How the Great Firewall of China Detects and Blocks Fully Encrypted Traffic [pdf]

Re:How the Great Firewall of China Detects and Blocks Fully ... by law_enforcement on Friday June 30, 2023 @10:18AM (#36535376)

The comments from people obviously never having been into a restricted country are hilarious. There are a few, most likely shadow approved, VPN providers that work. I refuse to believe they are just smarter than the GFW. I am convinced they are sanctioned and monitored. Which is fine if you never have any beef with the government. Which you never know you do until you do.

Stuff like socks5/shadowsocks and wireguard have long been useless. Imagine being in your house, and you want to go out, without anyone seeing you. No matter how well you try, just the attempt itself reveals you are trying - thus you are caught. Same for escaping GFW. A sanctioned VPN or RDP that stays alive without metering, is your best option.

[ Parent | on HN ]

Re:How the Great Firewall of China Detects and Blocks Fully ... by bilkow on Friday June 30, 2023 @11:48AM (#36537120)

Can't you use a "sanctioned" VPN to tunnel your connection to a "real" VPN or any wireguard endpoint? They could still be able to find out you're using a VPN, but not monitor your traffic.

[ Parent | on HN ]

Re:How the Great Firewall of China Detects and Blocks Fully ... by law_enforcement on Friday June 30, 2023 @12:52PM (#36538277)

Yes, you can. But you have to wonder what the sanctioned VPN is doing on/to your machine. There is a lot of trust going into any VPN solution.

[ Parent | on HN ]

Re:How the Great Firewall of China Detects and Blocks Fully ... by ImPostingOnHN on Friday June 30, 2023 @02:13PM (#36539621)

are you talking about the VPN endpoint exploiting a 0day vulnerability in the VPN client stack of the OS?

[ Parent | on HN ]

Re:How the Great Firewall of China Detects and Blocks Fully ... by rfoo on Friday June 30, 2023 @01:14PM (#36538653)

Your comment is equally hilarious from the point of view of a native who lives in China now.

idk if i'm smarter than the GFW but every time I rolled my own censorship-circumvention tool it worked well, even the most lazy way worked. I've never used any VPN provider. And FYI even unchanged WireGuard still works, though there seems to be some offline traffic analysis looking for that, so once a week you'd wake up to your VPN connection broken and had to change ListenPort on the server.

The only annoying thing for me is: f- you AWS, egress too damn expensive!

[ Parent | on HN ]