Hacker News Reader

Hacker News

Comment by ck2 | Hacker News Reader

Parent Full thread

ck2

Maybe http://m.gmail.com ?

What about ssh tunneling over an alternate port?

Gosh I cannot believe governments that do this to their people.

I wonder if they are ironically using American engineered equipment and software to do the block too.

View on HN

> I wonder if they are ironically using American engineered equipment and software to do the block too.

What exactly would be the irony of it? Iran doesn't forbid buying US products and services, it's the other way around.

They drop ALL encrypted connections. You cannot even make a normal ssh connection, since they drop the connection during handshake. (SSH has been disabled for a few months)

What about ssh over port 80? I realize that would have to be set up in advance from outside the country, but the question is are they using port numbers to aid in their filtering or deep packet inspection?

If they are dropping all encrypted connections, it doesn't matter what port you use for ssh, it'll be dropped.

How do they know it's encrypted? I mean would they block something that looks like gibberish but was plain text over port 80?

I like that idea. You could encode a block of octets with plain words. "\xC3\x08\x00\x23\xFA" would then actually travel on the wire as "Was named prefer to use the other especially in, every cast a chuckle on neithout getting. Into useful informash speech makes removing a featuring a move or usage actual considered!", and be decoded back at the other end. You'd have to use common words so it looks as innocuous as possible.

I doubt you'd need to go to such lengths, otherwise you wouldn't be able to transmit binary data such as images, either.

If.

That is why I asked the question.

They drop all secure connections. For security reasons, I had to access a VPS on port 33 (instead of 22), and in the past couple months I've been unable to do so.

That's an interesting data point, but port 33 is rarely used so deep packet inspection is still relatively cheap. I'd really like someone to test on port 80, then I'd believe that it's 100% coverage with deep packet inspection.

They have to be using ports. Deep packet inspection is far too expensive to do on a massive scale.

Maybe http://m.gmail.com ?

If they are blocking https traffic, they are almost certainly intercepting and scanning http traffic (lots of countries do this, e.g. lots of UK ISPs did this to censor wikipedia).

So, even if you were to be able to access gmail over http, you probably don't want to. :)

What parts of Wikipedia did they censor? Quite interested in that.

The article Virgin Killer was blocked for four days because of "child pornography".

https://en.wikipedia.org/wiki/Virgin_Killer

https://en.wikipedia.org/wiki/Wikipedia#Sexual_content

Thanks for the info!

I'm guessing it's this case he's referring to: http://www.theregister.co.uk/2008/12/07/brit_isps_censor_wik...

http://www.guardian.co.uk/technology/blog/2008/dec/08/intern...

I guess wikileaks, not wikipedia

Nope wikipedia. Over 'Child porn' images

Reply on news.ycombinator.com