Hacker News Reader

Comment by EGreg | Hacker News Reader

How does the blocking actually happen?

What if people used a decentralized service, that worked over https?

All traffic to/from some IP addresses is blocked, additionally all Chinese DNS servers respond with random A records when the domain name is banned, for example:

  $ host facebook.com 202.97.0.6
  facebook.com            A       8.7.198.45
  $ host facebook.com 202.97.0.6
  facebook.com            A       243.185.187.39
  $ host facebook.com 202.97.0.6
  facebook.com            A       243.185.187.39
  $ host facebook.com 202.97.0.6
  facebook.com            A       46.82.174.68
  $ host facebook.com 202.97.0.6
  facebook.com            A       59.24.3.173

(202.97.0.6 is an open resolver in China)

So you can get around the block if you use 8.8.8.8 for DNS?

No you can't, you will still get a connection reset error

> additionally all Chinese DNS servers respond with random A records when the domain name is banned

Which DOS'd one of my server when the random IP they picked was mine. Grr.

Had to add a special rule to deal with it.

>What if people used a decentralized service, that worked over https?

that sounds great until you realize that most people don't run tls servers on their computers/phones. so running one would immediately raise suspicion. not to mention that if they can block tor/vpn, they can block whatever tls chat service you have as well.

Why is running a webserver going to arouse suspicion?

Furthermore, with https authentication, non members wouldn't even know that a chat is going on.

Traffic analysis will tell you that something far from the norm is going on. You don't need to be able to read packets to recognize that the pattern is all wrong for an HTTPS website session. And it's not ordinary for a client machine or network to be listening for TLS sessions on port 443 in the first place.

in the beginning of September a chinese guy was arrested for selling VPN software. you can try ways to bypass the great firewall, but it is against the law to do that, and in China it is a good idea to follow the law.

http://thehackernews.com/2017/09/china-vpn-great-firewall.ht...

The mechanism of blocking is the Internet firewall with deep packet inspection and protocol sniffing, together with lots of human intervention and tracking.

What if a common enough encrypted protocol is used to carry all communication, such as https TLS protocols?

It's not a technology problem. Be aware that human operators are hired specifically for correlating internet traffic with these kinds of evasions. In the end, unless it's a robot talking to another robot, all internet traffic in China can be resolved to people. And people can be arrested or jailed or killed.

Of course, if you want to "go tech" you can go underground, but being illegal has disadvantages in a state like china

As I see it, a large set of computers all running a webserver over TLS can form a cryptographic global consensus (blockchain) for permissionless chat and other stuff. Sure, someone has to be running these serveds. But once they are ubiquitous enough, the government wouldn't be able to stop the chats by arresting / remocing any percentage of machines short of 90% or so.

What kind of traffic correlations would then be taking place? That someone is making requests with one of these servers? It's always hard to arrest a meaningful number of users once the network itself is resilient, uses a common protocol that resists deep inspection, and has no major points of failure.

It’s not just about protocols it’s also about the pattern of the data: the sizes and timing and other statistical characteristics of your packets. Tunneled traffic looks very different from normal web browsing even if you can’t read the content.

VPNs stick out like a red flag in Wireshark. Instead of a variety of small packets going to ports 53, 80, 443, and the occasional 22 or 3389, coming from random 5-digit ports - all you see are big packets over port 500.

I think peer discovery is still a difficult issue?

Hasn't it been solved with freenet, perfectdark, and other darknets and DHTs?

Reply on news.ycombinator.com