Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GoodbyeDPI: Deep Packet Inspection circumvention utility

github.com

Post reply on HN
Print view View original

71–80 of 124 posts

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#71

Post by patrakov »

oarsinsync wrote: post #59
5e92cb50239222b wrote: post #26

Earlier quoted context omitted.

I wonder why a VPN is the default solution (with all complications it ensues, some of which you've listed), when a simple SSH tunnel to any server in a sane location does just fine. `ssh server -D12345`, point your applications to socks5 at localhost:12345, and it's done. It's dead simple to only allow/deny those sites that you (don't) need to go through another server, and the traffic is encrypted (and optionally co…

Encapsulating TCP in TCP results in exponential backoff and retransmissions in the event of loss.

SSH tunneling is encapsulating byte streams in TCP, not TCP (which means "packets with sequence numbers, acknowledgements, and retransmissions") in TCP, and therefore doesn't suffer.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#72

Post by mmaunder »

patrakov wrote: post #18
liberia wrote: post #2

Worth reading Deep Packet Inspection is Dead: https://security.ias.edu/deep-packet-inspection-dead-and-her... This tool is great, but I religiously route all my traffic through a VPN that I own and control. I’ve hardened the box I use to have zero logs and I don’t need to blindly trust a commercial provider whether they’ve been audited or not. There’s no way of really knowing they’re not logging in some capacity bar…

Well, the good point of GoodbyeDPI is exactly so that it preserves your IP address. Normally, when trying to circumvent censorship, you would need a VPN server in a different country. But the downsides are that the bank will deny all transactions and call you (OK, answered, they added the VPN IP to the whitelist), that you will miss local-only content, you won't be able to register for a doctor appointment online (th…

Why isn’t SSL working for you? You should be end-to-end encrypted and no censor or government should be able to see your https requests.

The only time this doesn’t apply is if someone controls your computer or the destination website and is able to MITM your TLS traffic. Is that what has happened?

Your HTTPS headers are not visible to anyone. So, for example, why is GoodbyDPI modifying the Host header? This is inside the end-to-end TLS encrypted connection that your ISP can’t see, and that the destination web host can’t see.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#73

Post by 0xedd »

denkmoon wrote: post #21
buwrtgu wrote: post #14

Earlier quoted context omitted.

"secure boot must be disabled" is the equivalent of "in case of permissions error, just chmod 777". secure boot literally protects the user first, and is configurable with user provided keys on the vast vast majority of open platform computers (i.e. amd64) "prevent injection of a driver that can divert all my shit at the kernel level" is exactly what you want secure boot protecting you from. there is no limitation of…

Sad to see this downvoted without any response, because as far as I see he's exactly right.

No. That's just propaganda. The purpose is to further vendor lock you. MS has a minute share in the world of OS, completely outclassed by Linux. They're trying to force their way in by fooling people like you that something like Pluton is required.

The only reason they dominate the PC market share is because their spyware OS is installed by default and people don't go around switching OSes.

An anecdote about security; at my workplace, one of the top 5 security firms in the world, secure boot isn't required nor is MS. Makes you wonder.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#74

Post by cmgbhm »

rixrax wrote: post #33

Looking at the circumvention techniques GoodbyeDPI uses makes me want to cry. Is this really the state of DPI in 2022: changing Host to hoSt, or adding white spaces between method and URI actually works?

You can get really far with cheap techniques when your goal is to dissuade. The bigger concern I’d have is statistical analysis of top offender.

Every OSI layer offers more bypass techniques and is the halting problem where your goal is to get value without making everything break when a new browser comes out. You can’t cover all options as a 3rd party and get it perfect.

The higher up application layer, the easier it is to bypass. The more you try to classify without impact (dpi,ids,waf,spam,av), the easier bypasses are.

The domains that get effective like spam have quicker feedback loops. Network middle boxes have the slowest response cycle where they are explicitly called out in RFCs

In a url might get blocked but … bc it’s string matching and not layer aware.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#75

Post by OmarAssadi »

patrakov wrote: post #18
liberia wrote: post #2

Worth reading Deep Packet Inspection is Dead: https://security.ias.edu/deep-packet-inspection-dead-and-her... This tool is great, but I religiously route all my traffic through a VPN that I own and control. I’ve hardened the box I use to have zero logs and I don’t need to blindly trust a commercial provider whether they’ve been audited or not. There’s no way of really knowing they’re not logging in some capacity bar…

Well, the good point of GoodbyeDPI is exactly so that it preserves your IP address. Normally, when trying to circumvent censorship, you would need a VPN server in a different country. But the downsides are that the bank will deny all transactions and call you (OK, answered, they added the VPN IP to the whitelist), that you will miss local-only content, you won't be able to register for a doctor appointment online (th…

For what it’s worth as well, there are other solutions than whole-network VPNs and such.

Personally, I chose to generate a domain list for V2Ray from the Russian government’s blocklist when I lived there [1].

I prefer to do that typically because it avoids the pain of the ever-growing whitelists and it allows me to keep the traffic encrypted in case someone does actually figure out that you’ve bypassed DPI. And if you use something like V2Ray or ShadowSocks, they’ll disguise the traffic much better than something like OpenVPN typically would, making it less obvious to anyone monitoring that you’re using a proxy in the first place.

There’s a load of references and pre-generated lists for different needs if anyone else is interested in doing something similar [2].

(Also, I hope this doesn’t come across as missing the point of the tool — I think it’s really useful and a good solution. I just figured I’d note some others too)

[1]: https://github.com/OmarAssadi/AntiZapret-V2Ray

[2]: https://github.com/v2ray/domain-list-community

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#76

Post by kebman »

negus wrote: post #58
kebman wrote: post #57

Sorry, might be a dumb question, but isn't this simply a matter of encrypting your packets or using a VPN?

You certainly can pass all blocked traffic through VPN. But this is a cheaper (and because of that is more scalable) way to pass through.

Sorry, wouldn't that simply constitute security by obscurity?

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#77

Post by wruza »

Zen1th wrote: post #62
wruza wrote: post #61

Earlier quoted context omitted.

religiously route all my traffic through a VPN that I own and control Can you please share an easy way to do that? I’m usually not afraid of wading through configuration swamps, but when it comes to openvpn, I curl up in a corner crying.

Personally I use dsvpn ( https://github.com/jedisct1/dsvpn ) which is super simple to setup and use, and it's made by the guy who created libsodium.

Thanks! But from what I can see in sources (please correct me if that’s wrong), it is not a vpn, and a regular vpn client cannot connect to it. Nice idea along the lines of SOCKS proxy.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#78

Post by someguydave »

gjulianm wrote: post #66
progbits wrote: post #37

Earlier quoted context omitted.

Censorship companies probably can't hire good talent. I'm actually glad to see this, however it might get patched if this tool becomes too widespread.

It's not as much about talent but about tradeoffs. I work in traffic monitoring tools (not censorship, just observability tools for infrastructure) there's always the decision of how many edge cases you want to cover vs how fast you want your tool to go. At millions of packets per second, an extra "if" might make a big difference in the throughput you're able to monitor. So maybe it's actually reasonable to ignore th…

More importantly, using “hoSt” is a self-declaration of being an enemy of the censorship regime which is probably dangerous in Russia.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#79

Post by mytailorisrich »

vbezhenar wrote: post #70
vlovich123 wrote: post #67

Earlier quoted context omitted.

Isn’t this stuff typically specially built HW? I feel like an ASIC can accelerate this stuff fairly quickly although the volumes/pricing may not warrant building that. Also if you’re matching on host name there’s no reason you even need to keep up with line rate. All you need is to do is keep up with the connection establishment rate and you can always do the processing in the background and just issue a TCP reset af…

Can you update ASICs with new firmware?

No but I suspect many hardware products use FPGAs, which can be updated as you would firmware, and indeed are often updated during firmware updates.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#80

Post by DethNinja »

liberia wrote: post #2

Worth reading Deep Packet Inspection is Dead: https://security.ias.edu/deep-packet-inspection-dead-and-her... This tool is great, but I religiously route all my traffic through a VPN that I own and control. I’ve hardened the box I use to have zero logs and I don’t need to blindly trust a commercial provider whether they’ve been audited or not. There’s no way of really knowing they’re not logging in some capacity bar…

FYI, your setup is great if you don’t trust your ISP but it doesn’t provide any privacy.

Public VPNs act as a mixer and hide your tracks. IP correlation is very easy nowadays, so persistent single connection to your own VPN won’t protect you from certain entities that correlate your traffic.

DoH is better than DNS but it doesn’t provide privacy. You should switch to DNSCrypt.

Post reply on HN