[HN Gopher] How the great firewall of China detects and blocks f...
___________________________________________________________________
How the great firewall of China detects and blocks fully encrypted
traffic [pdf]
Author : mngnt
Score : 314 points
Date : 2023-06-30 07:03 UTC (15 hours ago)
(HTM) web link (gfw.report)
(TXT) w3m dump (gfw.report)
| anovikov wrote:
| I wonder what can be done about detecting data hidden within
| video streams in a steganographic way.
| Renaud wrote:
| I remember having to deal with the early GFW about 20 years ago
| when I was working for a company that had some employees on a
| site in Shanghai.
|
| Every morning, our colleagues in China would open their mail
| client and it would connect to our server abroad.
|
| The first person would usually be OK, but for everyone else, the
| connection would fail.
|
| At the time, almost nothing was known of the GFW and it wasn't as
| clever as it is now. I found out that the POP connection was
| quickly blocked after a few minutes, probably triggering some
| slow firewall rules along the way (it seemed a bit random, so I
| assumed the firewall setup wasn't unified).
|
| Moving to POPS/SMTPS seemed to improve things for a while, but
| the connection would still be randomly blocked.
|
| What worked in the end was to use a bunch of random ports instead
| of the well known ones to accept POP/SMTP connections on the
| server, and we never had any issues after that, at least until we
| changed system a couple of years later.
| dizhn wrote:
| We have a satellite office in Dubai. I know their static IP.
| When they connect to our imap/smtp server they are coming in
| from another IP. I never looked into it deeply but assumed
| their connection is being diverted for inspection. (If true,
| they would probably not be below performing industrial
| espionage with the data they are accessing)
| f4c39012 wrote:
| I've debugged connection issues with someone in China. The
| same person, using the same browser and at the same time,
| showed up in the logs of two cloud apps with different IP
| addresses. The applications were adjacent in the cloud, same
| network config and everything. We figured there was _always_
| redirection, and we were never seeing their "true" IP
| address.
|
| A simpler test is to search "what is my IP" and compare the
| values returned by different services.
| aeyes wrote:
| The IP space in China is wild, multiple ISPs use the same
| IP ranges and some even use foreign IP space but they don't
| route them outside of China. I wouldn't be at all surprised
| seeing proxy setups at ISPs trying to "fix" some of this.
|
| Even when we had physical machines in Chinese data centers
| it didn't mean that our service was reachable from all
| ISPs. In 2010 we gave up on that and just started using
| Akamai China CDN with our servers in Europe.
| proto_lambda wrote:
| At that level, there is no reason to proxy it through a
| different IP address. If you control the network, you can
| just make the packets come from the original, real address.
| dizhn wrote:
| It might be something government mandated where all ISPs
| direct mail traffic to a central location. (The largest ISP
| is the government by the way)
| H8crilA wrote:
| It was probably written by junior devs, like most other
| software around the world.
| slt2021 wrote:
| GFW that can inspect petabytes of traffic per second for
| 1.4 bln population cannot be written by juniors
| EGreg wrote:
| Speaking of satellites, the ones in geosynchronous orbit, how
| can Chinese block those?
| ec109685 wrote:
| "We will shoot your satellite if you don't block access
| while over China".
| EGreg wrote:
| In orbit? Good luck
|
| Lasers maybe?
| ImPostingOnHN wrote:
| the US has done so with a missile so basic that it's
| named "standard missile 3"
|
| most satellites will just be following an uninterrupted,
| predictable path for most of their time
| occamrazor wrote:
| Is the IMAP/SMTP connection not encrypted?
| dizhn wrote:
| Yes they are encrypted.
| philjohn wrote:
| Doesn't matter if the government mandates MITM and forces
| install of root certs on all clients.
| ballenf wrote:
| Would a steganographic hiding of payloads be possible and usably
| efficient inside permissible content/protocols? Has it been
| tried?
| gruez wrote:
| That would require mimicking an existing protocol, and as per
| the paper that's non-trivial
|
| >Houmansadr et al. [39] conclude that mimicking a protocol is
| fundamentally flawed and suggest that tunneling through allowed
| protocols be a more censorship-resistant approach. Frolov and
| Wustrow [35] demonstrate that even when a tunneling approach is
| used, it still requires effort to perfectly align protocol
| fingerprints with popular implementations, in order to avoid
| blocking by protocol fingerprints. For instance, in 2012, China
| and Ethiopia deployed deep packet inspection to detect Tor
| traffic by its uncommon ciphersuits [44, 55, 67]. Censorship
| middlebox vendors have previously identified and blocked meek
| [29] traffic based on its TLS fingerprint and SNI value [28].
| password4321 wrote:
| https://en.wikipedia.org/wiki/Domain_fronting was a workaround
| for a while.
|
| https://signal.org/blog/looking-back-on-the-front/ (2018)
| https://news.ycombinator.com/item?id=16970199
| apatheticonion wrote:
| Given HTTPS traffic is mostly permitted, could one obfuscate VPN
| traffic over http/3 (which I believe is UDP)?
| trallnag wrote:
| Could China implement a MitM proxy for HTTPS traffic like many
| companies do?
| nikanj wrote:
| No.
|
| Companies get around ssl issues by minting their own root CAs
| and configuring their workstations to trust them. China has
| no (technical) way of forcing you to trust their root CA
| gruez wrote:
| >China has no (technical) way of forcing you to trust their
| root CA
|
| That might be true, but "install our root CA or you can't
| access websites" would get most people to do it.
| netheril96 wrote:
| Indeed a whole class of GFW bypassing tools are now based on
| masquerading as HTTPS. Trojan (TCP only), Vision (TCP only),
| Hysteria (UDP), just for some examples.
| Ballas wrote:
| Seems like UDP is completely exempt, which would allow UDP-based
| VPNs, like Wireguard through.
|
| SSH is also exempt...
| sysstemlord wrote:
| I'd go for ssh if I was trying to bypass it. At least legally I
| can claim that I'm just sshing to my aws server and not be
| jailed for using vpn.
| blablablub wrote:
| using ssh for proxying is getting blocked within the first
| minute.
| lsllc wrote:
| Could be a use case for X-Windows with ssh -X [0]? (so your
| web browser is actually running outside the GFW, it's just
| the window updates that are coming over the SSH tunnel).
|
| [0] https://unix.stackexchange.com/questions/12755/how-to-
| forwar...
| blablablub wrote:
| any ssh traffic that does not look like ssh traffic (few
| bytes send to server, some more bytes returned) gets
| either terminated or slowed down to a crawl
| speedgoose wrote:
| Does this mean that in addition of the classic fail2ban,
| geoip firewall, or forever super slow login banners, we
| could also have a honey pot sending a lot of data with a
| traffic pattern similar than web browsing ?
| yorwba wrote:
| Trying to get off the hook on a technicality isn't going to
| work. Lots of people use VPNs completely in the open without
| getting jailed, because they're not otherwise of interest,
| but if you _are_ being targeted, nobody is going to care
| about your "sshing to aws" excuse. And ssh tunneling web
| traffic looks quite different from normal ssh usage anyways.
| 6LLvveMx2koXfwn wrote:
| > And ssh tunneling web traffic looks quite different from
| normal ssh usage anyways.
|
| Could you explain this further, this seems counter to my
| understanding of encrypted traffic!
| yorwba wrote:
| SSH encryption only hides the content, not how much is
| being sent and when. When your browser fires off a bunch
| of requests to load a webpage, the timing is different
| from running typical commands on a server and receiving
| the output.
| justsomehnguy wrote:
| Open network tools in your browser and go to Reddit,
| count total traffic. Now compare it with a typical SSH
| session, even with 'tail -f' some logs.
| praash wrote:
| I assume the timing patterns and amounts of data would
| likely be distinct between SSH and web. "Normal" SSH
| usage would mostly consist of much lighter packets, such
| as user keystrokes and terminal screenfuls of text.
| Typing tiny commands and getting a few kilobytes of
| output. SSH file transfers happen occasionally, sometimes
| with a large bulk of data.
|
| Active web browsing requires downloading a crapton of
| files with wildly different sizes and sporadic timings
| between them. Add normal user interaction, API requests,
| ad cycles, long video streams that won't max out all
| bandwidth, all happening at once across multiple tabs.
| The client also sends much more data with each TLS
| handshake and all those HTTP headers.
|
| This could probably be masked by deliberately filling
| idle periods with garbage data just to appear as a stable
| data stream both ways.
| mcpackieh wrote:
| Forget using a real web browser over an SSH proxy. What
| using elinks on a remote host with ssh? I bet somebody
| using elinks across ssh is virtually indistinguishable
| from somebody using a text editor.
|
| Not much good for images or video, but you could easily
| read https://text.npr.org/
| beardog wrote:
| I suspect TCP tunneling your traffic looks different than
| SFTP-ing some files around.
| josephcsible wrote:
| > At least legally I can claim that I'm just sshing to my aws
| server and not be jailed for using vpn.
|
| Your mistake is assuming that China has rule of law. If
| you're in China and you upset Xi enough, you get
| jailed/disappeared even if you technically didn't break any
| laws on the books.
| jongjong wrote:
| I was told that SOCKS proxies (which let you tunnel over SSH)
| are popular in China. It's super easy to setup and you don't
| need to install anything. You just need to SSH into any Linux
| EC2 instance outside of your network with ssh -D $port_number
| $username@$hostname and change a simple setting in your browser
| to proxy through that node using SOCKS5. It's nice because you
| still control the remote host (no need to trust some third
| party VPN) and the traffic is encrypted between your remote
| host and your local host (where it counts)... Anyone snooping
| would just think that you're SSHing into your EC2 instance for
| work purposes and not realize you're using it to browse the
| net.
| netheril96 wrote:
| You were told wrong. If you uses SSH as a proxy, the
| connection will be slowed down to a crawl very soon. GFW
| distinguishes this from SSH command typing by looking at the
| traffic. This has been in place for at least a decade.
| Hikikomori wrote:
| Went to china some years ago and my pptp vpn blocked after a
| day. Switched to ssh and after a day it was rate limited to
| basically nothing, but I could avoid that by switching port
| every morning.
| lordnacho wrote:
| Why would they let that happen? Doesn't seem to make any sense
| to me if it's how you describe it.
| Ballas wrote:
| Yes, that is why I also found it interesting. As to their
| motives - I cannot comment.
| WinstonSmith84 wrote:
| that's mentioned at the end of Page 17. The author tells it's a
| short term solution: "This is merely a stopgap measure, as the
| censor can enable their censorship for UDP."
|
| It doesn't seem that there are any (long term) solution to
| bypass the rules ...
| throwawayadvsec wrote:
| steganography?
| Ballas wrote:
| Hiding the encrypted messages so that it looks like other
| normal traffic. Like encoding your encrypted message
| (subtly) in the pixels of an image (like noise).
| reaperman wrote:
| It does seem like this GFW scheme can be tuned to severely
| degrade the reliability of any _unapproved high entropy_
| traffic. However, this single scheme doesn 't cover many
| other types of circumvention traffic, several of which are
| noted in the beginning of the paper. This scheme primarily
| applies to "fully encrypted" traffic - not SSL/TLS, etc.
|
| So for now, circumvention can live on, but this explains to
| everyone using fully encrypted protocols exactly why their
| connections would have been degraded over the past couple
| years. In the long term, steganography will probably work
| well as long as users are able to endure much higher costs
| for traffic (low ratio of true data to apparent data) and as
| long as the steganographic systems are effective at hiding
| any statistical fingerprints (very difficult). Protocol
| mimicry is another strategy, but a paper cited in this work
| details why successful protocol mimicry is very difficult.[0]
|
| Attempts to disguise circumvention traffic as typical traffic
| is very difficult, because a lot of fingerprinting
| information can be gleaned from handshakes and headers. The
| draw of fully encrypted traffic is that it provides very
| little variation which can be used to fingerprint and
| classify different types of usages. However, it's also easy
| to detect and block en masse -- that much is obvious, but
| this paper does a great job of showing how China does it and
| inferences can be made from that to provide a view into
| China's priorities (how much cost they're willing to incur,
| rates of false positives they feel is acceptable). Overall,
| China's blocking current appears to be fairly conservative
| here, with relatively low rates of false positives.
|
| In wider context, China is constantly updating their
| detection schemes, they're quite competent at it, and
| anything which doesn't match typical traffic is at risk.
|
| 0: https://people.cs.umass.edu/~amir/papers/parrot.pdf
| blablablub wrote:
| all https traffic to servers outside of china gets slowed
| down to a crawl after the first MB of send data.
| blablablub wrote:
| Wireguard is detected within the first minute of usage and
| blocked. The ping is a dead giveaway.
| Ballas wrote:
| Interesting. I was just going on my limited scan through the
| linked PDF, which evidently was not thorough enough.
| DeathArrow wrote:
| What kind of websites does China block?
| throwaway2990 wrote:
| Anything that might reveal to Chinese citizens that the CCP is
| evil.
| mooxiu wrote:
| google, facebook, amazon, twitter, github, you name it ...
| seanmcdirmid wrote:
| Also Reddit (ironically Chinese owned).
| cheaprentalyeti wrote:
| Reddit's owned by the Chinese? I thought they were owned by
| a US-based conglomerate called Advance Publications, which
| is the same group that owns Conde Nast.
| law_enforcement wrote:
| The comments from people obviously never having been into a
| restricted country are hilarious. There are a few, most likely
| shadow approved, VPN providers that work. I refuse to believe
| they are just smarter than the GFW. I am convinced they are
| sanctioned and monitored. Which is fine if you never have any
| beef with the government. Which you never know you do until you
| do.
|
| Stuff like socks5/shadowsocks and wireguard have long been
| useless. Imagine being in your house, and you want to go out,
| without anyone seeing you. No matter how well you try, just the
| attempt itself reveals you are trying - thus you are caught. Same
| for escaping GFW. A sanctioned VPN or RDP that stays alive
| without metering, is your best option.
| rfoo wrote:
| Your comment is equally hilarious from the point of view of a
| native who lives in China now.
|
| idk if i'm smarter than the GFW but every time I rolled my own
| censorship-circumvention tool it worked well, even the most
| lazy way worked. I've never used any VPN provider. And FYI even
| unchanged WireGuard still works, though there seems to be some
| offline traffic analysis looking for that, so once a week you'd
| wake up to your VPN connection broken and had to change
| ListenPort on the server.
|
| The only annoying thing for me is: f- you AWS, egress too damn
| expensive!
| [deleted]
| bilkow wrote:
| Can't you use a "sanctioned" VPN to tunnel your connection to a
| "real" VPN or any wireguard endpoint? They could still be able
| to find out you're using a VPN, but not monitor your traffic.
| law_enforcement wrote:
| Yes, you can. But you have to wonder what the sanctioned VPN
| is doing on/to your machine. There is a lot of trust going
| into any VPN solution.
| ImPostingOnHN wrote:
| are you talking about the VPN endpoint exploiting a 0day
| vulnerability in the VPN client stack of the OS?
| baybal2 wrote:
| On the other hand, this shows GFW authors are more, and more
| considerate of the collateral damage, which is a surprise. It
| seems GFW has indeed became good enough to frustrate casual users
| to trigger uproar when windows update, or AWS ip ranges go belly
| up, or something.
|
| VPN authors should chose the maximum collateral damage strategy
| to frustrate GFW authors, make China as close as possible to
| completely cutting off outside internet. No need to completely
| evade fingerprinting, instead, do the complete opposite, and try
| to mimic common protocols, and critical applications as much as
| possible.
| ixwt wrote:
| From my understanding, this is what TOR did for some time. They
| tried to make it look as close as possible to HTTPS.
| H8crilA wrote:
| The exact reverse engineered algorithm of the GFW is on page 4.
| It looks very reasonable (given what they are trying to achieve
| with it).
|
| The easiest bypass I can think of would be to tunnel your
| connections via TLS. For example socks server tunneled via SSH
| which in turn is tuneled via TLS to your gateway.
|
| Or perhaps you can somehow get your SSH client to transmit "GET "
| at the beginning of the connection, have the server ignore those
| 4 bytes, then proceed as usual.
| EGreg wrote:
| This is what I have a question about.
|
| Can China pressure every domestic company to use their
| certificate authority allowing them to decrypt all TLS traffic,
| or be blocked? And block all sites outside China?
| H8crilA wrote:
| 1 - I believe they do it
|
| 2 - they obviously do not want to block all traffic, since
| they can do it any day, but they don't.
| supriyo-biswas wrote:
| Kazakhstan had attempted a similar move[1], albeit through
| PSAs rather than convincing device manufacturers to add
| certificates to end-user devices.
|
| [1] https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-
| middle_a...
| nikanj wrote:
| If it's over https, an outside observer has no way of knowing
| your stream started with a GET. Unless they've tapped ssl
| certificates, but that would be major news
| H8crilA wrote:
| They are tapped into SSL certificates, those that are
| generated in China. Plus wherever the Chinese intelligence
| managed to install their "plugins".
| throwaway290 wrote:
| Are any of those tappable certificates still considered
| trusted by wider internet? Which CAs are those? They should
| be removed from trusted ASAP.
| FredPret wrote:
| This is such an own goal by China. All this useless work done
| suppressing the human spirit.
| pessimizer wrote:
| > All this useless work done suppressing the human spirit.
|
| It also becomes an inspiration to others.
| FredPret wrote:
| Would-be dictators, or firewall makers?
| red-iron-pine wrote:
| google
| JoeAltmaier wrote:
| So now we have to embed encrypted traffic in innocuous plaintext
| envelopes?
|
| It's like the cold war.
| NamTaf wrote:
| Interesting that it's cracking down on Shadowsocks with
| obfuscation plugins. SS w/ v2ray was more or less the gold
| standard when I was going there from 2017 to 2019.
|
| Back then, certain times (early June, big government meetings)
| would see a crackdown on VPNs where, so far as I could tell, they
| just threw down crude blanket blocks on anything they sorta-kinda
| knew was a VPN but couldn't procedurally target-block. It would
| (usually) still connect but be rate-limited to essentially
| nothingness.
|
| I always got the vibe that they sort of informally tolerated VPNs
| above a certain threshold of sophistication, figuring that they
| were more interested in blocking the low-hanging fruit that the
| unwashed masses could easily use, rather than something more
| sophisticated that only a few techno-nerds could utilise. As
| other posters have said, they'd know who was doing it and
| preferred to come knocking with a rubber hose if those people
| caused too much in the way of issues.
| cookiengineer wrote:
| But does the paper imply that something like chunked encoding
| smuggled HTTP requests with an encrypted payload after the second
| chunk would work?
|
| That is, assuming entry nodes are available as e.g. nginx proxies
| inside the Chinese ASNs and are allowed to operate serving
| websites to ASNs from foreign countries.
|
| I'm mentioning nginx because there were some related bypass
| vulnerabilities in the past, and one could argue that they just
| missed updating them.
| blablablub wrote:
| tried that...done that... blocked The last rule of the GFW is:
| If you don't know what this traffic is or it looks suspicious,
| block it.
| olodus wrote:
| I am a total obfuscation noob. How far does their DPI go? I am
| guessing Tor and stuff have tried hiding it inside lots of
| different protocols and file types (I think I read something
| about that at some point). Is it to the point of hiding it as
| part of a html doc (like under a specific tag or something). At
| what point do we move towards having executable Javascript
| generate the encrypted text which then is decrypted?
| nyolfen wrote:
| i recall a chinese guy telling me he got around it on his PC by
| setting up a streaming webtop on a VPS on a foreign network that
| he didn't have issues accessing
| https://docs.linuxserver.io/images/docker-webtop
| WinstonSmith84 wrote:
| I was wondering about simply using VPNs, which is not mentioned
| in the article at all, but checking GFW on Wikipedia, it tells:
|
| > The use of VPNs in China can provide individuals access to the
| international internet, but in China, it can be a potential legal
| risk. In 2017, the Chinese government declared all unauthorized
| VPN services to be illegal.[94] An example of the use of this
| punishment is Vera Zhou, a student at the University of
| Washington, who, when visiting her Hui parents in Xinjiang,
| China, used a VPN to access her school homework. She was arrested
| and sent to a Xinjiang internment camp from October 2017 until
| March 2018, followed by house arrest after her release. She was
| not able to return to the US until September 2019.[95][96]
| noduerme wrote:
| Just a small personal anecdote from another country with tight
| restrictions:
|
| When I rented a furnished apartment in Saigon back in 2008,
| there was an ethernet cable on the table and a piece of paper
| in English that said "Do not visit websites of anti-government
| propaganda, or pornography, or news such as the New York
| Times."
|
| Naturally, as the police held my passport for the entire year I
| was in Vietnam, I was cautious. But after a few days, I just
| went ahead and openly browsed the NYT for a few minutes. My
| internet was shut off for about 3 hours. The next time I did
| it, it was shut off for 24 hours, and then I knew it wasn't a
| glitch. It wasn't exactly immediate, either; it took a few
| minutes. I was pretty sure there was a semi-dedicated person
| assigned to watch my traffic.
|
| That wasn't over a VPN. I wanted them to see my traffic. But I
| knew running over a VPN would just raise suspicion. When I
| opened up VPNs to check email after that, I did it from cafes,
| and I did it in short spurts.
| hinkley wrote:
| In fact, the US Department of State recommends that all US
| citizens have a photocopy of their passport with them, when
| traveling abroad.
|
| Supposedly you get in shorter lines at the consulate if you
| have at least a photocopy of your passport available. You
| should be able to petition the consulate of your home country
| to issue you a new passport.
|
| I think it may be illegal, but I've heard from people who
| travel to places where it's sketchy for Americans to travel,
| that they report their passport as destroyed, get a second
| copy issued, then keep the first one.
|
| The reasoning is that certain immigration departments see red
| flags if they see visa stamps from certain other countries,
| and you may get grief for having visited them. Cuba and the
| US used to be one, but cross-border rivalries are another.
| Knowing who hates who and presenting the right passport to
| receive the stamp would save you grief. Also if you encounter
| corruption/extortion you can schedule the next flight out and
| run.
|
| With the electronic ones now I don't know how many places
| that still works.
| vidarh wrote:
| Some countries will issue second passports legally exactly
| for the reasons you list, but you typically need to apply
| for permission. Replacing your passport early without
| needing to pretend it's lost because it has stamps from a
| "problematic" country tends to be easier most places, but
| of course a hassle if you travel to these countries more
| than once.
| noduerme wrote:
| Anyone that says you should keep your passport on you when
| you're in a foreign country has never traveled. I never
| keep my passport on my person when I'm walking around
| outside the US. I lock it away as securely as I can
| wherever I'm staying, and carry a color copy of it in my
| pocket.
|
| Part of this is simply because American passports are
| extremely valuable. Another part is that anyone who wants
| to fuck with you in some semi-official capacity now has to
| choose whether to go back to your hotel or arrest you on
| the spot, which puts them in a better mind to give up or
| take a bribe.
| qingcharles wrote:
| But please don't keep it in a room safe at a hotel. If I
| had a dollar for the people I know who put valuables in
| the room safe and lost them...
| nerdbert wrote:
| Yep, laminated color copy is the way to go.
| reaperducer wrote:
| _Another part is that anyone who wants to fuck with you
| in some semi-official capacity now has to choose whether
| to go back to your hotel or arrest you on the spot, which
| puts them in a better mind to give up or take a bribe._
|
| Happened to me at an airport in Thailand. Some airside
| police officer demanded to inspect my passport, then
| wouldn't give it back to me until I walked him to an ATM
| so I could pay him a "tax" in cash.
|
| I never went back to Thailand.
| qingcharles wrote:
| Had this in Hungary about 2004. Had no money at all at
| the time. They handed me a notice in 15 languages which
| said I was now permanently excluded from ever entering
| Hungary again ^_^
| reaperman wrote:
| USA will issue "anyone" 2-3 valid passports at the same
| time. This is designed for two reasons:
|
| 1) you travel a lot and sometimes may need to mail your
| passport off to get a pre-travel visa from some consulate,
| while you are still outside the USA. This way you can send
| off one passport to get the visa for your next country,
| while keeping a valid passport with you while you're
| abroad.
|
| 2) You need to travel between Israel and countries which
| have laws against visiting Israel (Historically, GCC
| countries). This way you can always present whichever
| passport doesn't have Israel's entry and exit stamps on it.
|
| I've had two valid US passports at the same time, and I'm
| just a random nobody American.
| pawelos wrote:
| Israel no longer gives you any visa stamps in passport.
|
| https://www.touristisrael.com/the-israeli-passport-
| stamp/974...
| 0xffff2 wrote:
| I visited Israel circa 2012 and this was true even then.
| pdntspa wrote:
| Wait, the police held your passport? Why?
| noduerme wrote:
| If you're an American and you rent an apartment, the local
| police keep your passport until you leave. You keep a
| xerox. That's how it was at the time. I don't know if
| that's still the case.
|
| I didn't feel good about it when I found out (actually, the
| moment I signed the lease), but there was nothing I could
| do about it.
|
| My exit from Vietnam was almost humorous. I had about 50
| DVDs in my suitcase, mostly encrypted backups and burned
| movies, and every single one was inspected _by sight_ ,
| holding it up to the light (to see how far the burn went?),
| then left on the floor of the airport for me to pick up.
| Upon re-entering the US, the customs officers did almost
| the same thing, and then just confiscated all my discs.
|
| Weirdly, no one on either side checked my laptop.
| wahnfrieden wrote:
| Police control residents, rather than provide for their
| safety
|
| Yes just like the US
| mjhay wrote:
| Ah, so just like the US then!
| sixothree wrote:
| Zip code depending of course.
| mjhay wrote:
| Good point.
| noduerme wrote:
| Actually, it's mostly down to how you address them.
| noduerme wrote:
| Police in America don't control residents. Most of the
| time they can't even control themselves.
| CamperBob2 wrote:
| _Police in America don 't control residents._
|
| How was your nap, Mr. Van Winkle? 2020 wasn't a great
| year in the US. You were better off spending it asleep,
| trust me.
| noduerme wrote:
| Don't flatter yourself. Nothing happened in 2020 that
| hasn't happened a lot worse, a lot more times before in
| America. If anything, the police were surprisingly
| ineffectual at protecting the owners' interests. I'll
| step out and burn a flag all day long in the street. They
| ain't gonna arrest me.
|
| I've seen the police publicly flog random people on the
| street in Vietnam just for being in their way. What a
| wonderfully just, equitable socialist paradise.
|
| Go check out and live in a country where the police
| actually control people and get back to me.
| wahnfrieden wrote:
| You chose a bad example
| https://www.politico.com/story/2016/07/gop-convention-
| flag-b...
|
| Btw all you've said is something about degree of control
| or tactics. Not relevant
| vkou wrote:
| They control unwanted residents, and unarmed[1]
| protesters.
|
| [1] They prefer not to fuck with the armed ones.
| guessmyname wrote:
| More context about this WikiPedia excerpt:
|
| - https://www.chinafile.com/extensive-surveillance-china
|
| -
| https://www.rfa.org/cantonese/news/student-01272020075256.ht...
|
| It looks like Zhou Yue Ming (Vera Yueming Zhou) was sent to a
| Chinese concentration camp mostly because she was part of a
| religious minority and not necessarily for using a VPN to
| access the University of Washington's website.
|
| > _Vera was living in her hometown of Kuytun (Kuitun) in Ili
| Prefecture, an area directly north of the Tian Shan mountains
| that borders Kazakhstan. She had been trapped there since 2017,
| when--in the middle of her junior year at the University of
| Washington, where I was an instructor--she had taken a spur-of-
| the-moment trip back home to see her boyfriend, a former
| elementary school classmate. Using digital surveillance tools,
| the Kuytun police had noticed that Vera had used a Virtual
| Private Network in order to access websites such as her
| university Gmail account. Given her status as a member of a
| Muslim minority group, this could be deemed a "sign of
| religious extremism."_
| nonethewiser wrote:
| Just tragic. Hard to imagine living in such a backwards place
| wahnfrieden wrote:
| [flagged]
| b59831 wrote:
| Same?
|
| So ICE will arrest you for a VPN?
|
| ICE runs concentration camps?
|
| This comparison is silly.
| stevofolife wrote:
| Thanks for this elaboration. Upon reading original comment,
| it felt very strange that she was "encamped" for using VPN to
| access her school homework. Immediately I knew there was more
| than it meets the eye.
| fnordpiglet wrote:
| It's subjective of course, but the real story seems worse.
| psychphysic wrote:
| The best bit is that we're enacting very similar laws in
| the West [0]. As much as China is often deplorable I do
| wonder how much of a blind spot we have here to our own
| sins.
|
| [0] https://news.ycombinator.com/item?id=36428046
| kjs3 wrote:
| That's the thing about "illegal but everyone does it"...it's
| nothing to worry about until the government decides it's
| convenient to enforce (against an individual or group), and
| then it's definitely something to worry about and it becomes
| a low barrier pretext for all sorts of oppression.
| esaym wrote:
| Encamped for your beliefs and not for breaking the law, that
| makes it much better!
| mannerheim wrote:
| It's cute how people are acting as if 'ordinary people' in
| China and foreigners don't have to worry about this. Guess
| what'll happen to you, Mr Leaf, if Canada arrests a Chinese
| executive and China wants a hostage? How convenient if
| there's already a crime they can prove that you've
| committed, too...
| KptMarchewa wrote:
| We can look at russia arresting random foreign nationals
| for bullshit reasons right now.
| jareklupinski wrote:
| https://www.nytimes.com/article/brittney-griner-
| russia.html
| thalassophobia wrote:
| She did commit a crime by travelling to Russia with an
| illegal substance, for which she got roughly the same
| sentence as a typical Russian would get if caught with a
| similar amount of drugs. This case doesn't seem to be out
| of the ordinary, except for the "criminal" being a famous
| foreigner.
| pindab0ter wrote:
| Can we not call that "cute"? That seems needlessly
| abrasive for people who are genuinely unaware.
| mannerheim wrote:
| Anyone who believes themselves exempt from the laws of a
| country they travel to because of a little booklet they
| carry isn't just unaware, they are foolish, and
| dangerously so because they not only endanger themselves,
| but everyone else they convince to adopt this attitude.
| Better they receive the scorn they deserve now then for
| them or anybody else to face the same consequences Griner
| or Warmbier faced.
| pessimizer wrote:
| Exactly. This is the period when Muslim ethnic groups like
| the Uigurs were being rounded up on any pretense to be
| reeducated into not wanting to be separatists anymore (often
| with no indication that they had anything to do with
| separatism other than their ethnicity.) Seeing the VPN pop up
| was more than enough of an excuse. Calling it a "genocide" is
| 99% propaganda, but it was obviously a sinofication meant to
| get rid of separatist identities and cultures, and a horrible
| injustice. In the beginning, they were inspired and immunized
| by the US's anti-Muslim fervor during the GWB invasions (we
| were not only not criticizing, but probably even sharing
| intelligence with China.)
| matchapples wrote:
| Why do you say it's 99% propaganda?
|
| "sinofication" sounds a lot like "eliminating the existing
| culture" which sounds a lot like genocide. Genocide is more
| than just murdering everyone like in some of the most well
| known cases like the Holocaust -- it includes elimination
| of an ethnic group by any means possible, including
| "nativification"
| ineptech wrote:
| I understand where you're coming from, but -cide implies
| killing.
| KptMarchewa wrote:
| Of a nation or ethnic group.
| ImPostingOnHN wrote:
| the "cide" in genocide refers to destroying
|
| for example, a cultural genocide refers to destroying
| culture, e.g. Uighur or Muslim culture
| woooooo wrote:
| Would you say the choice of the word "genocide" here is
| because it's the most accurate description of what's
| going on?
|
| Or is it chosen for rhetorical/propaganda effect without
| too much concern for accuracy?
| ImPostingOnHN wrote:
| Would you say the common, accurate usage of the term
| "cultural genocide" to refer to what the term refers to,
| is a bigger or smaller problem than the actual cultural
| genocide itself?
| mayormcmatt wrote:
| Not the person you're responding to, but it is an
| accurate description of genocide under its current
| meaning as defined by the UN (probably the most
| authoritative body on this kind of matter).
|
| https://www.un.org/en/genocideprevention/genocide.shtml
|
| What the Chinese are doing there is covered under Article
| II, c.
|
| If you are being pedantic by holding fast to the literal
| Greek translation of "geno" and "cide" then, well, this
| is simply not the complete modern meaning of the term.
| ineptech wrote:
| There is no authoritative body on the definitions of
| words. More generally, if genocide can mean "not
| killling, but very bad" then it is not much use except as
| an epithet - a negatively-loaded bomb to be lobbed in
| partisan debates at people who you think are doing
| something very bad. Virtually every controversial policy
| could be described as, "Causing serious bodily or mental
| harm to" some group.
| dirtyid wrote:
| The definition, US propaganda under Pompeo as head of
| State tried (and failed to meet), was UN's convention on
| genocide, which would trigger legal responses on member
| states. The TLDR is Pompeo laundered very tortured legal
| analysis through Zenz and some Gulanist Saudi think tank
| (IIRC) to try insinuate PRC met the definition when most
| credible international lawyers saw through the bullshit,
| but noted PRC actions closer to cultural genocide, which
| does NOT have definition at UN, and hence not
| prosecutable. The result is PRC actions merely labelled
| as potential human rights abuses at UN, aka business as
| usual, and a bunch of useful idiots who ate Pompeo's bait
| thinking PRC actually met the definition of genocide when
| it manifestly did not. And buy business as usual, of
| human rights abuses / cultural genocide, it puts PRC XJ
| actions in league with behaviours of the west. Hence you
| don't hear much about the XJ campaign anymore from
| western propaganda, because the propaganda was mostly
| useful if the genocide label stuck at UN, and made PRC
| actions more nefarious not equal to west. Now it's mostly
| used by US to justify XJ sanctions and trying to partners
| onboard to cripple XJ industry like solar, cotton,
| agriculture.
| dirtyid wrote:
| It's absolutely not. There's a reason US propaganda under
| Pompeo had to manufacture and launder reports with
| tortured legal interpretation to try to get the genocide
| label to stick but couldn't because there's no intent to
| destroy, hence useful idiots trying to be pedantic and
| argue how enforcing family planning reflect intention
| even though that applied to Han majority, or mass
| (temporary) internment / inflicting "pain" somehow
| equivalent to physical destruction while population
| continues to grow.
|
| Modern definition of genocide at UN explicitly wouldn't
| categorize what PRC is doing in XJ - cultural genocide -
| because members, especially west went out of their way to
| ensure cultural genocide would have little legal
| ramifications, otherwise Canada would have been
| sanctioned to death for self professed cultural genocide
| a few years ago. Incidentally the entire reason Pompeo
| tried to propagandize genocide label was because it would
| trigger diplomatic ramifications at UN. What the PRC is
| doing in XJ is cultural genocide, and bluntly that's
| permissible thanks to lobbying from the west.
|
| The entire manufactured genocide narrative is so retarded
| because if PRC wanted to, they could just... commit
| genocide. At PRC scale they can wipe out the 12M Uyghurs
| in a few weekends on the cheap instead of wasting
| trillions of RMB trying to sinicize them.
| woooooo wrote:
| That article IIc pivots on the key phrase "physical
| destruction".
|
| Look, internment isnt good either, why dig in your heels
| on the most loaded possible word?
| ImPostingOnHN wrote:
| physical destruction, internment, cultural genocide, they
| are all happening
|
| why not focus on that, rather than your personal,
| individual dislike of a term?
|
| why dig your heels in on the semantics of the thing,
| rather than the substance?
| last_responder wrote:
| " but -cide implies killing."
|
| Maybe to simple minded uneducated people. Others take the
| time to learn the actual definition.
| jxramos wrote:
| what?
|
| > cidium "act of killing," from caedere "to kill, to cut
| down" (from PIE root *kae-id- "to strike").
| https://www.etymonline.com/search?q=homocide
| https://www.etymonline.com/search?q=fratricide
| https://www.etymonline.com/search?q=suicide
|
| lots of others
| mistermann wrote:
| > Why do you say it's 99% propaganda?
|
| I suspect because of propaganda.
| l3mure wrote:
| > In the beginning, they were inspired and immunized by the
| US's anti-Muslim fervor during the GWB invasions (we were
| not only not criticizing, but probably even sharing
| intelligence with China.)
|
| Yeah, seems to be overlooked quite a lot since it's
| convenient for the US narrative lately.
|
| > Starting in 2002, the American government detained 22
| Uyghurs in the Guantanamo Bay detainment camp. The last 3
| Uyghur detainees, Yusef Abbas, Hajiakbar Abdulghupur and
| Saidullah Khalik, were released from Guantanamo on December
| 29, 2013, and later transferred to Slovakia.
|
| > None of the Uyghurs wanted to be returned to China. The
| United States declined to grant the Uyghurs political
| asylum, or to allow them parole, or even freedom on the
| Naval Base.
|
| > A May 2008 report by the Inspector General of the United
| States Department of Justice claimed that American military
| interrogators appeared to have collaborated with visiting
| Chinese officials at Guantanamo Bay to enact sleep
| deprivation of the Uyghur detainees.
|
| https://en.wikipedia.org/wiki/Uyghur_detainees_at_Guantanam
| o...
| Arn_Thor wrote:
| And for those who don't feel in legal jeopardy many VPNs are
| still being blocked and reconfigured in an endless arms race
| between the provider and the GFW
| FaultBit wrote:
| A lot of people actually use VPNs in China (since 2010 even),
| and some of them call it "Jia Su Qi " which basically means
| "booster" (for your internet). Some use it for lower latencies
| when playing foreign games. The issue is that VPN connections
| get easily blocked. We aren't really worried about legal
| issues.
|
| Except for that one time when police (of a certain district,
| not everywhere in China) knocked on people's doors to inspect
| their phones for VPNs during the "white paper protest" I
| believe.
| seanmcdirmid wrote:
| Surely Xinjiang has stricter rules and more aggressive
| enforcement than the other provinces/regions? They always put
| a hardliner in as party head.
| helen___keller wrote:
| When I was in China in 2019, the VPN built into google fi
| actually got me around the GFW with zero effort. I didn't even
| realize it until I caught myself checking American social media
| unhindered.
|
| My experience is most younger and tech savvy people have a VPN.
| It's common / casual, like speeding your car by 10mph on the
| highway.
|
| Most people are not persecuted for using a VPN, I assume that's
| reserved for people who the government already wanted to
| persecute and just need to give an excuse for why they detained
| their target.
| chanind wrote:
| The reverse is true as well. I traveled in India with a
| friend from China who used their Chinese sim card in India,
| and their data was censored through the firewall. Really
| annoying to be outside China and not able to use Google maps.
| computerfriend wrote:
| That's roaming, not a VPN.
| ktta wrote:
| Google Fi offers a VPN as well:
| https://support.google.com/fi/answer/9040000?hl=en
| ehhthing wrote:
| Assuming what you mean is over mobile data (and not over
| wifi), mobile data works differently than typical internet.
| You can think of it like when you connect to a mobile network
| what you're actually doing is making an IPsec connection to
| your carrier, with all data flowing over that IPsec
| connection. As such any carrier with a roaming agreement in
| China will bypass the GFW entirely -- and this is by design,
| Chinese carriers have to whitelist the APNs of western
| companies they do business with.
| qingcharles wrote:
| This is the same in Qatar, and probably in other Middle-East
| countries. Most of the residents use a VPN to get around the
| firewall, but I don't think anyone would be prosecuted for it
| unless the police wanted a nice easy reason to get you into
| custody.
| synergy20 wrote:
| That's because the GFW allowed it, GFW has no problems to
| block any VPN at will.
|
| GFW is sophisticated beyond imagination, one way to detect
| VPN traffic(or SSL, or SSH) is to observe its patterns and
| where the traffic is going. It's not too hard to have a
| blacklist of all VPN vendors too.
|
| shadowsocks was designed to bypass it(to make traffic looking
| random), I recall its developers were visited by cops and
| warned to stop doing that.
|
| It's said China built the largest LAN on earth, the
| government is just too scared by its people to get educated,
| it's a true parallel universe.
| pantalaimon wrote:
| I think China doesn't care if foreigners use a VPN, it's
| their own people they want to keep under control.
| balder1991 wrote:
| I keep contact with a girl in China and from her reports
| using VPNs is kinda common for young people with college
| education. She would do it sometimes to access YouTube, and
| would laugh it off when I would say she should be careful
| doing such things.
|
| I suppose for the government, as long as it isn't the
| majority of people doing something that would cause
| trouble, it isn't worth tracking down all things, as
| expected.
| mrguyorama wrote:
| This is intentional; "Oh it's not authoritarian/bad,
| people use VPNs all the time and get away with it".
|
| Except for that muslim chick another commenter pointed
| out, or anyone else the party decides is undesirable.
| mannerheim wrote:
| Just be prepared to spend a year or two in prison if
| relations between your country and China worsen and they
| need a hostage.
| [deleted]
| thaumasiotes wrote:
| > The use of VPNs in China can provide individuals access to
| the international internet, but in China, it can be a potential
| legal risk. In 2017, the Chinese government declared all
| unauthorized VPN services to be illegal. An example of the use
| of this punishment is Vera Zhou, a student at the University of
| Washington, who, when visiting her Hui parents in Xinjiang,
| China, used a VPN to access her school homework. She was
| arrested and sent to a Xinjiang internment camp from October
| 2017 until March 2018, followed by house arrest after her
| release. She was not able to return to the US until September
| 2019.
|
| Use of VPNs is... universal... among middle-to-upper-class
| Chinese. This is obviously not an example of legal risk
| associated with _using a VPN_. Rather, it 's an example of a
| punishment coming down on someone who was targeted for other
| reasons.
|
| An immediate implication is that, if you repealed all the laws
| against VPNs, nothing about anything would change.
| beebmam wrote:
| Deeply unethical stuff. Why are Chinese people not currently
| trying to overthrow this garbage?
| edvards wrote:
| Pragmatism, I suppose. The country does well enough
| economically for people to accept it, not to mention they're
| used to it all already.
| mrguyorama wrote:
| Because "Everybody does it and gets away with it", as seen in
| this very comment section, so it doesn't actually put much
| pressure on the public as far as they are concerned.
|
| Also, "it's done for social harmony"; Very few places are as
| dogmatically hostile towards social good as the US, and are
| willing to make individual liberty sacrifices so that everyone
| may be better off. Arguably this is the same rhetoric or
| philosophy as the "Thin blue line" American cops love.
|
| Also, your average chinese person just doesn't care to see
| english language media that much. They have diverse (to them)
| opinions and culture on their homegrown social media systems,
| and don't feel a need to leave the walled garden of Chinese
| internet much in the same way most westerners do not feel the
| need to join Russia's social media apps.
|
| Also, the CCP "brought millions out of poverty" within living
| memory. Many people there feel that justifies a hell of a lot
| of vaguely "bad" actions, or makes it way easier to rationalize
| things.
| gruez wrote:
| The threat of you and your family members getting sent to a
| labor camp is a good incentive.
| j-a-a-p wrote:
| With Youtube blocked, the Chinese are not being bombarded with
| VPN advertisements
| jiggywiggy wrote:
| Yeah already 10-12 years ago was clear.
|
| My university vpn only worked for a few days while studying in
| China.
|
| But there is this tiny little vpn software being spread around.
| Not sure if it's true but I remember it's falun gong teaming up
| with the CIA. Which at the time was able to go undetected, I
| think they keep rotating the IPS or something.
|
| Was interesting how fast that tool spread "offline" between
| international students. Also Chinese have it but its less known
| among them.
|
| Not sure if it still
| works:https://en.m.wikipedia.org/wiki/Freegate
|
| [Edit] Here is an old hn comment saying it doesn't work anymore
| and other options that are also hard;
|
| https://news.ycombinator.com/item?id=10101965
| LT_SPA wrote:
| Nearly the same experience with my campus life.
| cynicalsecurity wrote:
| Can you bring a Starlink and then just don't really care?
| hughesjj wrote:
| Nope. Starlink shuts down over china on the satellite side.
| Tesla has a huge presence there and they also threatened to
| shoot the satellites down (which they've done before) if
| starlink provided internet access there
| reaperman wrote:
| To clarify for readers: China has never shot down someone
| else's satellite. They've only destroyed one satellite ever
| and it was their own.
| red-iron-pine wrote:
| and creating a ton of space debris in the process. oups
| RocketMan9999 wrote:
| Maybe you can, but the Chinese "VPN law" used some wording like
| "unauthorized communication channels" without further
| definition. They can just call Starlinks "unauthorized" and
| start confiscating them, just like what they did to the
| satellite dishes for receiving foreign TV signals.
| ck2 wrote:
| How long do you figure until the first public execution for using
| starlink?
|
| And yet we can never cut them off because it would be economic
| suicide.
| maldev wrote:
| This paper is nice, but it goes over some finer technical things.
| So, not about the great wall, but there's projects out there,
| like this one https://github.com/salesforce/ja3 , which talk
| about how you can fingerprint fully encrypted traffic(TLS/HTPS).
| There's a great section in the Readme "How it works" that goes
| over it. Would be surprising if the great wall doesn't do this,
| when some open source firewall will.
| supriyo-biswas wrote:
| Chrome randomizes the ClientHello these days[1], so JA3 is
| obsolete in that sense. You could still build a fingerprint off
| of the common advertised TLS parameters, disregarding their
| order. The linked paper references an incident where the list
| of ciphersuites were used to detect Tor-obfs connections[2][3].
|
| [1] https://www.fastly.com/blog/a-first-look-at-chromes-tls-
| clie...
|
| [2] https://gitlab.torproject.org/legacy/trac/-/issues/4744
|
| [3] https://blog.torproject.org/ethiopia-introduces-deep-
| packet-...
| [deleted]
| mensetmanusman wrote:
| China doesn't realize how much they are being held back by
| meaningless investments of time and expertise on this. They spend
| almost the same %GDP as the US does on the US military as on
| their internal suppression forces.
|
| Maybe it's good for the world that they burn so much talent and
| wealth on adding inefficiency to their internal information
| exchange.
| Herring wrote:
| I wouldn't be so sure that it's a bad idea. Look how social
| media has damaged democracy around the world. US democracy is
| stuck in a bit of a death spiral -
| https://www.theatlantic.com/ideas/archive/2021/04/how-
| stop-m.... I hate repression, but they've been at it for
| thousands of years and I'm no longer super confident we have
| something better (see citizens united, roe v wade, affirmative
| action). China's life expectancy just beat the US.
| ed25519FUUU wrote:
| Free speech causing problems for the USA yet again?
| Herring wrote:
| I'd say the issue is "factionalism" as the US founding
| fathers identified it. Some group (elites, landlords,
| corporations, white people, etc) is looking out only for
| themselves at the expense of society in general. East Asian
| countries love enforcing their conformity and harmony.
| nonethewiser wrote:
| You outed your poor judgement with the endorsement of racist
| admissions practices.
| nirimda wrote:
| The US doesn't have a minority rule death spiral because of
| social media, it has a minority rule cycle because the
| constitution literally entrenches minority rule via
| mechanisms like senatorial malapportionment, supermajorities,
| the electoral college and judicial review of policy (see
| citizens united, roe v wade, affirmative action) rather than
| merely procedure. It has experienced this before, sometimes
| devolving into outright civil war, without actually reaching
| death.
|
| The technologies for resolving America's problems are well
| understood - majority decision making, parliamentarism,
| representation and participation of electoral minorities
| rather than inhibiting the work of the majority, a narrower
| scope of judicial review and/or a more flexible constitution.
| But as long as people say, as you do, "it isn't the thing
| that caused the problem that is the problem, it is some fancy
| gadget that is the problem", then you will be unable to solve
| the problems
| pessimizer wrote:
| > It has experienced this before, sometimes devolving into
| outright civil war, without actually reaching death.
|
| That's not really enough to establish a pattern, though.
| People in China have furniture older than the United
| States.
|
| > But as long as people say, as you do, "it isn't the thing
| that caused the problem that is the problem, it is some
| fancy gadget that is the problem", then you will be unable
| to solve the problems
|
| This is victim blaming. US citizens get no say in
| governance:
|
| _" Testing Theories of American Politics: Elites, Interest
| Groups, and Average Citizens"_
|
| https://www.cambridge.org/core/journals/perspectives-on-
| poli...
| dirtyid wrote:
| PRC centralized narrative setting apparatus is more efficient
| than constant misinformation shitshow on western platforms. Not
| to mention the entire reason why PRC has domestic info
| ecosystem is because they were prescient in filtering external
| content. The system already paid for itself many times over.
|
| >They spend almost the same %GDP as the US does on the US
| military as on their internal suppression forces.
|
| It's almost as if PRC doesn't spend that much %GDP on military.
| The waste is PRC spending as much as US on domestic policing,
| which is not great considering how militarized US policing is.
| Meanwhile PRC simply doesn't spend that much on defense <2% vs
| US ~3.5%, if you include guestimates of shadow budgets, 3% vs
| 6%.
| jcarrano wrote:
| It is not the goal of the CCP to advance China as it is to keep
| themselves in power.
| H8crilA wrote:
| I would disagree. The leading organization is much more
| aligned with the needs of the nation than the likes of Iran
| or Russia, which probably wouldn't mind bombing the shit out
| of their own city if it was necessary to stay in power.
|
| For example they actually bow to American pressure and try to
| avoid sanctions or other trade problems. As of today their
| navy could be completely destroyed with like 30% of the US
| Navy, so any naval blockade is probably unbreakable for them.
| Iran's hunta would (and did) just say "whatever" and
| continued tanking the GDP.
|
| Another example - the Chinese intelligence helps domestic
| industries, even those that are far from the defense
| business.
| nonethewiser wrote:
| > which probably wouldn't mind bombing the shit out of
| their own city if it was necessary to stay in power
|
| See the Tiananmen Square Massacre.
| H8crilA wrote:
| Bombing a city can result in tens to hundreds of
| thousands of casualties.
| pessimizer wrote:
| You have to have a sense of proportion on this, and an
| example that isn't 30 years old.
| mensetmanusman wrote:
| They fear bomb their own cities though (using drones!):
|
| Shanghai Residents Told to 'Control Your Thirst for
| Freedom' Amid Lockdown
|
| https://www.newsweek.com/shanghai-residents-told-control-
| you...
| throwaway290 wrote:
| I didn't downvote you but if a government
|
| - offers no way of replacing itself democratically
|
| - extends own term indefinitely
|
| - blocks free exchange of information
|
| - censors specific speech that shows its failures or desire
| of people to replace it
|
| - suppresses internal protests with murders and
| disappearings of people (1989 Tiananmen, 2019+ Hong Kong,
| blank paper movement, ...)
|
| etc then it's super clear its primary goal is maintaining
| power.
|
| Sure, it cannot maintain power without at least seeming to
| be "aligned with nation". But it takes second place to
| maintaining power.
| justincredible wrote:
| [dead]
| pessimizer wrote:
| There's probably more disagreement within the Chinese
| government than between the two dominant parties of each
| of the western powers.
| red-iron-pine wrote:
| Perhaps, but you wouldn't know it, and the results sure
| aren't felt domestically or internationally.
| pdntspa wrote:
| You have to keep the poeple happy enough, not even China
| could withstand the full force of their own people rising
| up against them.
|
| So, on the surface, you appear aligned with growth and
| advancement and all that.
|
| But under the surface, the system is about control, and
| only control.
| bitwize wrote:
| Get used to it; we will soon be a part of China's "community of
| common destiny".
| nonethewiser wrote:
| I wouldn't say that. But Western countries would absolutely
| replicate the surveillance and censorship if they could. And
| they do in some ways, but there are many structural things
| stopping them.
| m-p-3 wrote:
| They let the private sector do it for them instead.
| mdhb wrote:
| Limited use cases but for moving info in and out of a system like
| this you should be able to use this
| https://en.m.wikipedia.org/wiki/Chaffing_and_winnowing
| noman-land wrote:
| This is a really cool idea. Thanks for sharing.
| JPLeRouzic wrote:
| The algorithm found seems so unintuitive that I wonder if it was
| not found by the AI.
|
| " _Allow a connection to continue if the first TCP payload (pkt)
| sent by the client satisfies any of the following exemptions:
|
| Ex1: popcount(pkt) len(pkt) <= 3.4 or popcount(pkt) len(pkt) >=
| 4.6.
|
| Ex2: The first six (or more) bytes of pkt are [0x20,0x7e].
|
| Ex3: More than 50% of pkt's bytes are [0x20,0x7e].
|
| Ex4: More than 20 contiguous bytes of pkt are [0x20,0x7e].
|
| Ex5: It matches the protocol fingerprint for TLS or HTTP.
|
| Block if none of the above hold._"
| vbezhenar wrote:
| This is just some experimentation results, it's not algorithm.
| amrocha wrote:
| An algorithm is just a bunch of rules to follow to perform an
| operation, so this looks like an algorithm to me.
| netheril96 wrote:
| You misunderstood your parent comment. What he/she meant is
| that the "algorithm" is only a guess from reverse
| engineering. The actual algorithm deployed at GFW can look
| significantly different.
| colanderman wrote:
| Ex1 is just excepting low-entropy packets (distribution of 1s
| and 0s tends toward the mean for high-entropy data). Encrypted
| data presents as high-entropy. This is a crude method (errs on
| the side of not excepting) but is very efficient for embedded
| hardware to compute.
|
| Ex2-4 are just excepting ASCII text, which is used by many
| unencrypted protocols (e.g. IMAP), but which are high enough
| entropy that they statistically will fail the first test often.
|
| Ex5 is necessary because TLS is high-entropy (by nature of
| being encrypted). HTTP is also excepted presumably so e.g.
| compressed uploads (e.g. images/video) aren't flagged.
|
| That "low entropy" is the key to bypassing the GFW isn't
| surprising at all -- high entropy is all but a necessary
| feature of most cryptography schemes. (I say "all but" because
| -- encryption isn't adding information, so unless you compress
| before you encrypt, it's possible for a (hypothetical)
| encryption scheme to preserve entropy, according to several
| objective metrics. I don't know of any that do this, beside the
| meta scheme of compression before encrypting, followed by
| steganographically padding the encrypted data afterward. This
| of course leaks some information through the encryption --
| equal to the negentropy of the message -- but it would
| typically be information that can't be gleaned from context,
| e.g. that the message is HTML+text.)
|
| So... base64-encode your TLS?
| tgv wrote:
| Looks more like it was found using random forests.
| H8crilA wrote:
| Lol you guys never worked with real data :D
|
| There's at least 1'000 such algorithms at each google-like
| company.
| reaperman wrote:
| > I wonder if it was not found by the AI.
|
| Do you mean "found" by the CCP, or "found" by the researchers?
| In the case of the CCP it was likely generated through basic
| statistical analysis, and tuned to minimize side effects and
| collateral damage below some threshold of acceptability (~0.6%
| of global traffic unintentionally blocked). In the case of the
| researchers, the paper details the basic statistical analysis
| used to discover these rules.
| H8crilA wrote:
| It's extremely intuitive. You're trying to filter unusual,
| encrypted traffic.
|
| First rule exploits the IND-CPA property of most encryption.
| You want to kill traffic that has about 4 bits set to 1 per
| byte, i.e. traffic that "looks random".
|
| The following rules are exemptions for permissible encrypted or
| compressed traffic (note that compression, while not IND-CPA,
| results in high entropy and thus will trigger the first rule).
|
| This could work very well, which is confirmed by the
| researchers in this paper.
| JPLeRouzic wrote:
| Thanks for the information, it is very interesting.
| nerdbert wrote:
| Cool, I'll just base32 my encrypted traffic and sail through!
| delfinom wrote:
| That looks hilariously easy to defeat though it will require
| introducing "0x20,0x7e" padding to protocols heh.
| GartzenDeHaes wrote:
| > 1 security vendor flagged this URL as malicious
|
| https://www.virustotal.com/gui/url/f530591ff939e09c1cf8bc534...
| seanmcdirmid wrote:
| I mentioned this a few years ago (maybe 7-8 years ago) on HN when
| I was told everyone just uses a VPN. Even back then, the cat and
| mouse game was annoying. You would purchase a VPN (plenty
| offered), pay a year subscription, and then it would go dark a
| couple of weeks later (sort of like a membership at a gym that
| closes down a week after you renew a year subscription). I gave
| up quickly on outside access, though we had a line out at work so
| it wasn't that bad.
| __sy__ wrote:
| I've done so much experimentation with GFW pre pandemic while
| staying in China for extended period of times. I was always
| amazed at how quickly they would catch up on my shadowsocks,
| random ssh tunnels...etc. 48 hours top before I had to rotate
| IPs. This report seems to indicate this is now instant?
|
| Fwiw My most reliable trick ended up piggie-backing off of a
| physical line going into Hong Kong from Shenzhen, and when
| roaming around China, using a vpn to get to that shenzhen
| gateway. As far as I can recall, that always worked. This led me
| to believe that most of the vpn traffic analysis (and
| blocking)was done at the edge of the GFW and not inside of it.
| Again, this could be outdated by now.
| ehhthing wrote:
| GFW only looks at connections with destination IPs outside of
| China, the private fibre line bypasses it entirely.
| traceroute66 wrote:
| > the private fibre line bypasses it entirely
|
| Well, I'm sure the Chinese are tapping it. ;-)
|
| Its more that they are just not actively acting on the
| content.
| ethbr0 wrote:
| Not much use tapping encrypted packets, which is why it
| terminates connections when able.
| EGreg wrote:
| Why don't they just detect and block all VPNs? In Dubai, that's
| what seemed to be happening
| jszymborski wrote:
| I wonder if the whole tor obsf4 and snowflake business works
| with the GFW.
| rfoo wrote:
| Yes but they are unfortunately targeted more than other
| censorship circumvention tools. Since everyone knows
| Tor/Obfs4/Snowflake it's easier to get your research
| published if you work on detecting that.
| gruez wrote:
| There's a more straightforward way: roam with a foreign sim
| card. Roaming traffic is tunneled to your home telco and for
| whatever reason the tunnel isn't inspected at all. With the
| advent of esims you can buy a roaming sim and use it on your
| phone within minutes.
| Roark66 wrote:
| Can you activate it while abroad though? After I moved away
| from the UK I still had to have a UK mobile phone for various
| things. My UK sim would stop working after about a year away.
| When buying a new one I had to get someone in UK to put it in
| their phone to let it at least once connect to the home
| network. Without it the card would be useless. Is using
| foreign sim cards now easier?
| gruez wrote:
| There are esims explicitly targeted to travelers. Those are
| the ones you want. In my experience they don't have any
| activation restrictions like the ones you describe
| kotaKat wrote:
| eSIMs just need a data connection back to the SM-DP server
| and that can be done over Wi-Fi. I don't _think_ that
| protocol is blocked that they talk to it, and the SM-DP
| vendors on the market are typically "global" providers
| that work with multiple operators.
|
| EDIT: I checked myself to be sure. It's "RAM over HTTP(s)"
| -- "Remote Application Management" of the eSIM. GFW doesn't
| block HTTPS, so you should be able to get provisioned to
| any carrier worldwide while inside the firewall.
|
| https://www.sharetechnote.com/html/Handbook_LTE_eSIM.html
| narism wrote:
| MS and other vendors recommend doing something similar
| (connecting via Hong Kong): https://learn.microsoft.com/en-
| us/azure/virtual-wan/intercon...
| gaoshan wrote:
| Many years back I was running a socks proxy for access while in
| China and I found that it worked great in Shanghai but was
| rapidly blocked (or degraded in some fashion) in Hangzhou. That
| seemed internal and not edge but I do no really know how they
| were interfering with it. Given Hangzhou's tech expertise it
| just may be the ISP there was more capable and up to date?
| kccqzy wrote:
| Was there an international event in Shanghai at that time? If
| they expected a large number of foreigners in a particular
| region they would relax the censorship in that particular
| region. They could even do it per hotel room where hotel
| rooms booked by foreigners automatically have lesser
| interference between GFW.
| gaoshan wrote:
| That might be it. I was there every year for about a 15
| year period but this may have been around the time of the
| 2010 Expo. Though I was not in hotels, I was in apartments
| (ones owned and lived in by Chinese, not foreigners).
| apatheticonion wrote:
| I tried to setup a shadowsocks server to bypass the GFW about 2
| weeks ago. Server was hosted on my local network in Australia
| (with public IP), client was connecting from China (using the
| server IP).
|
| It was blocked immediately and the client could not connect. I
| had several unknown IPs try to connect prior to the attempted
| connection.
|
| I was stunned at how water tight the GFW is, it's really
| unfortunate as I would love to work/travel through China but
| cannot due to needing an active internet connection.
| m-p-3 wrote:
| I run https://snowflake.torproject.org/ in my browser as my
| way to help.
| __sy__ wrote:
| Yeah pdf of report says that blocking is instant as of 2021.
| Also completely agree with the need for an active connection
| to do work. A lot of the software/hacker devs I knew have
| left China all together in the last 3-4 years. Inability to
| look up stuff reliably (even on working VPN providers) was
| one of the reasons cited by a few.
| Grimburger wrote:
| That's a massive shame because shadowsocks has been the only
| real reliable method for a long time.
|
| I used it successfully when I was in mainland China while
| VPN's, even the ones boasting they could get through the GFW
| were all hit or miss.
| throw_19cn1k3 wrote:
| A fellow Aussie currently in China, a Trojan [0] server has
| been working fine for the last week I've been here. I've got
| it hosted through a VPS (smaller provider) in LA. While it's
| a bit of a pain to setup, reliability has been pretty decent
| (with occasional? short breaks) and definitely useable - my
| laptop is connected 24/7 and I can access the unfiltered web,
| including video, just fine. V2ray also supposedly works quite
| well, but I haven't looked into it.
|
| [0] https://github.com/trojan-gfw/trojan
| fundatus wrote:
| Last time I went to China (2018) you could simply get a China
| Unicom Hong Kong SIM card and then use that to roam in
| mainland China. With that you'd get the Hong Kong censorship
| level, which is much much less restrictive. No VPN or
| anything needed apart from the SIM card itself.
| hutzlibu wrote:
| "you'd get the Hong Kong censorship level, which is much
| much less restrictive."
|
| Didn't that changed since 2018?
| emaro wrote:
| I'm in China right know with a Mainland/Macao/HK eSIM. My
| Chinese friend has to use a VPN to access Instagram as
| did I when I was connected via WiFi in mainland China.
| Using the eSIM connection I could access Instagram and
| Youtube without any issues, likewise here in Hongkong
| (with WiFi).
|
| I didn't investigate how large the difference is, but
| Hongkong traffic is still treated more liberal.
| monetus wrote:
| It was really sad seeing all the bookstores close.
| kurtoid wrote:
| They say UDP is never blocked, so would Wireguard work?
| userbinator wrote:
| As a result of such blocking, I suspect steganographic techniques
| are only going to become more popular over time.
___________________________________________________________________
(page generated 2023-06-30 23:03 UTC)