enterprise firewalls, and using a similar technique one should be able to use HTTPS with an encrypted javascript tunnel to access out rather securely.

Perhaps there is something like this already in existence, and any resources/opinions would be great!

Post reply on HN