Hacker News Reader

Comment by Basic_Treat | Hacker News Reader

Is there an easy to follow guide for how to setup a censorship resistant internet toolkit for those of us in HK to prepare? Especially for mobile phones/devices.

View on HN

Yeah, at this point probably any plan start with getting a plane ticket and getting out of there if you really want to be prepared. :/

In my experience nothing really works, because the Chinese firewall is more like a whitelist than what it used to be.

OpenVPN over WebSocket proxy works, sometimes. Some commercial VPNs work up to a point, but expect very low bandwidth and frequent annoying disconnects.

You can get a direct line in the mainland from China telecom unfiltered by the firewall if you are a big enough company (foreign or otherwise). It is about the only reliable way of jumping the wall.

A lot of hotels in GZ have internet through HK for some odd reason I can’t fathom, it was nice browsing Facebook in my hotel room without a VPN.

Sure, you can, but that's not censorship resistant either, after all they know who you are.

Plus even just to get a SIM card you need passport/id. So to be able to speak freely some kind of secure anonymization layer is needed.

Outline VPN, by Jigsaw (a Google/Alphabet subsidiary), is an open source tool that allows you to set up and manage Shadowsocks VPN servers with very little effort. There are clients for Android, iOS, Windows, macOS, Linux. It's designed for organizations, but is also easy for individuals to use. Configuration is automatic.

https://getoutline.org

Outline integrates with DigitalOcean (easiest to use), Google Cloud, and Amazon Web Services. It also works with any other Linux server host.

Shadowsocks is resistant to the detection methods used by the Great Firewall, but has been steadily declining in effectiveness according to user reports on GitHub. It's still much better than OpenVPN, which reportedly gets interrupted frequently.

If you want a more comprehensive solution, you can also use the Streisand tool to set up a variety of VPN protocols, including OpenConnect, Shadowsocks, and WireGuard. On Streisand, Shadowsocks can be equipped with the V2ray plugin to help evade detection.

https://github.com/StreisandEffect/streisand

Streisand's setup process is slower and less reliable than Outline VPN's. There's no management console here, just a shell script (using Ansible) to deploy the services to a server. You are given instructions for manually setting up third-party client software (also open source) after the server deployment is complete.

The hardest part about such a toolkit is how do you know it is undetectable. Its quite easy to see when you have managed to bypass filters but what if the government has still detected the bypass and has put you on a list for illegal activity. Or what if they work out how to detect it in the future and go back through the logs to find all the people who used it.

I think this is a problem that needs a political solution, not a technical one. The protesting in HK is probably the best way to go about this.

This risk is generally exaggerated. Every once in awhile someone is fined for using a VPN or circumvention tool. Even that is rare, however, and the consequences are relatively benign.

The practice is also so common that it would likely be impractical to make the penalty more severe.

Full disclosure: I work on Lantern at https://www.getlantern.org.

That said, you should just use Lantern. Recently international links out of China are insanely unreliable, but we’re continuing to improve it. There are hiccups, but it works.

Your mobile site is messing with my back button.

As a Hongkonger, can I ask what's the best technology for:

1. Censorship-resistant chat: Something DHT-based preferrably, I am looking at Status.im right now

2. Mesh Internet over the air, something like DN42 but over wireless links

Reply on news.ycombinator.com