Hacker News Reader

Comment by tptacek | Hacker News Reader

DPI can certainly be used to detect VPNs, but my broader point is, if you want real assurance, you need to get a VPN working; you can't rely on TCP/IP reassembly glitches, because they're largely addressable by the serious DPI vendors.

View on HN

I think it's right to say you can't rely on those older methods, but there has been a lot of research that's gone into DPI bypass. The HTTP Evader work that's been done is particularly good [0]. In some cases the guarantee of operating a VPN over a hostile network isn't guaranteed, especially something like IPsec. So it's good that the simplistic fragmentation methods of tools like fragrouter have been expanded on.

[0] https://noxxi.de/research/http-evader.html

The stuff HTTP Evader is doing is simpler still than the stuff fragrouter (and this tool) does. Middlebox evasion is a cat and mouse game. I'm fine with people playing that game, but not with their lives; if real opsec is on the line, you need a VPN.

Sorry, n00b here, but a friend was telling me about a new version of Internet Protocol that fixes man in the middle attacks, like deep packet inspection. Is that realistically coming anytime soon?

It is an impossibility. Protocols are layered and so at one layer you can add features to detect possible MITM (eg. IPSec, SSL etc.) but cannot always be eliminated.

I suggest you consult a book like "The TCP/IP Guide" to get an overview of the main data protocols and how they work. In this day and age, everybody ought to know something about the basic protocols which form the bedrock of our networked society.

Reply on news.ycombinator.com