Hacker News Reader

Comment by sethbannon | Hacker News Reader

As someone with a trip to Beijing on the horizon, aside from using a VPN, are there any other best practices to keep data secure while traveling there?

View on HN

(I live in China) I would advise against VPN entirely. I am unsure about the state ability to decrypt the content of the connection (heavily depends on how the VPN is configured really — weak and legacy ciphers, etc.). But they will detect it and eventually you'll start dropping packets like crazy.

A simple way to evade all of this is to use shadowsocks with a strong cipher and strong password between your computer in China and your server outside of it. Don't use any free server and don't use any commercial shadowsocks offerings. Set it up yourself, it's pretty easy.

On the mobile phone side of things. I wouldn't trust anything. Especially Apple that has been very complaisant with local authorities.

China plays a tactical game: they pretend (or we suspect, and they want us to) that they can do a lot of things. But nobody knows the extent of what they are actually capable of.

But shadowsocks is a VPN. What makes it better than other offerings?

Shadowshocks is not a VPN at all. It's a connectionless SOCKS5 proxy. No hand-check, no key exchange, no protocol agreement. VPN is not made to be undetected, only secure in the sense of data encryption. Shodowsocks has broader objectives.

See https://shadowsocks.org/ for info.

> It's a connectionless SOCKS5 proxy.

On your local workstation, it exposes itself as a SOCKS5 proxy. But to communicate with the shadowsocks server, it uses a proprietary protocol which is not SOCKS5 and does have a key exchange process. Either way, these details don't affect its ability to be detected.

> VPN is not made to be undetected

"VPN" is not just one technology. Many vendors of VPN software do claim that their software is made to be undetectable. One example is shadowsocks, but there are other vendors who also claim that.

Thanks for the info, couple of things I didn't know. What I meant by "it's not a VPN" was mainly it doesn't make your computer part of another private network.

Used to live in China. Can vouch completely for the Shadowsocks approach. It can't be blocked yet. Set up an endpoint at home or on EC2 and configure Streisand. Works great on mobile and desktop.

shadowsocks is on their radar now...and they have been able to detect its usage with some success, unfortunately...

i.e. The Random Forest Based Detection of Shadowsock's Traffic, https://ieeexplore.ieee.org/document/8048116/

I don't really understand what kind of scientists would do such researches to help the government carry out the censorship more efficiently, over their fellow people...it's either those intellectuals have no brain, or no heart...

this is correct, SS is on the radar and is not as dependable as it used to be, there is a variant of SS that is said to be an improved version but it is still not 100% dependable.

or he could just use roaming mobile data which are not subject to great firewall

If I had to do it, I'd go full thin client. Store nothing. Bring a laptop that is basically a bare bones Linux + xfce desktop, and the ability to connect to external VPN + vnc-over-ssh2 session to a system you trust. Keep in mind that a rootkit installed on your thin client is a possibility, for keystroke logger or whatnot, so if you don't keep it with you and don't treat its physical security as a concern, all bets are off.

FYI, the great fire wall engineers have already found ways to inspect packets sent through OpenVPN...

A couple of weeks ago, I was asked by a friend who was traveling in China at the time to set up a VPN for him so he could use Gmail and other Google services there...I went for the easy way and used the OpenVPN for him, but to our disappointment, with that VPN tunnel, he still could not access google search page while many other pages on other domains were fine...I spent a few hours trying to figure out why, and then I came across these discussion,

https://superuser.com/questions/1187525/vpn-to-avoid-the-gre...

https://www.quora.com/Can-Openvpn-still-bypass-the-GFW-of-Ch...

My friend and I haven't experimented further; but I think one way that might work is to chain multiple VPNs or perhaps obfuscate your protocol a bit (i.e. make some minor customization yourself)...

It isn't that they need to inspect the contents of the packets, tcp and udp flow analysis will reveal VPN traffic patterns even if the crypto is perfect. What I've seen reported is that people using openvpn see it work for a while, then increasing latency and packet loss, then eventually total lack of ability to move traffic between the two endpoint IPs.

that's true...they have been studying the packet flow patterns for a while -- such as this research,

http://security.riit.tsinghua.edu.cn/share/classify_encrypte...

But if the government completely blocks out VPN uses in the country, lots of international business operating there will suffer and then they will complain, which is not something the government can ignore (at least not always)...VPN whitelist could be a solution, but I don't know how well that is implemented (if it has been implemented) -- not to mention keeping a perfect consistent whitelist at that scale would be difficult...in addition, there is always some false positive/negative in their flow pattern analysis -- those are statistical approaches after all...so there is some grey area here...

Anyway, back to that openvpn experiment I did with my friend, many websites were still accessible with my openvpn tunnel -- although Google was not among those sites -- this seems to imply that they were doing some package semantic analysis (i.e. deep packet inspection)...

They will detect the VPN trivially if you try to layer them. They only need to see either the pattern of traffic or the outermost layer's handshake.

OpenVPN has been offlimits in China for like 8 years now.

If you have something that you genuinely need to keep from the Chinese, don't connect to the internet full-stop. Even SSL can be decrypted by their great firewall if they are suspicious enough. Even VPNs have no guarantee that someone with the right resources hasn't terminated the VPN themselves on the quiet!

[citation needed]

Like whoa, are you even aware of what you are suggesting? This is completely false.

No need to decrypt SSL, there are easier ways: https://xkcd.com/538/

Or do like Uzbekistan has done, force all local computer stores to install a trusted root CA in the operating system before it gets to the hand of the end user. You can transparently MITM TLS1.2 if the system trusts the mitm operator CA. Maybe 0.01% of people even know where to look to examine their windows 10 machine's trusted CA list.

Having looked through the government CAs in preinstalled CA lists, I'm a little surprised Uzbekistan doesn't qualify.

Naturally! Well - except for the diplomatic disaster this would turn into if you did it on foreigners.

I think most people exaggerate the technical capabilities of the Chinese government and how interesting they are for them. Sure, we shouldn't be naive, but a drop of realism is always good.

The difference is in the degree! I don't think the Chinese could or would decrypt all foreigners traffic (and I did mean TLS but use the more well-known SSL name) but if the question is "As someone with a trip to Beijing on the horizon, aside from using a VPN, are there any other best practices to keep data secure while traveling there?", the answer is very clearly don't connect to the internet.

I don't know the person who asked the question, whether he is a realistic government target or just some normal person but there are enough reports of cache poisoning, VPN control/blocking and Chinese hijinks to know that if you are worried about them, don't connect. Mind you, the same fear applies to the US and UK as well.

I know that SSL and TLS tend to be thrown around interchangeably, but SSL is actually deprecated and unrecommended for being unsecure[0]

[0] https://en.wikipedia.org/wiki/Transport_Layer_Security#SSL_2...

I would still like to see them decrypt the traffic on demand. There are heaps of other attack vectors that are much easier to deploy. Also, looking at Qualys SSL Labs[0] it seems like most of the web does a good job at supporting secure and modern protocols. And it feels safe to assume that parent meant TLS, like most people do.

[0] https://www.ssllabs.com/ssl-pulse/

Buy a feature phone and dump it once you return.

Buying a SIM in china requires you to register your passport.

I meant assume that your phone will be hacked so buy one that you can afford to throw away once you return from China.

Reply on news.ycombinator.com