Hacker News Reader

Comment by greggman | Hacker News Reader

not being a network guru how easy is this? I have my VPN set to run over port 443 but I assume it would be easy to see enough of the traffic to see it's a VPN and not an HTTPS connection. I'm assuming that could be obscured in some way but then I've heard even if you can't see the contents you can generally tell it's not HTTPS by looking at the traffic patterns?

View on HN

Yes, deep packet inspection with ML, read for example here [1]

[1] http://blog.zorinaq.com/my-experience-with-the-great-firewal...

DPS will give you nice and beautifully encrypted payloads. Now what?

Emulating a standard browser TLS handshake is a no-brainer.

The Great Firewall blocks these no problem, not sure if you realize the scale of who and what you are dealing with.

There are enough side channels leaked trying to proxy an Internet connection through an encrypted tunnel, this is picked up on through Machine Learning or otherwise and it pretty effectively blocks many forms of escape. Read the parent article, let it soak in, and come back.

And from TFA, it looks like whatever China can't block through technology, they are blocking through politics.

The handshake is only one of the many giveaways of a VPN connection. A single HTTPS connection has a certain normal pattern of traffic that is very different from a VPN connection. VPN connections often persist, with bursts of activity as pages are loaded. Even if you repeatedly put up and tear down the VPN connection, you're exchanging large amounts of traffic with a single IP address, which is not typical of normal web browsing behavior. If you can see all of the traffic going in and out of China, you can easily tell which IP addresses and/or ranges host VPN servers. There are many, many features which you can put into an ML model that will identify users that are using VPNs just based on IP headers. Will it block 100% with no false positives? No. However, they can simply set the penalty to be not being able to connect to outside-China IP addresses for half an hour if they detect VPN usage. After tripping this a certain number of times, you get a letter, and then eventually someone pays you a visit. If for some reason this doesn't work, they'll just require everyone to install their MITM root certificate to use the internet like lots of corporations do.

Will some people find ways around it? Yes. However, it will be risky, and if any given technique becomes widespread, they will find a way to block it.

There are lots of corporate VPNs and RPCs. Blocking of these will result in a disaster. So, just mimic, say, one of hundreds Microsoft Windows 10 user data collecting services.

AWS traffic also never will be blocked.

Notice that a selective blocking is not the same as real-time https inspection and filtering, which is an intractable task.

http://ipop-project.org/

You can make it more difficult, but short of actually disconnecting China's network from the rest of the Internet entirely I don't think there's any way to completely prevent it.

I had a run-in with a particularly aggressive captive portal last week that kept injecting ads into unencrypted pages (if I'm traveling on one of your vehicles, I don't want to buy tickets to travel with you), but fortunately didn't firewall outgoing port 22 so I could use sshuttle to route 0.0.0.0/0 via an SSH connection to my personal server. This works with pretty much any server you can run Python on, so I don't know of a good way to stop it unless you're willing to block anyone from SSHing outside of the country (thus preventing e. g. Chinese companies with a global market from running servers in other countries).

China could simply require business that use ssh to register and/or ssh through one of their firewall servers.

ssh sessions reveal enough that an interactive session, a file transfer (scp), and sshuttle routing someone web browsing look quite different from one another. Sure, you can multiplex and throw in extra traffic, but it's not trivial.

They do block SSH at random. Having it on port other than 22 helps some times.

Reply on news.ycombinator.com