Hacker News Reader

> VPN software is simple

Can someone explain why VPN software is "simple"? I thought it encrypted your data so they cannot be inspected, plus if you tunnel over the HTTP/HTTPS ports how can VPN traffic be separated out from "regular" traffic?

View on HN

Because to establish the tunnel, you need to send some "handshake" packets to the server. Those packets are not encrypted and can be easily identified and dropped.

Which is why `shadowsocks` has become popular to bypass the GFW: it has no such handshake phase and hence cannot be easily identified.

...and when GFW has trouble stopping `shadowsocks`, it threatens the author of the software. GFW is not only the technology, which is easy to bypass, but also the system that average citizen cannot escape.

>if you tunnel over the HTTP/HTTPS ports how can VPN traffic be separated out from "regular" traffic? it can't. that's why openvpn doesn't work in China but openvpn tunneled over stunnel (TLS proxy for arbitrary TCP streams) does.

Reply on news.ycombinator.com