Hacker News Reader

Comment by erikj | Hacker News Reader

I don't think it's possible to reliably enforce this ban.

I don't think anyone in Russia expects it to be enforced reliably. But this law can be (and will be) enforced selectively against an opposition.

It can be enforced reliably enough to make it too hard for most people to keep circumventing censorship. Even with only current capabilities they can gather metadata on everyone's internet usage and see into a bit of data if needed, which is enough to statistically detect most attempts to hide traffic in something else.

I don't even think it should be enforced much at all. Quite the opposite. If almost everybody does it you can charge your opposition at will.

It doesn't need to be enforced reliably. It just needs to be reliable enough that your average person who might want to access one of the blocked resources doesn't manage to do so after spending a couple of hours trying the popular VPNs and such, and gives up because it's not worth the effort.

We need something that tunnels over HTTPS/Websockets, and utilizes domain fronting [1] with e.g. Google Cloud or Azure. Ideally it'd also work over WebRTC in unreliable mode, but I'm not sure that works with domain fronting.

[1] https://bamsoftware.com/papers/fronting/

// edit: why the downvotes?

> We need something that tunnels over HTTPS/Websockets, and utilizes domain fronting [1] with e.g. Google Cloud or Azure. Ideally it'd also work over WebRTC in unreliable mode, but I'm not sure that works with domain fronting.

The Tor Browser already comes with the meek transport[1] that uses domain fronting, one with Amazon and the other with Azure. There's also a recent PT titled snowflake[2], that uses WebRTC to connect to short lived proxies that people can make by just running some JS code in their browser, it's currently available in the alpha builds for Linux and Mac.

Note that meek is expensive, and the Tor Project pays for each byte. It should only be used when no other PT works.

[1] : https://trac.torproject.org/projects/tor/wiki/doc/meek

[2] : https://trac.torproject.org/projects/tor/wiki/doc/Snowflake

The problem is that any website that allows domain fronting is itself illegal under this new law, and can be blocked on those grounds.

The idea of domain fronting though is that the fronting website is "expensive" to block that the censor won't do it.

As with everything else, this isn't a 100% technical solution, it has a political component of how expensive the fronting website is to block.

Many users in Russia use russian social network (Vkontakte), russian email services and russian search engine (Yandex). There is also popular dating service (Badoo). So Google and Facebook can be blocked without causing much trouble. But there is no good replacement for Youtube and Android Store (yet).

Ah nice, I didn't know meek does domain fronting too, and thanks for mentioning snowflake.

One more idea to add to this (that sits on top of the idea that the distributed internet heals itself from attacks) would be to make it super simple for every HTTPS site to donate a portion of its bandwidth to defeating censorship. Imagine a world where VPN traffic was indistinguishable from a normal browsing session.

Openvpn over stunnel can somewhat already do this, albeit at a performance hit.

The idea is to make it hard for average person to use it - problem solved. Most likely will ban commercial vpn providers that refuse to implement blocklist for users from Russia.

If you are able to set up a personal openvpn server, they wont bother hunting you down.

China blocks even private VPNs.

Reply on news.ycombinator.com