Pakistan bans VPNs
tribune.com.pk
tribune.com.pk
With the ban on VPNs, steganographic[1] techniques that make encrypted traffic look like regular traffic will become more and more common. The troubling thing is the fact that these techniques are somewhat hungry for bandwidth.
Only in the sense that "Crypto is breakable."
The entire point of steganography is that it isn't detectable. If it can be detected, you need a better algorithm.
If you're encrypting your steganographic messages, you're increasing the entropy of the plaintext message you're concealing it in.
Looks like you're getting the hang of it: good steganography relies on having better statistical models than the opposition.
Things are weighted in favour of the concealer, however, as (unlike the attacker) he doesn't have to worry about false positives/negatives
Furthermore, hiding even an unencrypted message still adds entropy, since you're encoding more information in the same amount of space.
No. It is perfectly possible to have steganographic keys, in the same way that you have cryptographic keys.
Trivial example: If the key is 7, the hidden message can be extracted by combining the least significant bits of every 7th pixel of an image. (Incidentally, that hidden message could also be, and indeed probably should also be, encrypted.)
For an example that's only slightly more complex but might actually be useful, replace "7" with a seeded CSPRNG.
you're increasing the entropy of the plaintext message you're concealing it in.
Yes. But you should still be able to conceal a low-bitrate secret message inside a high-entropy covertext/envelope/whatever-you-call-it without a significant chance of being detected.
Trivial example: With a good algorithm and a stick full of 1MB JPEGs, it shouldn't be possible for an attacker to determine which files contain a concealed (140-byte) tweet and which don't.
What I know is that, as https is so easy to use, there are plans to make it serve covert traffic. So you would make a request to https://www.friendlyproxy.com with an extra header somewhat like What-I-Want: http://www.bannedsite.com and have "friendlyproxy.com" serve you the document you originally wanted.
I forgot the name of the project, though. I believe it was from an American university
Besides, with this new wave of government carrying MITM attacks, I don't know how useful this techniques will be.
EDIT: I was able to find a link explaining the Telex project from University of Michigan: http://ns.umich.edu/htdocs/releases/story.php?id=8505
Crypto is currently usable in practice. Its a bit hard for many users, but its doable, especially with modern VPN implementations. If any encrypted tunnel is allowed, you can put all your traffic through it, and no one knows whether you are surfing banned websites, or working on the corporate VPN. And you can be pretty confident your modern crypto implementation isn't going to be broken.
But steganography isn't really usable, in practice. If nothing else, the government can do traffic analysis, and see suspiciously large traffic volumes going to a small collection of servers (which are accepting the steg'd communication, and proxying your requests, presumably).
And even if the traffic looks like normal HTTP, with images in it, that's simply not good enough to use, in a regime where the secret police can arrest you if they suspect you are trying to hide your traffic content. And they will be able to find users, because eventually the servers accepting steg'd traffic, which the population are using, will become known.
So, while I think it'd be very hard to remove the ability to send small amounts of text data, from the Internet, I think it'd be possible to make private communication unworkable, in practice, for most people.
I don't see how this would be worked around, without building a massive distributed network of computers that all accepted and routed steg'd communication; something like if every webserver would accept, and onion-route, incoming steg'd traffic.
That doesn't exist, so I think their initiative will work, if they push it enough; hopefully rules like this remain isolated to relatively repressive regimes, and not gain widespread adoption; the widespread commercial use of encrypted communications is probably the best defence against global crypto bans.
Let us remember that normal HTTP traffic follows a power-law, with relatively few sites getting the majority of the traffic, so there might be a way, if many of the high-traffic sites on the internet collaborate, of making "covert" traffic look just like "innocent" traffic.
that's simply not good enough to use, in a regime where the secret police can arrest you if they suspect you are trying to hide your traffic content
Even if we accept the premise of undetectable steganography, which is not possible by any possible means today, the arrests will continue to happen. However, I hope they will tend to happen less, as the large number of false-positive arrests would certainly cause high commotion in the general population.
* So, while I think it'd be very hard to remove the ability to send small amounts of text data, from the Internet, I think it'd be possible to make private communication unworkable, in practice, for most people.*
You are correct. Under the current situation, it'll be hard to make all your communication private under the restrictions imposed by, for instance, the Pakistani government, but dissidents don't need all communication to be private, and small amounts of text data might be all that's needed.
Or is the plan that the punishment for stepping outside the lines be enough to keep people from experimenting with these technologies?
I don't see any mention of a wholesale ban on encryption, only the use of encryption for privacy purposes. So, port 443 might still be open. It's still pretty easy to distinguish between HTTPS traffic and VPN traffic, though.
> Authority prohibited usage of all such mechanisms including encrypted virtual private networks (EVPNs) which conceal communication to the extent that prohibits monitoring.
They sure can't monitor your email if you're using SSL, so I'd wager that yes, if you have gmail and live in Pakistan, now would be a great time to back it all up.
That would have been my gut feeling until I saw this yesterday:
Frankly I don't see how they could possibly get away with it. Businesses of any size can't run without encrypted channels. Proceeding with this seems sure way to smother any economic development and relegate the country to third-world backwater status for the foreseeable future. And is any world leader crazy enough to do that besides Kim Jong-il?
Sure they can - they did before the internet. (No, the postal mail is not secure.)
> Proceeding with this seems sure way to smother any economic development and relegate the country to third-world backwater status for the foreseeable future. And is any world leader crazy enough to do that besides Kim Jong-il?
Pretty much every "world leader" in the last 100 years (if not longer) has shown that s\he is willing to give up some economic development in return for control and other benefits. (They arguably give up more than they think that they're giving up, but that's a separate issue.) Disagree? Name three exceptions.
Besides, the effect on economic development in the short term will be almost unnoticable.
Anyway, "some economic benefit" is the understatement of the year. A multinational simply can not do business without secure communications. History is irrelevant; Wells Fargo wrote out every transaction on a slip of paper and manually reconciled it every night 50 years ago, but to do so today would be utterly impossible. In todays global economy, countries need to be able to do business with foreign companies or they will be a backwater plain and simple. China certainly makes some of the tradeoffs you are talking about, but do they outright ban secure communications? Of course not, because that would be suicidal.
It's several orders of magnitude more secure than plain http.
>Besides, the effect on economic development in the short term will be almost unnoticable.
India has to be chock full of nationalistic script kiddies and legitimate hackers who will have a field day wrecking Pakistan's online economy if they actually try to implement this plan.
Anonymous has got some work to do.
At my university, students are required to browse through an authenticated proxy (which we have to sign in to using our university IDs), which logs our browsing history. This is done so that they can comply with the PTA's requirement that an ISP should be able to provide browsing history of all users for the last 45 days upon request.
Never mind that it's trivial to get around that proxy, all it actually does is mess up most stuff like Windows updates, gaming, etc.
VPN's work too, so far. I'm on one right now. As to why - the filtration system the government is using is so brain dead - there is basically one Juniper router and a couple of Cisco routers (last time I looked) - through which the entire country's traffic is routed.
Using a VPN makes web browsing much faster, with no annoying "waiting" moments - which I presume is the routers locking up under massive load.
The day VPN's are blocked is going to be a sad day indeed. I am going to explore for alternatives to VPN's. Way back in the days of super slow dial up I used these services which would take a link and email the page or entire site to you depending on the command you sent, in a zip file.
Though of course they could just tap into the local last mile...
I'm guessing the extended set contains countries with names that don't start with "I"?
Why would a tech company even consider spreading/outsourcing to Pakistan after this?
Basically, if you're a multinational or a large local corporation you get to use VPN's. Private citizens need not apply.
Even multinationals don't enjoy having to spend extra resources to keep track of such arbitrary requirements. Will they need to register only the IP of their VPN gateways, or also the client IPs? Will they need to specify the type of software they use? What are the chances that they'll also be asked for certificates, so that spooks can snoop anyway?
If I have a website running on servers in Jamaica, selling paper planes, and I use SSL because it's the right thing to do, will Pakistani customers be able to buy anything from me? Obviously I haven't registered with the Pakistani government, chances are that I don't even know what Pakistan is!
This is unbelievable.
(On the other hand, it's a wet dream for the likes of RIAA...)
How can any global company now do business in Pakistan? Surely there is some kind of back door in there.