It's like the cold war.
And yet we can never cut them off because it would be economic suicide.
VPN authors should chose the maximum collateral damage strategy to frustrate GFW authors, make China as close as possible to completely cutting off outside internet. No need to completely evade fingerprinting, instead, do the complete opposite, and try to mimic common protocols, and critical applications as much as possible.
> The use of VPNs in China can provide individuals access to the international internet, but in China, it can be a potential legal risk. In 2017, the Chinese government declared all unauthorized VPN services to be illegal.[94] An example of the use of this punishment is Vera Zhou, a student at the University of Washington, who, when visiting her Hui parents in Xinjiang, China, used a VPN to access her school homework. She was arrested and sent to a Xinjiang internment camp from October 2017 until March 2018, followed by house arrest after her release. She was not able to return to the US until September 2019.[95][96]
→ https://www.chinafile.com/extensive-surveillance-china
→ https://www.rfa.org/cantonese/news/student-01272020075256.ht...
It looks like 周月明 (Vera Yueming Zhou) was sent to a Chinese concentration camp mostly because she was part of a religious minority and not necessarily for using a VPN to access the University of Washington’s website.
> Vera was living in her hometown of Kuytun (Kuitun) in Ili Prefecture, an area directly north of the Tian Shan mountains that borders Kazakhstan. She had been trapped there since 2017, when—in the middle of her junior year at the University of Washington, where I was an instructor—she had taken a spur-of-the-moment trip back home to see her boyfriend, a former elementary school classmate. Using digital surveillance tools, the Kuytun police had noticed that Vera had used a Virtual Private Network in order to access websites such as her university Gmail account. Given her status as a member of a Muslim minority group, this could be deemed a “sign of religious extremism.”
When I rented a furnished apartment in Saigon back in 2008, there was an ethernet cable on the table and a piece of paper in English that said "Do not visit websites of anti-government propaganda, or pornography, or news such as the New York Times."
Naturally, as the police held my passport for the entire year I was in Vietnam, I was cautious. But after a few days, I just went ahead and openly browsed the NYT for a few minutes. My internet was shut off for about 3 hours. The next time I did it, it was shut off for 24 hours, and then I knew it wasn't a glitch. It wasn't exactly immediate, either; it took a few minutes. I was pretty sure there was a semi-dedicated person assigned to watch my traffic.
That wasn't over a VPN. I wanted them to see my traffic. But I knew running over a VPN would just raise suspicion. When I opened up VPNs to check email after that, I did it from cafes, and I did it in short spurts.
In fact, the US Department of State recommends that all US citizens have a photocopy of their passport with them, when traveling abroad.
I think it may be illegal, but I've heard from people who travel to places where it's sketchy for Americans to travel, that they report their passport as destroyed, get a second copy issued, then keep the first one.
The reasoning is that certain immigration departments see red flags if they see visa stamps from certain other countries, and you may get grief for having visited them. Cuba and the US used to be one, but cross-border rivalries are another. Knowing who hates who and presenting the right passport to receive the stamp would save you grief. Also if you encounter corruption/extortion you can schedule the next flight out and run.
With the electronic ones now I don't know how many places that still works.
Except for that one time when police (of a certain district, not everywhere in China) knocked on people's doors to inspect their phones for VPNs during the "white paper protest" I believe.
My experience is most younger and tech savvy people have a VPN. It’s common / casual, like speeding your car by 10mph on the highway.
Most people are not persecuted for using a VPN, I assume that’s reserved for people who the government already wanted to persecute and just need to give an excuse for why they detained their target.
GFW is sophisticated beyond imagination, one way to detect VPN traffic(or SSL, or SSH) is to observe its patterns and where the traffic is going. It's not too hard to have a blacklist of all VPN vendors too.
shadowsocks was designed to bypass it(to make traffic looking random), I recall its developers were visited by cops and warned to stop doing that.
It's said China built the largest LAN on earth, the government is just too scared by its people to get educated, it's a true parallel universe.
Use of VPNs is... universal... among middle-to-upper-class Chinese. This is obviously not an example of legal risk associated with using a VPN. Rather, it's an example of a punishment coming down on someone who was targeted for other reasons.
An immediate implication is that, if you repealed all the laws against VPNs, nothing about anything would change.
Fwiw My most reliable trick ended up piggie-backing off of a physical line going into Hong Kong from Shenzhen, and when roaming around China, using a vpn to get to that shenzhen gateway. As far as I can recall, that always worked. This led me to believe that most of the vpn traffic analysis (and blocking)was done at the edge of the GFW and not inside of it. Again, this could be outdated by now.
Every morning, our colleagues in China would open their mail client and it would connect to our server abroad.
The first person would usually be OK, but for everyone else, the connection would fail.
At the time, almost nothing was known of the GFW and it wasn't as clever as it is now. I found out that the POP connection was quickly blocked after a few minutes, probably triggering some slow firewall rules along the way (it seemed a bit random, so I assumed the firewall setup wasn't unified).
Moving to POPS/SMTPS seemed to improve things for a while, but the connection would still be randomly blocked.
What worked in the end was to use a bunch of random ports instead of the well known ones to accept POP/SMTP connections on the server, and we never had any issues after that, at least until we changed system a couple of years later.
A simpler test is to search "what is my IP" and compare the values returned by different services.
Back then, certain times (early June, big government meetings) would see a crackdown on VPNs where, so far as I could tell, they just threw down crude blanket blocks on anything they sorta-kinda knew was a VPN but couldn't procedurally target-block. It would (usually) still connect but be rate-limited to essentially nothingness.
I always got the vibe that they sort of informally tolerated VPNs above a certain threshold of sophistication, figuring that they were more interested in blocking the low-hanging fruit that the unwashed masses could easily use, rather than something more sophisticated that only a few techno-nerds could utilise. As other posters have said, they'd know who was doing it and preferred to come knocking with a rubber hose if those people caused too much in the way of issues.
Maybe it's good for the world that they burn so much talent and wealth on adding inefficiency to their internal information exchange.
Stuff like socks5/shadowsocks and wireguard have long been useless. Imagine being in your house, and you want to go out, without anyone seeing you. No matter how well you try, just the attempt itself reveals you are trying - thus you are caught. Same for escaping GFW. A sanctioned VPN or RDP that stays alive without metering, is your best option.
idk if i'm smarter than the GFW but every time I rolled my own censorship-circumvention tool it worked well, even the most lazy way worked. I've never used any VPN provider. And FYI even unchanged WireGuard still works, though there seems to be some offline traffic analysis looking for that, so once a week you'd wake up to your VPN connection broken and had to change ListenPort on the server.
The only annoying thing for me is: f- you AWS, egress too damn expensive!
[1] https://www.fastly.com/blog/a-first-look-at-chromes-tls-clie...
[2] https://gitlab.torproject.org/legacy/trac/-/issues/4744
[3] https://blog.torproject.org/ethiopia-introduces-deep-packet-...
"Allow a connection to continue if the first TCP payload (pkt) sent by the client satisfies any of the following exemptions:
Ex1: popcount(pkt) len(pkt) ≤ 3.4 or popcount(pkt) len(pkt) ≥ 4.6.
Ex2: The first six (or more) bytes of pkt are [0x20,0x7e].
Ex3: More than 50% of pkt’s bytes are [0x20,0x7e].
Ex4: More than 20 contiguous bytes of pkt are [0x20,0x7e].
Ex5: It matches the protocol fingerprint for TLS or HTTP.
Block if none of the above hold."
My university vpn only worked for a few days while studying in China.
But there is this tiny little vpn software being spread around. Not sure if it's true but I remember it's falun gong teaming up with the CIA. Which at the time was able to go undetected, I think they keep rotating the IPS or something.
Was interesting how fast that tool spread "offline" between international students. Also Chinese have it but its less known among them.
Not sure if it still works:https://en.m.wikipedia.org/wiki/Freegate
[Edit] Here is an old hn comment saying it doesn't work anymore and other options that are also hard;
https://signal.org/blog/looking-back-on-the-front/ (2018) https://news.ycombinator.com/item?id=16970199
The easiest bypass I can think of would be to tunnel your connections via TLS. For example socks server tunneled via SSH which in turn is tuneled via TLS to your gateway.
Or perhaps you can somehow get your SSH client to transmit "GET " at the beginning of the connection, have the server ignore those 4 bytes, then proceed as usual.
Can China pressure every domestic company to use their certificate authority allowing them to decrypt all TLS traffic, or be blocked? And block all sites outside China?
[1] https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_a...
2 - they obviously do not want to block all traffic, since they can do it any day, but they don't.
It also becomes an inspiration to others.
SSH is also exempt...
That is, assuming entry nodes are available as e.g. nginx proxies inside the Chinese ASNs and are allowed to operate serving websites to ASNs from foreign countries.
I'm mentioning nginx because there were some related bypass vulnerabilities in the past, and one could argue that they just missed updating them.
>Houmansadr et al. [39] conclude that mimicking a protocol is fundamentally flawed and suggest that tunneling through allowed protocols be a more censorship-resistant approach. Frolov and Wustrow [35] demonstrate that even when a tunneling approach is used, it still requires effort to perfectly align protocol fingerprints with popular implementations, in order to avoid blocking by protocol fingerprints. For instance, in 2012, China and Ethiopia deployed deep packet inspection to detect Tor traffic by its uncommon ciphersuits [44, 55, 67]. Censorship middlebox vendors have previously identified and blocked meek [29] traffic based on its TLS fingerprint and SNI value [28].
Companies get around ssl issues by minting their own root CAs and configuring their workstations to trust them. China has no (technical) way of forcing you to trust their root CA
https://www.virustotal.com/gui/url/f530591ff939e09c1cf8bc534...
Also, "it's done for social harmony"; Very few places are as dogmatically hostile towards social good as the US, and are willing to make individual liberty sacrifices so that everyone may be better off. Arguably this is the same rhetoric or philosophy as the "Thin blue line" American cops love.
Also, your average chinese person just doesn't care to see english language media that much. They have diverse (to them) opinions and culture on their homegrown social media systems, and don't feel a need to leave the walled garden of Chinese internet much in the same way most westerners do not feel the need to join Russia's social media apps.
Also, the CCP "brought millions out of poverty" within living memory. Many people there feel that justifies a hell of a lot of vaguely "bad" actions, or makes it way easier to rationalize things.
It was blocked immediately and the client could not connect. I had several unknown IPs try to connect prior to the attempted connection.
I was stunned at how water tight the GFW is, it's really unfortunate as I would love to work/travel through China but cannot due to needing an active internet connection.
I used it successfully when I was in mainland China while VPN's, even the ones boasting they could get through the GFW were all hit or miss.
Well, I'm sure the Chinese are tapping it. ;-)
Its more that they are just not actively acting on the content.
“You should…” from any large corporation translates in my mind to “…because we certainly won’t.”
For example they actually bow to American pressure and try to avoid sanctions or other trade problems. As of today their navy could be completely destroyed with like 30% of the US Navy, so any naval blockade is probably unbreakable for them. Iran's hunta would (and did) just say "whatever" and continued tanking the GDP.
Another example - the Chinese intelligence helps domestic industries, even those that are far from the defense business.
>They spend almost the same %GDP as the US does on the US military as on their internal suppression forces.
It's almost as if PRC doesn't spend that much %GDP on military. The waste is PRC spending as much as US on domestic policing, which is not great considering how militarized US policing is. Meanwhile PRC simply doesn't spend that much on defense <2% vs US ~3.5%, if you include guestimates of shadow budgets, 3% vs 6%.
The technologies for resolving America's problems are well understood - majority decision making, parliamentarism, representation and participation of electoral minorities rather than inhibiting the work of the majority, a narrower scope of judicial review and/or a more flexible constitution. But as long as people say, as you do, "it isn't the thing that caused the problem that is the problem, it is some fancy gadget that is the problem", then you will be unable to solve the problems
First rule exploits the IND-CPA property of most encryption. You want to kill traffic that has about 4 bits set to 1 per byte, i.e. traffic that "looks random".
The following rules are exemptions for permissible encrypted or compressed traffic (note that compression, while not IND-CPA, results in high entropy and thus will trigger the first rule).
This could work very well, which is confirmed by the researchers in this paper.
Do you mean "found" by the CCP, or "found" by the researchers? In the case of the CCP it was likely generated through basic statistical analysis, and tuned to minimize side effects and collateral damage below some threshold of acceptability (~0.6% of global traffic unintentionally blocked). In the case of the researchers, the paper details the basic statistical analysis used to discover these rules.
Ex2-4 are just excepting ASCII text, which is used by many unencrypted protocols (e.g. IMAP), but which are high enough entropy that they statistically will fail the first test often.
Ex5 is necessary because TLS is high-entropy (by nature of being encrypted). HTTP is also excepted presumably so e.g. compressed uploads (e.g. images/video) aren't flagged.
That "low entropy" is the key to bypassing the GFW isn't surprising at all -- high entropy is all but a necessary feature of most cryptography schemes. (I say "all but" because -- encryption isn't adding information, so unless you compress before you encrypt, it's possible for a (hypothetical) encryption scheme to preserve entropy, according to several objective metrics. I don't know of any that do this, beside the meta scheme of compression before encrypting, followed by steganographically padding the encrypted data afterward. This of course leaks some information through the encryption -- equal to the negentropy of the message -- but it would typically be information that can't be gleaned from context, e.g. that the message is HTML+text.)
So... base64-encode your TLS?
There's at least 1'000 such algorithms at each google-like company.
Your mistake is assuming that China has rule of law. If you're in China and you upset Xi enough, you get jailed/disappeared even if you technically didn't break any laws on the books.
It doesn't seem that there are any (long term) solution to bypass the rules ...
So for now, circumvention can live on, but this explains to everyone using fully encrypted protocols exactly why their connections would have been degraded over the past couple years. In the long term, steganography will probably work well as long as users are able to endure much higher costs for traffic (low ratio of true data to apparent data) and as long as the steganographic systems are effective at hiding any statistical fingerprints (very difficult). Protocol mimicry is another strategy, but a paper cited in this work details why successful protocol mimicry is very difficult.[0]
Attempts to disguise circumvention traffic as typical traffic is very difficult, because a lot of fingerprinting information can be gleaned from handshakes and headers. The draw of fully encrypted traffic is that it provides very little variation which can be used to fingerprint and classify different types of usages. However, it's also easy to detect and block en masse -- that much is obvious, but this paper does a great job of showing how China does it and inferences can be made from that to provide a view into China's priorities (how much cost they're willing to incur, rates of false positives they feel is acceptable). Overall, China's blocking current appears to be fairly conservative here, with relatively low rates of false positives.
In wider context, China is constantly updating their detection schemes, they're quite competent at it, and anything which doesn't match typical traffic is at risk.
Even when we had physical machines in Chinese data centers it didn't mean that our service was reachable from all ISPs. In 2010 we gave up on that and just started using Akamai China CDN with our servers in Europe.
That might be true, but "install our root CA or you can't access websites" would get most people to do it.
Didn’t that changed since 2018?
I didn't investigate how large the difference is, but Hongkong traffic is still treated more liberal.
Yeah, seems to be overlooked quite a lot since it's convenient for the US narrative lately.
> Starting in 2002, the American government detained 22 Uyghurs in the Guantanamo Bay detainment camp. The last 3 Uyghur detainees, Yusef Abbas, Hajiakbar Abdulghupur and Saidullah Khalik, were released from Guantanamo on December 29, 2013, and later transferred to Slovakia.
> None of the Uyghurs wanted to be returned to China. The United States declined to grant the Uyghurs political asylum, or to allow them parole, or even freedom on the Naval Base.
> A May 2008 report by the Inspector General of the United States Department of Justice claimed that American military interrogators appeared to have collaborated with visiting Chinese officials at Guantánamo Bay to enact sleep deprivation of the Uyghur detainees.
https://en.wikipedia.org/wiki/Uyghur_detainees_at_Guantanamo...
"sinofication" sounds a lot like "eliminating the existing culture" which sounds a lot like genocide. Genocide is more than just murdering everyone like in some of the most well known cases like the Holocaust -- it includes elimination of an ethnic group by any means possible, including "nativification"
for example, a cultural genocide refers to destroying culture, e.g. Uighur or Muslim culture
I suspect because of propaganda.
That's not really enough to establish a pattern, though. People in China have furniture older than the United States.
> But as long as people say, as you do, "it isn't the thing that caused the problem that is the problem, it is some fancy gadget that is the problem", then you will be unable to solve the problems
This is victim blaming. US citizens get no say in governance:
"Testing Theories of American Politics: Elites, Interest Groups, and Average Citizens"
https://www.cambridge.org/core/journals/perspectives-on-poli...
EDIT: I checked myself to be sure. It's "RAM over HTTP(s)" -- "Remote Application Management" of the eSIM. GFW doesn't block HTTPS, so you should be able to get provisioned to any carrier worldwide while inside the firewall.
Lasers maybe?
most satellites will just be following an uninterrupted, predictable path for most of their time
[0] https://unix.stackexchange.com/questions/12755/how-to-forwar...
I suppose for the government, as long as it isn’t the majority of people doing something that would cause trouble, it isn’t worth tracking down all things, as expected.
Except for that muslim chick another commenter pointed out, or anyone else the party decides is undesirable.
She was a spy--look at how intense their reaction was.
Unfortunately, they tend to grab innocents to exchange for captured spies. However, they're going to go for big fish, not little ones. As an average joe I'm not concerned about being held for a spy swap, but if I were a highly placed executive there's no way I would set foot in China.
I didn't feel good about it when I found out (actually, the moment I signed the lease), but there was nothing I could do about it.
My exit from Vietnam was almost humorous. I had about 50 DVDs in my suitcase, mostly encrypted backups and burned movies, and every single one was inspected by sight, holding it up to the light (to see how far the burn went?), then left on the floor of the airport for me to pick up. Upon re-entering the US, the customs officers did almost the same thing, and then just confiscated all my discs.
Weirdly, no one on either side checked my laptop.
Could you explain this further, this seems counter to my understanding of encrypted traffic!
Active web browsing requires downloading a crapton of files with wildly different sizes and sporadic timings between them. Add normal user interaction, API requests, ad cycles, long video streams that won't max out all bandwidth, all happening at once across multiple tabs. The client also sends much more data with each TLS handshake and all those HTTP headers.
This could probably be masked by deliberately filling idle periods with garbage data just to appear as a stable data stream both ways.
Not much good for images or video, but you could easily read https://text.npr.org/
Or is it chosen for rhetorical/propaganda effect without too much concern for accuracy?
https://www.un.org/en/genocideprevention/genocide.shtml
What the Chinese are doing there is covered under Article II, c.
If you are being pedantic by holding fast to the literal Greek translation of "geno" and "cide" then, well, this is simply not the complete modern meaning of the term.
Look, internment isnt good either, why dig in your heels on the most loaded possible word?
Modern definition of genocide at UN explicitly wouldn't categorize what PRC is doing in XJ - cultural genocide - because members, especially west went out of their way to ensure cultural genocide would have little legal ramifications, otherwise Canada would have been sanctioned to death for self professed cultural genocide a few years ago. Incidentally the entire reason Pompeo tried to propagandize genocide label was because it would trigger diplomatic ramifications at UN. What the PRC is doing in XJ is cultural genocide, and bluntly that’s permissible thanks to lobbying from the west.
The entire manufactured genocide narrative is so retarded because if PRC wanted to, they could just... commit genocide. At PRC scale they can wipe out the 12M Uyghurs in a few weekends on the cheap instead of wasting trillions of RMB trying to sinicize them.
* suicide
* regicide
* fratricide
* insecticide
* pesticide
Using the word "genocide" to refer to something other than mass murder - and then falling back to the claim that "genocide" doesn't mean mass murder - is just playing rhetorical games.
1) you travel a lot and sometimes may need to mail your passport off to get a pre-travel visa from some consulate, while you are still outside the USA. This way you can send off one passport to get the visa for your next country, while keeping a valid passport with you while you’re abroad.
2) You need to travel between Israel and countries which have laws against visiting Israel (Historically, GCC countries). This way you can always present whichever passport doesn’t have Israel’s entry and exit stamps on it.
I’ve had two valid US passports at the same time, and I’m just a random nobody American.
https://www.touristisrael.com/the-israeli-passport-stamp/974...
And to show how stupid things were--he also had a stamp he had made up to make forged entries on our yellow books. At that time your average joe certainly did not have an up-to-date smallpox shot--but at multiple border crossings they would hit you up for a bribe if you didn't have an up-to-date smallpox shot. Hence fake them. (Even around 2000 which was the last time I had occasion to have anything added to my yellow book there still was no anti-counterfeit protection.)
Part of this is simply because American passports are extremely valuable. Another part is that anyone who wants to fuck with you in some semi-official capacity now has to choose whether to go back to your hotel or arrest you on the spot, which puts them in a better mind to give up or take a bribe.
Happened to me at an airport in Thailand. Some airside police officer demanded to inspect my passport, then wouldn't give it back to me until I walked him to an ATM so I could pay him a "tax" in cash.
I never went back to Thailand.
It most certainly can be done--I wore mine basically 24/7 for a year. The only time it wasn't under my clothing was for border crossing or bathing--and in the latter case it almost always was under a traveling companion's clothing. No close calls--but someone else in the group wasn't so cautious and hers was snatched. Fortunately, the thief wasn't sophisticated, kept the cash and dumped everything else quickly.
In the end you'll have two passports but one of them is now useless and it will be flagged the moment you actually use it for traveling. It may not be pleasant when you're abroad and the authorities catch you using an invalid travel document.
I guess it makes more sense if you never intend to use the old passport again for crossing borders?
[1] https://www.interpol.int/en/How-we-work/Databases/SLTD-datab...
Hence intense reaction. The 2 Canadian Michaels on the other hand, were text book spys with NGO covers. Western propaganda likes insinuate PRC would capture innocent westerners when state security have massive state survillance capability that completely dismantled CIA networks a few years prior. Like literally friend of Michael hinted he was in "intelligence" and CSIS (Canadian CIA) publically celebrated on twitter upon their return. The Michaels weren't executives. The TLDR, while in PRC, don't traffic drugs, don't be a spy/do anti state activities, don't get involved in expensive legal proceedings - the latter is what actually get (white) westerners in trouble via exit bans.
- offers no way of replacing itself democratically
- extends own term indefinitely
- blocks free exchange of information
- censors specific speech that shows its failures or desire of people to replace it
- suppresses internal protests with murders and disappearings of people (1989 Tiananmen, 2019+ Hong Kong, blank paper movement, ...)
etc then it's super clear its primary goal is maintaining power.
Sure, it cannot maintain power without at least seeming to be "aligned with nation". But it takes second place to maintaining power.
So, on the surface, you appear aligned with growth and advancement and all that.
But under the surface, the system is about control, and only control.
See the Tiananmen Square Massacre.
Shanghai Residents Told to 'Control Your Thirst for Freedom' Amid Lockdown
https://www.newsweek.com/shanghai-residents-told-control-you...
false: there are a few. They aren't always correct, but they're more correct than you personally
> More generally, if genocide can mean...
there is no question what it means, you simply personally disagree with it
and since you definitely aren't an authoritative body on the definition of words, your personal pedantic insistence that the word mean only what the strict etymological roots imply, rather than how people actually use it, is irrelevant
> a negatively-loaded bomb to be lobbed in partisan debates
it's quite telling that you seem to view usage of the term "cultural genocide" to refer to cultural genocide as a bigger issue than actual cultural genocide
don't like people using the correct term to refer to the action? maybe get those perpetrating the action to stop, instead of telling everyone we're using the wrong words to describe it.
I am guessing the comment above somehow meant that more infighting within a gang of literal criminals who put themselves in power and clearly struggle to maintain it means the gang is somehow better than a democratic government? But I cannot see the logic
why not focus on that, rather than your personal, individual dislike of a term?
why dig your heels in on the semantics of the thing, rather than the substance?
It used to depend on where you were coming from. When travelling to Israel for work a few years back, my passport (irish citizen) was not stamped, but my colleague's (at the time, a Turkish citizen) was.
No idea why.