Internet Blocks, the Great Firewall and VPNs

[imron]

I miss the downvote button.

 

Angelina, please try to stay on topic.

[Angelina]

How would you define the topic? 

"How are you getting around Internet blocks in China"?

 

I voted that I am not, I am no longer using a VPN and can't wait to see what the future holds for me in China. 

 

 

It is an interesting topic.

I would be happy to see discussion on the Investigatory Powers Act. Can't believe people don't care about it. Yet, that would be off topic and I would stick to my decision not to use a VPN while living in China. 

 

https://www.theguardian.com/world/2016/nov/19/extreme-surveillance-becomes-uk-law-with-barely-a-whimper

 

https://www.theguardian.com/world/2016/nov/29/snoopers-charter-bill-becomes-law-extending-uk-state-surveillance

[imron]

Not using a VPN = on topic

Nerdy Korean athletes = off topic

 

1 hour ago, Angelina said:

Investigatory Powers Act. Can't believe people don't care about it. Yet, that would be off topic

 

There are plenty of other places online to discuss that, and lack of discussion here doesn't mean people don't care about it, it just means that people realise this site is called Chinese-forums, and not uk-forums. 

[Angelina]

There are people who are seriously considering leaving China if it is no longer possible to use a VPN. 

 

I would choose nerdy North Korean athletes over Facebook anytime. 

 

Try this poll:  

1. Are you living in China?

2. Are you using a VPN?

3. Would you consider leaving China if it is no longer possible to use a VPN?

4. Have you ever heard about the Investigatory Powers Act? 

 

 

If anyone answers yes to question #3 and no to question #4, I urge them to think again. 

[Balthazar]

Angelina, if your issue is the surveillance of the West (hence "hypocrisy"), have you considered using a VPN provider hosting outside the  "14 eyes"?

[Angelina]

Surveillance and hosting, this is one small part of the problem.

 

The 14 eyes, they not only watch, they kill too. 

 

 

http://www.slate.com/articles/news_and_politics/dispatches/2005/09/you_cant_handle_the_truth.html

 

 

So how to survive the 14 guns? China is ok, not perfect, but still ok. 

[Balthazar]

That didn't really answer my question though.. I fail to see why you would feel like a hypocrite using a VPN in China, even from your point of view regarding the ominous surveillance situation in the West. (It is precicely because of this situation that many in the West are also using VPNs hosted outside the "14 eyes" (as well as proxies). Unless you mistakenly conflate VPN usage with a pro US/UK stance in the larger international cyberwar.

[roddy]

5 hours ago, imron said:

I miss the downvote button.

 

Month-long ban, as the previous week-long ones don't appear to have stuck. I must have some soft spot for Angelina, she's been banned, but then let back in, more than any other member ever. Patience wears thin though. 

 

Batlhazar, Angelina talks shite. Or is oppressed. You decide. 

 

 

[abcdefg]

16 hours ago, Balthazar said:

(It is precicely because of this situation that many in the West are also using VPNs hosted outside the "14 eyes" (as well as proxies).

 

I was ignorant. Didn't know about the "14 eyes." Looked it up. In case anyone else out there doesn't know, here's a list of them.

 

https://www.my-private-network.co.uk/vpn-provider-14-eyes-country-something-know/

 

Note: I have no relationship to the company which wrote that piece, and don't know if they are any good or not.

[renzhe]

On 11/07/2017 at 7:22 PM, banjo67xxx said:

You could use an encrypted proxy. You could even configure a VPN on port 80 or 443 so it doesn't look like a VPN.

 

I am afraid that this will not work anymore. The technology for detecting VPN traffic has been maturing for a while now. It is not based on blocking a port or IP but analysing the packets and timings. VPN traffic looks very different from TLS or HTTPS traffic and you can now detect it pretty accurately without decrypting the packet payload. OpenVPN was simply not designed to hide what it is doing -- only to hide the actual content. I suspect that this block simply means that the technology is ready (and deployed) and that any and all VPN traffic will be blocked or disrupted in a way that will make using it very difficult. The GFW is already reading every packet, this is simply more complex than looking for text in unencrypted packages, yet possible.

 

Corporate VPNs could be whitelisted or asked to hand over keys to the government. The fact that this is coming suggests that there is some kind of plan in place.

 

This does not bode well for other technologies, either. Very few of them are designed to disguise themselves. And even if you tunnel through SSH (which is unlikely to get blocked outright), the traffic signature of using SSH to edit a remote file on a server you are administering is very different to that of a tunnelled HTTP handshake or streaming video. Anything that matches will be simply dropped.

 

The next step will be some sort of steganography-based piggybacking approach that disguises itself as something else. But this will take time and will probably be attacked by some adaptive machine learning approach which will learn to detect it based on minor differences in signatures.

 

Note: I am simply speculating about the technology. It's not like some spy would come and tell me how it is actually going to work...

[Sarevok]

Okay, I was wondering whether I should buy a compatible router when going home in August (I usually return only once or twice a year) and set up the SSH tunneling, since somebody wrote here earlier, that this method is virtually untraceable... is that so? Or will this also be futile? 

 

Also, our company has everything on G Suite, so we will probably have to get our own corporate VPN and register it with the authorities... I can already see that the HQ won't like this

[renzhe]

7 hours ago, Sarevok said:

Okay, I was wondering whether I should buy a compatible router when going home in August (I usually return only once or twice a year) and set up the SSH tunneling, since somebody wrote here earlier, that this method is virtually untraceable... is that so? Or will this also be futile? 

 

Not untraceable, but vulnerable to the same kind of analysis.

 

That said, it is probably less likely to be hit by a blanket ban at this time. The vast majority of people using SSH are sysadmins doing system administration, and these are the sort of people who would get angry and mischievous if you take their tools away from them.

 

As it becomes popular (people moving away from VPNs) it is more likely to get analysed and blocked as well.

[ChTTay]

Anyone got any good links to setting something up myself? Like to my UK router and a like.

 

I've not attempted something like this before but... I'd give it a shot. All for learnin'

[banjo67xxx]

Setting up a VPN on your UK router is dependent on the router, but it's fairly easy to navigate through their setup menus and create the passwords and encryption keys. It's easy to setup the VPN client on Android or an iPhone. There's lots of how to guides for Windows and Linux. The only thing that's difficult is DDNS as China blocks some of them. Even then you could write down your IP address before you leave the UK, and hope that your router doesn't lose power for more than a week and it changes. 

 

SSH tunnelling requires you to leave a Linux PC running 24/7 at home, so would be more complicated. 

[歐博思]

How does SSH technology stack up against, say, ExpressVPN? Assuming things don't get too much more restricted, of course, I'd be mainly concerned with HD Youtube streaming and low latency for gaming. 

[banjo67xxx]

Never used ExpressVPN so I don't know what bandwidth and latency they have. An ssh tunnel will depend on the ISP in Europe where the Linux machine is running. If you pay for a hosted server you'll get better than a commercial VPN, but if you run the system at home then it depends. (Remember for bandwidth that Europe upload limit is your download limit in China). 

[roddy]

Apple App Store changes, apparently.

https://techcrunch.com/2017/07/29/apple-removes-vpn-apps-from-the-app-store-in-china/

[renzhe]

Only tangentially related, but Russia has just passed an anti-VPN law too: http://money.cnn.com/2017/07/31/technology/russia-vpn-internet-putin/index.html

 

Other countries will probably follow suit.

[Angelina]

Update: 

 

Apple removing certain apps, including the removal of VPN apps in China, has more to do with their (of the apps) quality than Cold War fantasies.

 

Quote

In June, tens of thousands of apps were removed from the Chinese app store as part of a worldwide purge of low-quality offerings. Although many Chinese consumers reacted negatively to the move, developers welcomed it. “What Apple did then affected us small businesses positively,” Cui Yinjie, a manager at Suzhou-based game developer Leji, told Sixth Tone. “If all the illicit developers are forced out, then the rest of us can have a better environment in which to grow.”

 
 

 

 

http://www.sixthtone.com/news/1000661/chinese-app-developers-accuse-apple-of-monopolistic-behavior

 

 

Also, yes, I am not planning to leave China just because certain VPN apps of dubious quality are no longer available.

 

 

[Zbigniew]

1 hour ago, Angelina said:

 

Also, yes, I am not planning to leave China just because certain VPN apps of dubious quality are no longer available.

 

 

It won't be just the apps of dubious quality that will no longer be available though. I don't think anyone who has full access to uncensored commentary is in any doubt that the outlawing of VPNs in China is largely about information control, not quality control.