Hacker News Reader

Comment by RcouF1uZ4gsC | Hacker News Reader

This is a reminder that without physical security, electronic security is pretty much worthless. The best encryption won't save you from rubberhose cryptanalysis where they beat you until you reveal your key. Clever circumvention technologies such as VPN won't save you when they arrest your for using circumvention technologies.

These are all good things, but we in tech, oftentimes think we can program our way out of bad physical governance. We can't! We need now more than ever to engage with everyone to make sure that we have good physical governments.

View on HN

>Clever circumvention technologies such as VPN won't save you when they arrest your for using circumvention technologies.

True, but my question here is: given that VPNs are pretty much essential for the way many large corporations work (they're not going to let employees access sensitive data over the internet in the clear), how does India, a country with a large tech presence and which promotes itself as a good place for software development, handle this?

You can use VPNs in other parts of the country, just not in the areas where internet access has been banned. While this is an egregious abuse of power and a gross violation of the rights of Kashmiris, it is not happening in the rest of the country.

How is use of VPN is enforced? Looking at credit card transactions?

Use-cases like these makes cryptocurrency so much appealing. Where I can potentially spend my money like normal physical cash.

Well, it's just Kashmir, which is as close to become a tech booming region as those remote tribes in the middle of the amazon rainforest.

There are online businesses, call centers, tech startups that have been affected. Maybe you would hear what they are saying if you weren’t too busy sneering.

It is just in Kashmir which has no real industry to speak of.

Can't they whitelist VPN access to corporate IPs?

Circumvention technologies must be used by everyone, so you can't filter out some people.

It's very fun how Kazakhstan government worked against himself. They blocked a lot of websites including harmless ones (like pornhub) and plenty of useful ones (probably by mistake) along with opposition websites. So basically most of computer-literate people now have VPN ready to use and many people use it all the time, myself included. Government tried to block Tor and some major VPNs, but I don't think that it worked out. For example Cloudflare VPN works just fine.

Now even if they wanted to find out who reads opposition websites, they have no way to do that, because a lot of people use VPN every day. Again, thanks to Cloudflare, I just install and enable VPN for everyone I know to improve their browsing experience.

I'm not sure if "Harmless like a site that has been exposed for hosting rape videos of minors" is the rabbit hole you wanted to jump down.

From the perspective of a hostile government it's safe to assume that people VPN'ing to known CIDRs of VPNs are doing something subversive. I don't think this is really giving people much security as far as casual visiting goes.

Finding out what they're doing on opposition websites is a much better argument though.

Perhaps there is also the need for untraceable/hidden tools for censorship circumvention. This may involve masquerading as normal traffic. I've heard of specialized hidden censorship circumvention tools that do this by tunneling information though protocols like ping or DNS which won't look as suspicious as a VPN. Of course, for wide deployment this will become a game of cat and mouse, but I don't see any reason it would be impossible to make a good solution that is very hard to detect.

Your intentions are really good, but this kind of comment is _exactly_ what the person you're responding to was talking about - you're just playing another cat-and-mouse game and not solving the real issue.

The world is hitting a breaking point where this has to be solved by fixing governments/legislation/what have you, not by programming more.

(Edit: a typo)

We're on a tech form. We aren't political experts, we're tech experts. While we should be aware and discuss the political issues at the end of the day we aren't experts in that. But being experts in tech, we can approach the problem from that end. This isn't a "I'm a hammer therefore every problem is a nail" this is "It is a complicated problem that involves nails, screws, rivets, welding, etc. I am good at using a hammer, so let me take care of the nails".

The hammer analogy is amusing, given the old adage of "if your only tool is a hammer...". :)

I'm of the opinion that a voice (such as yours), if it's so much of an expert, would be better off in advocacy and consulting rather than tinkering with more tools. Not everyone has to agree with me, but I agree with OP's comment and I maintain that your response is emblematic of the issue.

I probably won't respond further to this, given we disagree (which is fine) and I've said my piece.

I just think that since we can't know everything that we instead form coalitions. Use our expertise together to function better, together.

The OP's comment make me feel that they are requesting that we be experts in everything. While I believe this is a popular belief (I think it is especially common among us nerdy types that we _have_ to be experts on everything), it is also unhealthy and makes us weaker as a society. Instead lets form coalitions. Coalitions are stronger than their individual parts.

Sometimes hammering nails into the broken thing will just end up splitting the wood and it'll be more broken than before.

Yes, this is a tech forum, but it's entirely reasonable to argue that in some cases, a tech solution is by its very nature not the right solution.

> Sometimes hammering nails into the broken thing will just end up splitting the wood and it'll be more broken than before.

I 100% agree? But we're trying to build a house here. We may not want to hammer nails into those boards, but there are plenty of places we want to. We also don't want to hammer into steel or into live wires.

Maybe my analogy didn't work. I'm saying form coalitions and we apply our domain knowledge to the domain of the problem where our knowledge is most effective. We leave the other domains up to the other domain experts. I'm not saying we shouldn't be aware and help where we can with those issues, but that we also aren't the experts there and shouldn't be leading the conversations (again, participate, but not leading).

wait are you telling me that experts in tech are not by default also experts in all other fields? i'm going to have to let everyone i work with know about this...

I know... such a radical belief. But for some reason it is...

Checkout ScrambleSuit and OBFS4 https://github.com/Yawning/obfs4 https://www.cs.kau.se/philwint/scramblesuit/

I remember reading on the Signal Blog[0] about using domain fronting to hide their traffic from governments. I think we not only need to have a serious conversation about this (hey corps, if you want to do some good, just look the other way or actually embrace this!) but need to push for technology like this and others. India is heavily invested in WhatsApp and we know that it leaks a lot of metadata. We see in HK users being deanonymized through WA/Telegram/Signal because phone numbers are how social graphs are created or through weak encryption.

There's currently a lot of apathy because people feel defeated. But as the tech literate I feel it is our place to lead these conversations.

[0] https://signal.org/blog/looking-back-on-the-front/

Tor has setting that hide your data to make it look inconspicuous. The issue with tor is its speed and ease of use in my opinion. https://2019.www.torproject.org/docs/pluggable-transports

Well, there isn't much we can do around here to solve physical security.

But we can make sure that the rubber hose is required. The government going around beating people on no evidence is a completely different situation than they knowing beforehand everything they need to do.

Reply on news.ycombinator.com