Hacker News Reader

Comment by aasasd | Hacker News Reader

I think DPIs might also be used to detect VPNs. I'm not familiar with VPN traffic patterns situation but I doubt that it's too chaotic or masquerades as something else, since VPNs weren't invented with DPI in mind.

Not to imply that GoodbyeDPI assuages all my doubts, either.

View on HN

DPI can certainly be used to detect VPNs, but my broader point is, if you want real assurance, you need to get a VPN working; you can't rely on TCP/IP reassembly glitches, because they're largely addressable by the serious DPI vendors.

I think it's right to say you can't rely on those older methods, but there has been a lot of research that's gone into DPI bypass. The HTTP Evader work that's been done is particularly good [0]. In some cases the guarantee of operating a VPN over a hostile network isn't guaranteed, especially something like IPsec. So it's good that the simplistic fragmentation methods of tools like fragrouter have been expanded on.

[0] https://noxxi.de/research/http-evader.html

The stuff HTTP Evader is doing is simpler still than the stuff fragrouter (and this tool) does. Middlebox evasion is a cat and mouse game. I'm fine with people playing that game, but not with their lives; if real opsec is on the line, you need a VPN.

Sorry, n00b here, but a friend was telling me about a new version of Internet Protocol that fixes man in the middle attacks, like deep packet inspection. Is that realistically coming anytime soon?

It is an impossibility. Protocols are layered and so at one layer you can add features to detect possible MITM (eg. IPSec, SSL etc.) but cannot always be eliminated.

I suggest you consult a book like "The TCP/IP Guide" to get an overview of the main data protocols and how they work. In this day and age, everybody ought to know something about the basic protocols which form the bedrock of our networked society.

Detecting VPNs is not an issue in most places since VPNs are allowed.

Reply on news.ycombinator.com