Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: The Internet situation inside Iran

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 198 posts

Re: Tell HN: The Internet situation inside Iran

#71

Post by masukomi »

you might want to consider scuttlebutt[1]. It's a truly decentralized social network. You can set up your own in-country servers to spread information between clients fairly easily and it doesn't matter if they take them down because it's decentralized any any other server can replace it. Set up a few and then if they take one down the others can spread the word about where to find its replacement.

[1]: https://scuttlebutt.nz/

[edit] checked back in on it since i hadn't used it for a bit. Looks like the clients probably still work but the development seems to have been abandoned for a couple years now. So sad. It had an amazing community. Maybe still does...

Re: Tell HN: The Internet situation inside Iran

#72

Post by zwkrt »

bouncycastle wrote: post #65

Back in the 80's, I remember that people were protesting without internet and mobile phones, with very successful results. They bought down the iron curtain after all. The most sophisticated technology they used was the printing press, for printing and distributing fliers, newspapers and censored books. Underground groups were organized in cells too, without phones, email or apps. Right now, it seems like those who u…

People can protest without the Internet. However, they’re at a greater disadvantage than protesters in the 80s because the government does have the Internet.

Re: Tell HN: The Internet situation inside Iran

#73

Post by remram »

bo1024 wrote: post #56

Can people use a steganography app to communicate via innocuous images? 1. Take a picture. 2. Use app to insert message into picture, encrypt with passphrase. 3. SMS picture to friend or upload to Iranian equivalent of imgur (if any is up). 4. Friend loads picture into app and types passphrase to get message. I'm not sure what a good choice of app would be, but something good must exist?

The point is that phone service and access to the outside internet is blocked. You can't get images out any more than you can get text out, so putting text in images does not help.

Re: Tell HN: The Internet situation inside Iran

#74

Post by cookiengineer »

darcys22 wrote: post #31

Over at session we are getting a massive influx of users from Iran right now. We have not been blocked yet, session is an e2ee decentralised messenger. https://getsession.org/

How does session compare to Briar + Orbot?

Did session and lokinet already have a code security audit or pentest?

Re: Tell HN: The Internet situation inside Iran

#78

Post by mariojv »

_yb2s wrote: post #25
LinuxBender wrote: post #5

the servers inside Iranian data centers still have access to the outside world. Knowing that, the simplest and easiest solution that would avoid detection is to SSH tunnel into that datacenter and SSH-ProxyForward out of that datacenter into Amazon AWS via SSH and use that SSH proxy chain as a SOCKS proxy for browsers. Make sure the browser is using the SOCKS proxy (SSH) for its DNS. Many sites will make your friends…

The first hop, "SSH Client -> Iranian Datacenter" seems extremely vulnerable to surveillance, and would create an incriminating list of people involved. With this discussion in the open, you can bet Iranian authorities are going to specifically look for anything discussed here, so the only viable solutions should have no measurable deviation from normal behavior that would allow them to detect which datacenter was do…

Could individuals run a public internet gateway that doesn't keep logs with something similar to mosh but running the equivalent of an SSH tunnel? Think a SOCKS proxy on one end, but running as a public web application/forward proxy on the other end.

The ISP would still be able to see any traffic to the gateway, but if you had enough links outside of government monitored net infrastructure to the gateway (hard lines you take down or obfuscate when the patrol does their rounds, wireless point to point connections), the risk would be on the gateway operator.

(Please do not take my advice without evaluation. This is speculation from a SWE, not advice for life or death situations.)

Edit: I suppose if your ingress traffic is over links not monitored by government anyway, it doesn't matter if you use SSH or a web application forwarding traffic to a SOCKS proxy behind the scenes. Not sure if the idea presented above would be useful in other scenarios.

Edit2: I guess usability is a benefit, even without security benefits. "Plug in this cable and type this URL into your browser" is easier than "open a terminal and establish an SSH connection."

Re: Tell HN: The Internet situation inside Iran

#79

Post by LinuxBender »

mariojv wrote: post #78
_yb2s wrote: post #25

Earlier quoted context omitted.

The first hop, "SSH Client -> Iranian Datacenter" seems extremely vulnerable to surveillance, and would create an incriminating list of people involved. With this discussion in the open, you can bet Iranian authorities are going to specifically look for anything discussed here, so the only viable solutions should have no measurable deviation from normal behavior that would allow them to detect which datacenter was do…

Could individuals run a public internet gateway that doesn't keep logs with something similar to mosh but running the equivalent of an SSH tunnel? Think a SOCKS proxy on one end, but running as a public web application/forward proxy on the other end. The ISP would still be able to see any traffic to the gateway, but if you had enough links outside of government monitored net infrastructure to the gateway (hard lines…

something similar to mosh

Something that looks similar to mosh being UDP and encrypted but that allows proxied traffic would be Tinc Open Source VPN [1] The nicest thing about Tinc is that it does user-space dynamic mesh routing without requiring packet forwarding being enabled. I would call it a middle ground to onion routing if set up right. It has configurable compression. The reason I did not suggest this is that it is not simple to set up and get OpSec right the first time out of the gate unless the people involved are already very experienced with it. That's why I suggested SSH. SSH is relatively simple, well known and will blend in with all the legit SSH traffic and more people have experience with SSH. SSH egress from a datacenter is normal, expected and likely already permitted to AWS without making logged firewall changes.

[1] - https://www.tinc-vpn.org/

Post reply on HN