Slashdot Mirror
Telex Would Work, But Is It Overkill?
Professor Alex Halderman published a paper in July describing a new anti-censorship system called Telex, whereby users in censored countries could request banned websites by sending an encrypted request to an SSL-enabled website (i.e., a Web address beginning with https://) outside of their country -- even if the owner of the SSL-enabled website is not participating in the scheme. Since encrypted communications usually contain some random variation, that random variation can be used to embed hidden messages, which can then be decoded by any third-party observer who intercepts the communication and knows how to decode the hidden message. The third-party observer still cannot decode the original encrypted communication between the end user and the SSL-enabled website -- SSL is designed to be unbreakable by all but the intended recipient -- but the observer can decode the "side message" that was designed to be intercepted in transit. So a Telex-enabled router, in the process of passing the communication along, would notice the hidden request for a banned website, and pass the requested content back to the original user.
By analogy, suppose Mrs. Smith wants to send a letter to a friend. Mrs. Smith knows the letter will be sealed, and supposedly unopenable by the postman. But Mrs. Smith also has many choices of colored envelopes to use, and she has agreed with the postman on a color-coded system -- red for "Meet me tonight at the Motel 6", blue for "Not tonight, he suspects something" -- that the postman can "decode" when he picks up the envelope for delivery. The choice of envelope color is the "random variation" inherent in the sending of the message, which the message sender can use to send a "side message" to anyone who passes it along and who knows the system. The postman -- who is analogous to the Telex-enabled router -- has no access to the original sealed message inside the envelope, but he understands the side message just fine. (A Telex user may have no control over what routers their messages pass through, though, so they simply have to hope that there are enough Telex-enabled routers on the Internet that one of them will pick up the message and decode it. Imagine many different amorous mail carriers in the Postal Service, and any one of them who finds the colored envelope will be happy to show up at the appointed time, if Mrs. Smith is not picky.)
The novel feature of Telex is that it would not require the cooperation of the owner of the SSL-enabled website in order to work. You could send an encrypted communication to any website -- https://www.paypal.com/ for example -- and any Telex-enabled routers along the pathway traveled by the connection, would be able to decode the embedded message hidden in the randomness of the encryption. By contrast, for a user to make use of a typical proxy website like Vtunnel, the owner of the Vtunnel website has to set up the site as a proxy; this means the supply of such sites is limited to those websites whose owners have installed proxy software, and the censors have a greater chance of finding and blocking them all. Telex, on the other hand, would continue to work as long as the user in the censored country was able to access any SSL-enabled website, as long as their request happened to pass through a Telex-enabled router.
So far, so good. But this would presumably require an investment of at least several million dollars by any major backbone provider who wanted to try it, by re-configuring their major routers to speak the Telex protocol, and then potentially hundreds of millions of dollars for a sustained long-term effort. (As Halderman says, "We like to envision this technology as a possible government-level response to government-level censorship.") So here's my question: If any backbone provider (or government entity) wanted to go to that trouble to support the cause of fighting Internet censorship, why wouldn't it be much more straightforward for them to just set up proxy websites themselves?
Professor Halderman didn't respond to my inquiry on that point. The Telex FAQ notes that censorious governments can easily block new proxy sites once they find out about them. But in many censored countries, most proxy sites are not blocked, either because the government isn't trying, or they can't keep up. In China, hardly any proxy sites are blocked at all, as the government seems to put more of their resources into suppressing local dissent directly. Meanwhile in Iran, the censors do put more resources into actually blocking proxy sites -- but because Iran is on the U.S. State Department's embargo list, Iranian censors can't buy Internet censoring software from U.S. companies, so they have to find and block the sites themselves. As a result, newly released proxy sites often stay unblocked longer in Iran than they do in other Middle Eastern countries that use U.S.-made blocking software. Meanwhile, Saudi Arabia, for whatever reason, doesn't seem to block proxy sites at all for the time being. (Saudi Arabia is a strange outlier, since most conservative Islamic countries that filter the Web, also block proxy sites as well. It's not clear why Saudi Arabia doesn't.) So if a government or a philanthropist wants to help the cause of fighting censorship, just set up some proxy sites and pay to keep them running -- and you'll be helping the residents of all of those countries right away, for starters. This is in fact what Voice of America (through their various proxy programs) and the founders of UltraSurf (a privately funded network of anti-censorship servers) have been doing all along.
Even in the case of countries like U.A.E. and Yemen that are reasonably quick at finding and blocking proxy sites (as a result of using Western-made blocking software), the most cost-effective way to help these users is probably to set up more proxy sites, hosted at different locations and with perhaps with legitimate-looking "decoy" content, so that U.S. censorware companies can't keep up. My experience has been that the more money you spend (using unique IP addresses, buying .com domains instead of cheap .info ones, and setting up lots of proxies so that each one is sent to only a subset of your target audience), the longer the proxy sites last. You can also use proxy-like services (such as Tor, Hotspot Shield and UltraSurf) to route traffic through dedicated servers, to circumvent censorship in a way that is more transparent and convenient to the end user.
In short, existing proxy sites (and proxy-like services) do the job pretty well for many censored countries, and a massive cash expenditure on setting up more proxies (equivalent to the cost of setting up the Telex system) would probably be enough to demolish all other national filtering schemes completely. The software and tools to run proxy sites have already been tried and tested; all it takes to run them is money. Telex, by contrast, would require backbone providers to alter the architecture of their systems -- which means large-scale testing, isolation of any problems that arise, and countless other potential headaches. And that's not even counting the fact that censorious countries might detect which backbone providers are using Telex, and block all traffic from their countries to any sites hosted on those networks.
So I think Telex is a brilliant technical achievement, and I'd be happy if it got deployed, but I'd be scratching my head as to why the backbone providers (or the government, or whoever sponsored the effort) decided to kill a gnat with a flamethrower. I deal in flyswatters for a living, and they get the job done.
Telex is already defined...find another name.
I appreciate the idealism and effort of this author, but why the fuck should he be trying to involve himself or be so concerned over other countries issues with respect to censorship?
Some countries and their respective governments don't have the same western notion of free speech, I think its only fair we stay out of these fights. Why do outsiders think they know what is better for their countries?
Its too bad, but I think we shouldn't be trying to help get around their laws and ways of life.
"Telex" is something completely different. I can't take someone seriously when they make that sort of schoolboy error. You might as well call it "Microsoft".
What is hindering the oppressive regime to install its own telex-routers at the boundaries and filter out all telex-requests? Or, to use the analogy: why shouldn't the regime just block all coloured envelopes?
I thought this was an article about the old terminal program for calling BBSs.
There is that delicious part about TOR (Telex-On-Radio).. Acronym overload is imminent.
Came here to say this. Reusing names within the same field is fail. If you cannot be bothered to google a term to make sure it is relatively unused, you are lazy. When you work in electronics, computers or communication and don't even realize there is a protocol called Telex already....
It would be like someone say I have a great idea for a computer. We shall name it UNIVAC...
The traffic is secure but the destination is not, benefit is minimal.
Can't the oppressive regime modify and install some of these routers themselves and use them to figure out who is trying to access "banned" websites? Sure, they might not be able to read the communication itself, but simply going to a banned website is generally enough to find yourself in prison.
These telex routers might help things along, but they don't solve the problem.
Also, this assumes that encryption is even allowed in the first place. Simply sending traffic with SSL is some places might get your arrested, even if you're not visiting a banned website. Remember when RIM was going to be kicked out of Saudi Arabia until they agreed to give the government the ability to decrypt every transmission over their network?
There is that delicious part about TOR (Telex-On-Radio).. Acronym overload is imminent.
You mean TBNTT (Telex, But Not That Telex)?
Please. The correct phrase is Frequent Slashdot contributor Bennett Haselton.
Seriously Telex is not only a brand name of communications equipment, but its also a name of a very old and still used protocol.
These comments are my own and do not necessarily reflect the views or opinions of my employer or colleagues...
Has survived for decades and still lingers on today in special situations, thanks
Bennett Haselton is an idiot. Read some of his bullshit trying to defame judges (www.judgejokes.com) and it's clear how little he actually understands.
I don't believe Telex could work. However whatever Bennett Haselton thinks about US judges has nothing to do with the reasons why. If he had a few bad experiences and decided to mock a few power-mongers publicly then good on him.
Tint
Telex is not telex.
Viable Slashdot alternatives: https://pipedot.org/ and http://soylentnews.org/
Error: Symbol 'Telex' already defined.
If the only way you can accept an assertion is by faith, then you are conceding that it can't be taken on its own merits
It would be like someone say I have a great idea for a computer. We shall name it UNIVAC...
Great idea!
Tint is not TECO!
Dilbert RSS feed
Yeah right, after all that huge effort to get ISPs in variouss places to spend money installing something their own customers don't use, the censoring government just aquires that hardware themselves and drops everything that it detects having "telex" crap in it (and sends the thugs to kick down the door of the guy sending the request).
I'm inclined to agree with your analysis (though I wouldn't have been as harsh about it) as it seems Bennett missed a critical point:
Upkeep on a Telex-enabled system would theoretically be much less than with a coordinated proxy system used to "outrun" censors. The advantage to Telex is that -- barring a flaw in, say, RSA or PGP PKI -- all that's needed is one public key and a minimal application which handles the client-side logic, or in simpler terms, two files which would remain static barring either a leak of the private key, a cryptanalytical break, or a discovery of every Telex interceptor, all of which would happen far less often than the blocking of a proxy but would be as easy, if not easier, to correct.
Heck, the facilities for this still exist. The NSA intercepts and conducts deep packet inspection on packets throughout the vast majority of the Internet. This would be a bolt-on fix, and no one would have to know the NSA did it.
If the end result of the same initial investment in either Telex or Proxies would be the downfall of most (or all) censorship systems, why not go the route that saves on upkeep?
Viable Slashdot alternatives: https://pipedot.org/ and http://soylentnews.org/
It may work in other places where the government has not power over the ISP's, but in the US of A, as of yesterday, your online activity is recorded with the help of the ISPs, so good luck trusting you can anonymously do anything online, even if they tell you it is safe. I just do not think there is any polytical will to enable this type of systems. It is not much better in other countries. This really hurts; the US use to be a bastion of personal freedoms, but of lately, the government seems to be against its own citizens on this.
So you want a router on level 7 that does a asymmetric crypto on every client_hello that's passing by. Even if such a machine existed and the border ISPs were compensated for additional costs caused by it, I doubt they'd put up with it. Traditional technologies like TOR or VPNs are already available and seem a lot less insane than "Telex".
Bennett Haselton
Supplying finest chutneys, jams and marmalades to the discerning gourmand since 1853.
Ask for it by name. Accept no substitute!
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
As I remember from the election days in Iran, they used to delay routing SSL packets to make those who use proxies hidden under https miserable. This won't work because once they realize you have a successful path out of censorship using SSL, they will block SSL all along or use custom SSL certificate roots (which users should use because basically that's their only option). As long as you are using their pipes, there won't be a (successful) way out of their censorship.
They might not have the right type of paper tape. You can always encrypt the hole patterns in the paper type if they do. At least if you are talking about the Telex that I and most of the rest of the world talk about when we use the word 'Telex'.
-- I ignore anonymous replies to my comments and postings.
Proxy's and VPN's are businesses. They make a profit. Our VPN and that of our closest competitors alone serve 100.000+ users in censored countries. This is quite an incentive to keep things running, and cost really isn't an issue. At all.
Who will pay for Telex?
This does not really fight censorship. Sure, it prevents third parties from being able to censor what goes through the system, like communications out of Syria for example, but it puts control of those communications into the hands of those that control the Telex system which is the ISPs and the makers of Telex. There is nothing to prevent them from censoring, or from altering the data, or simply using it as a way to track you.
If you are a reporter trying to get a story out from behind a warzone, then yes, I would recommend such a system, otherwise, stay away from it.
There's no reason why these governments wouldn't require all traffic to go through a "transparent proxy". All they have to do is make a government CA in your browser mandatory (which many have already actually) and re-encrypt all connections while filtering them. Without it your connection simply gets blocked. Yes this costs a lot of resources but you're talking about something that would receive military-style budgets given it's purpose. In the end it's Cisco eating two sides of the pie and everybody else just wasting more money.
Or, perhaps, I want to make a new operating system that can run multiple copies of Unix. Though I want the name to mean something other than just a play on Unix. I'll change the last couple of letters and call it Multics for "Multiple Computer Servers"...
Now I've finally got a use for the ASR-33s in my garage! Will the rotary-dial one work with this?
There is an old tradition of airport telex machines (still in use today) being used to communicate with the outside world in the days before the Internet. Just before a massive crackdown, dictators would shutdown all phone lines going out of the country but overlook the airport telex circuits.
This is a boring sig
Missing a critical point is a common theme in Haselton's opinion dumps. I used to have a lot of support for him when he was raising the alarm on Cybersitter and the specter of censorware with very strong political leanings, but he went out to lunch years ago and hasn't come back.
Maybe there are some billionaires out there who want to throw a few bucks at this? BillG, RichardB?
"If any backbone provider (or government entity) wanted to go to that trouble to support the cause of fighting Internet censorship, why wouldn't it be much more straightforward for them to just set up proxy websites themselves?"
The answer to this question is simple: the government won't set up proxies because proxies are trivially detected and blacklisted via automated scanning and DPI. China banned the entire Tor network in a day and has 24 hour response time on new "stealth" Tor nodes. Even if you spun up a million proxies in a day, DPI would find them all on the first request and add them to the blacklist. The next generation censorship technologies sold to China by Cisco have effectively removed proxies as a viable technique.
"Telex", on the other hand, unless it can be detected by scanning (and this is a key to-be-researched point), forces a censorship regime to choose between an entire routing path and censorship. Say, for instance, it was installed at the single transatlantic cable that pops out of the Pacific in San Francisco. China would have to make a choice between allowing access to any site in America and censoring their people. They would be forced to turn off the entire link. That is a HUGE impact for a modest technology.
The final mistake in this essay is the cost estimate of 100 million dollars. Look how much NSA spent installing a full tap in the same NAP where this cable enters SF. You could do this for 100k - and the reasons why escape the author, and the minimal importance of this post.
I will say however that the failure to grok displayed here is hilarious.
Why don't you believe it would work? The steganography itself is encrypted: it can only be detected by one holding the private key. Chat-enabled gmail produces enough https traffic that if Google installed Telex servers, there'd be plenty of capacity for legitimate use (that is, not downloading gigabytes of kiddie porn). If this had government / ISP backing, it'd be highly effective: the "message in a bottle" problem goes away if you know your destination will catch the message.
The only problem I see so far is that it appears that the user needs to trust the Telex server operators. For example, if a curious American citizen uses Telex to obscure their visits to al-qaeda websites, it can likely be traced back to them. Am I missing something?
It is all explained here.
Hey KID! Yeah you, get the fuck off my lawn!
Two reasons this won't work spring to mind:
1) This requires core routers to attempt decryption on all SSL traffic passing though them. This is deep packet inspection on a scale the Internet has never seen and would require massively expensive router upgrades, if it's even possible at all. The companies expected to carry out all this work get no commercial benefit for their efforts. It's unlikely anyone else will pay these companies to do this work.
2) The whole security model relies on a secret key being held on a massive number of different core routers, should this secret key ever be leaked anyone with it can detect that secret data is being sent. It won't be possible for either side in the communication to know if this is happening. You want to use this against China? Guess who built the hardware that holds the secret key?
In the future all websites will be licensed. This allows the government to yank the site license whenever the holders break a law (or for any other reason they can think of). Everyone else won't care because they don't have a web site. Win/Win!
. . . it doesn't help when the entire country has an Internet kill switch. The average teenager in a country who needs this has been dodging filtering since middle school; political activists have been keen to alternatives for years. Blocking Facebook and Twitter in Egypt taught the entire nation about Tor.
The people who really need and want unfiltered content know how to get it. I'd rather see work on wireless meshes and other alternatives, that will benefit everyone including the US as it becomes a more facist state than it already is.
Yeah, but is it Linux?
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
As someone living and working in China, I can tell you that Bennett Haselton's size http://peacefire.org/circumventor/ is currently unreachable in China.
Once I use my personal proxy to get to his site, we find a link to a "Circumventor" site, http://www.mousematrix.com/. But after clicking the MouseMatrix link, it redirects to http://www.stupidcensorship.com/, which has the following message:
This IP address range has been blocked from accessing our server due to abusive traffic.
If you are a human who has been using our website, then you personally are probably not the reason that this IP address range got banned, so please send an email to bennett (at) peacefire.org with the subject line 'allow access', and include your IP address: 221.220.52.152
Sorry for the inconvenience and hopefully we can restore your access soon!
Now THAT makes a lot of sense. Block Chinese IPs from using your proxy service.
I think this guy is just an ignorant hater. Who is he? He has no technical background, and his ego is hurt when someone with an actual working solution comes along. He claims that proxies work, but they don't, not even his own. You can put thousands out there, but there are tens of thousands of people in China working for the GFW that can block them all, and that is the status quo.
Please don't give this guy any more time and front page space.
LS
There is a fine line between being a cultivated citizen and being someone else's crop. - A. J. Patrick Liszkie
I don't think Telex is the right approach, but it offers one important benefit over the proxy approach: deniability. It may be true that regimes don't block all proxies. But if they decide to check up on you, they can see that you are using one of the censorship evasion proxies and punish you. With Telex, it appears that you are communicating with a legitimate web site; the only way to know otherwise is to crack the encryption and see that there's a message intended for Telex.
Getting help from ISPs isn't the only way to accomplish that. For example, if you could convince major players on the internet to run Telex-like systems _on their own machines_, then a user would have deniability because they could claim they were using the legitimate services on those machines. E.g. this might be a nice thing to put Google's 900,000 servers to work on, and would be a nice payback for last year's China hacking scandal.. Or something that all American universities could do in the name of free speech. The obvious way to block such a system would be to block the hosting site, but that may force the censor to cut off access to useful material (e.g. the teaching content on American university sites).
But it doesn't stop there; a censor could set up an SSL proxy and force all https traffic through it, which would allow them to decrypt any communication and look for suspicious side-requests. That's why we built a system a few years ago that disguises the subversive request in plain sight as a sequence of standard web browsing requests (and hides the response in images), without relying on SSL at all.