Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GreenTunnel: anti-censorship utility designed to bypass deep packet inspection

github.com

Post reply on HN
Print view View original

41–50 of 82 posts

Re: GreenTunnel: anti-censorship utility designed to bypass deep packet inspection

#41

Post by bravoetch »

ukd1 wrote: post #24
nimbius wrote: post #23

Earlier quoted context omitted.

there are two edges to this sword. DoH also means breaking stuff like pihole and other ad filtering. It means you trust companies like google who base their revenue off ads, or cloudflare who have censored content numerous times in the past, to serve you DNS. its also kind of pointless if the state knows youre using it outside of a tunnel...they can just watch your next packets to see where you decided to go.

pihole is a short term solution; it is the wrong long term one - it only works as these holes exist. blocking needs to be done in the browser, or your computer to be done more securely

Pi-hole helps for network devices where blocking on the device isn't possible. Examples in my household are the TV, which tries to connect to an obvious telemetry address, all my sonos devices (love em, hate em) the nest device, and the apps on all phones. I struggled to block those until the pi-hole made it easy.

Re: GreenTunnel: anti-censorship utility designed to bypass deep packet inspection

#42

Post by Thorentis »

> We send it in 2 parts: first comes GET / HTTP/1.0 \n Host: www.you and second sends as tube.com

How does this even work? "www.you" won't return a valid HTTP response and "tube.com" won't either. How can you fetch the content at "youtube.com" but splitting the domain name in half? Won't you get two completely wrong responses that don't fit together?

Re: GreenTunnel: anti-censorship utility designed to bypass deep packet inspection

#43

Post by detaro »

Thorentis wrote: post #42

> We send it in 2 parts: first comes GET / HTTP/1.0 \n Host: www.you and second sends as tube.com How does this even work? "www.you" won't return a valid HTTP response and "tube.com" won't either. How can you fetch the content at "youtube.com" but splitting the domain name in half? Won't you get two completely wrong responses that don't fit together?

It's split across two network packets. It's still one request for the web server.

Re: GreenTunnel: anti-censorship utility designed to bypass deep packet inspection

#44

Post by stevespang »

aasasd wrote: post #34
rubyfan wrote: post #33

Earlier quoted context omitted.

does this just become an arms race where root certificates or some sort of device management tools are forced onto citizen devices?

Kazakhstan just recently conducted an experiment with sending people an sms telling them to install a root cert. And Russia is making it mandatory to install not-yet-determined Russian software on all newly sold machines, which will quite probably soon include an FSB cert.

Ahh yes, all Tyrant / dictator / authoritarian states

Re: GreenTunnel: anti-censorship utility designed to bypass deep packet inspection

#45

Post by jaimex2 »

gruez wrote: post #11
paulryanrogers wrote: post #2

So basically it just does two things: carefully chunking HTTP header packets and encrypted DNS? Not sure this will work for very long.

>Not sure this will work for very long. Maybe if it gets popular. Defeating chunking would require additional memory + compute power on the DPI boxes, which I suspect ISPs don't want to bear.

I work in the DPI field and have maintained a few DPI firewalls.

Most DPI that I know of will defeat this bypass technique, I'm not sure the author has even tested if it works.

DPI firewalls already have to support aggregating packets. It's pretty common to need more information beyond the initial packet. It's not really any more memory intensive either, you're just reading byte by byte and keeping what you need.

Heck most DPI firewalls support checking something in the outbound packets is in the inbound packets. ie - checking if a connection is performing IKE.

Re: GreenTunnel: anti-censorship utility designed to bypass deep packet inspection

#46

Post by jaimex2 »

hrdwdmrbl wrote: post #26
david_draco wrote: post #18

Why not use Tor?

Really depends on your use-case. Tor is great but easily detectable and thus blockable, and though its speed has gotten much better, it isn't as fast as other options. But again, it really depends on what your goal is.

Tor has obfuscation options, they work well.

The default endpoint list is usually blocked though as its published to the clients so you have to request an off-list endpoint.

Re: GreenTunnel: anti-censorship utility designed to bypass deep packet inspection

#47

Post by friendlybus »

segfaultbuserr wrote: post #38
segfaultbuserr wrote: post #37

> GET / HTTP/1.0 > Host: www.youtube.com > We send it in 2 parts: first comes GET / HTTP/1.0 \n Host: www.you and second sends as tube.com \n .... In this example, ISP cannot find blocked word YouTube in packets and you can bypass it! If you talk to anyone from China that this is how you bypass (HTTP) "deep packet inspection", it would sound incrediblely naive. I'm not criticizing here, thanks for developing an anti-…

Shadowsocks being the most well-known example. From a cryptographic perspective, it was a big step backwards. Since Diffie-Hellman handshakes were subjected to traffic classifiers, these tools only used symmetric encryption with fixed keys. Their encryption protocols were ad-hoc, and not cryptographically robust. While it was a matter of fact that nobody could break a simple AES-CBC encryption, nobody would trust the…

Great post, thank you.

Re: GreenTunnel: anti-censorship utility designed to bypass deep packet inspection

#48

Post by travisgriggs »

Why hasn't this become the modern Right to Bear Arms? The root of the second amendment was trying to ensure that one class of citizenry did not have tools at their hands to force another class of citizenry to comply. It maintained a balance. The right to encrypt and keep your data private should be a modern equivalent of the right to bear arms.

Re: GreenTunnel: anti-censorship utility designed to bypass deep packet inspection

#49

Post by godelski »

nimbius wrote: post #23
snvzz wrote: post #15

This is a nice workaround for those stuck under censorship regimes such as the UK, South Korea, Turkey, India or China. Now, Encrypted DNS (thanks to DNS over TLS/HTTPS) and HTTPS (thanks to Let's Encrypt and HSTS) are getting deployed somewhat widely. The next step is encrypted SNI[0], and it'll get this much harder to do any meaningful DPI, for censorship or else. [0]: https://en.wikipedia.org/wiki/Server_Name_Indi…

there are two edges to this sword. DoH also means breaking stuff like pihole and other ad filtering. It means you trust companies like google who base their revenue off ads, or cloudflare who have censored content numerous times in the past, to serve you DNS. its also kind of pointless if the state knows youre using it outside of a tunnel...they can just watch your next packets to see where you decided to go.

> cloudflare who have censored content numerous times in the past

Besides Stormfront[0], what else did they censor?

[0] https://en.wikipedia.org/wiki/Stormfront_%28website%29

Re: GreenTunnel: anti-censorship utility designed to bypass deep packet inspection

#50

Post by jchw »

nimbius wrote: post #23
snvzz wrote: post #15

This is a nice workaround for those stuck under censorship regimes such as the UK, South Korea, Turkey, India or China. Now, Encrypted DNS (thanks to DNS over TLS/HTTPS) and HTTPS (thanks to Let's Encrypt and HSTS) are getting deployed somewhat widely. The next step is encrypted SNI[0], and it'll get this much harder to do any meaningful DPI, for censorship or else. [0]: https://en.wikipedia.org/wiki/Server_Name_Indi…

there are two edges to this sword. DoH also means breaking stuff like pihole and other ad filtering. It means you trust companies like google who base their revenue off ads, or cloudflare who have censored content numerous times in the past, to serve you DNS. its also kind of pointless if the state knows youre using it outside of a tunnel...they can just watch your next packets to see where you decided to go.

Quick thought. If software wanted to, could they not, today, bypass your DNS resolvers anyways? Choosing to use DoH on software where you control the DNS resolution seems like an unambiguous win. FWIW, the Chromium implementation of DoH upgrading only upgrades you to DoH if your configured DNS provider is known to support it via a hardcoded list.

In theory, you could have Pihole resolve using a DoH resolver and your devices resolve using Pihole and have the best of everything.

(Disclaimer: Google employee, not working on ads or Chromium or DNS.)

Post reply on HN