Slashdot Mirror
China Cuts Off Some VPNs
jaa101 writes The Register (UK) and the Global Times (China) report that foreign VPN services are unavailable in China. A quote sourced to "one of the founders of an overseas website which monitors the Internet in China" claimed 'The Great Firewall is blocking the VPN on the protocol level. It means that the firewall does not need to identify each VPN provider and block its IP addresses. Rather, it can spot VPN traffic during transit and block it.' An upgrade of the Great Firewall of China is blamed and China appears to be backing the need for the move to maintain cyberspace sovereignty.
It doesn't help that most VPNs are so easy to detect and block at the IP header level. PPTP depends on the GRE IP protocol (47), and L2TP is usually tunneled over IPSec, which depends on the ESP IP protocol (50). By using different protocol numbers in the IP headers, the designers of these protocols made it mindlessly easy to block them, and made them harder to support, because routers have to explicitly know how to handle those nonstandard protocol numbers.
Check out my sci-fi/humor trilogy at PatriotsBooks.
Help me understand your point of view. We run liberal democracies here in EU. We do block some things based on cultural expectations, and in some cases, because certain foreign power that shall not be named forces us to do so typically through government corruption on high level as shown in leaks by certain man who now resides in Russia.
But on the principle, we still consider freedom of speech to be of paramount importance, and unblocked internet access to be an important cornerstone of this principle. As you point out we do make some deviations from the principle, but these deviations tend to be based on rather awful historic facts and are very much targeted.
Chinese model is about denying large portions of free speech, such as political non-threatening free speech of political dissidents to improve social cohesion of their society. How is it hypocritical to criticize this aspect of Chinese society from European point of view? We very clearly differ here, and there is no hypocrisy at play. Our blocking is targeted, specific and based on history. It specifically makes a point to avoid suppressing political dissent when at all possible. Chinese is pre-emptive, overly broad and its main intent is suppression of political and social dissent.
I fail to see hypocrisy. Please point out the mistake in my logic and explain how exactly this critique is hypocritical.
Where I work, you don't do anything with company-owned data unless it's on the corporate VPN.
It's one of the world's 5 largest software companies, does billions in business in the PRC annually, and it's not Microsoft or Apple.
I do not think when I visit China next month that I will find the corporate VPN blocked. It certainly isn't being blocked right now for my colleagues who live there.
Il n'y a pas de Planet B.
There is an interesting irony in this. In China, which to my own opinion has been historically more oppressive, now you have the engineers and the scientists in charge of government (true) while as in Europe and the Americas, we have lawyers and businessmen in charge. It appears as though China is taking a technological approach to solving its perceived problems, such as searching for keywords, blocking, defeating TOR and the like, while in the West, our governments appear to be bent on passing laws and ordinances that tell companies and ourselves what we can install and use and how we must use it so we can justify charges c.f. recent attempts to codify in law backdoors into tech companies products and hiding what they are doing. The overly broad laws in China do not change but the technology is not as well hidden and grows. For example, China has setup fake Apple stores (this should be a warning) so that once an iPhone is jailbroken, it becomes easier to install malware on that person's iPhone in order to spy on the user to see if they have broken these laws. The government puts much effort into catching people without knowing they have committed a crime. In the West, laws are changing too fast and laws have become overly specific instead of broad. Nobody likes being told over and over which task to do and nobody likes being told how to do a task. The Chinese know that what they are doing is unpopular, but here, the government has to hide because perception will be that they are not doing the right thing if they are discovered, which says a lot about what they are doing. The government here seems to care more that they are doing the same unpopular things, but that have a history of goodwill which they are destroying, so we can continue to say "Here in the West". This should be a warning sign.
Society use your Sciences
Look up packet inspection.
You don't have to look at much of a packet to see if it belongs to one of the common VPN implementations. You may not even have to go that far, a lot of volume on a port that doesn't belong to expected traffic is a bit of a giveaway.
Yes you could do something weird and roll your own VPN protocol, based on email traffic or whatever way you hide, but that's a lot harder than just changing ports.
Then think of the mindset of who you are dealing with. It's not so hard to deny everything you don't recognise so long as you don't care about blocking legit traffic by mistake.
When free speech threatens innocent lives
It doesn't. Actions threaten innocent lives. Rape, physical assault, believing and acting on baseless rumors in harmful ways, and murder are harmful. A video or picture is only subjectively offensive at most.
these things should not be allowed in a free society for damned good reasons.
The society you want is not free at all, as it places restrictions upon one of the most fundamental rights based on completely flawed reasoning.
And if anyone thinks they should be, let them and their loved ones be the first victims
Victims of freedom of speech? You need to learn the difference between action and speech.
All I can say is that as long as authoritarians such as yourself exist, we'll need to continuously improve technologies that help us keep our privacy to reduce the risk of being harassed for saying things that you don't like.
I was just in China a few days ago. Was there for 3 weeks prior to that. I have a VPN setup in my apartment back in the US and I typically dial in to it. It was great for the first two weeks and a half weeks. After that, it would fail to authenticate or work really slowly, randomly drop traffic, then disconnect after a minute. I was using a relatively insecure PPTP system with 128 bit encryption. I wasn't worried about getting spied on, I just wanted news, youtube, and social media unblocked.
Frustrated, I had a friend set up a PPTP link at his apartment, using different keys and a different IP. That worked perfectly for the last few days I was in the country. So they're definitely doing some kind of long-term traffic analysis over many days, and then blocking close to real time after that (30-60 seconds).
Basically I got to witness the blockage go into effect. Yes it's real. Yes it's general purpose, not a high level block on specific free websites. Yes it was a huge pain the the ass.
Greetings from China. I don't live here, just working here for a few months.
Corporate VPNs work just fine.
Many non corporate VPNs work just fine too.
Actually I'm not seeing any problem. Both my OpenVPN connection on TCP port 443 (good luck blocking something like that without breaking the internet), and my PPTP connections to a Canadian VPN I subscribed to before I left still work just fine. L2TP has been sketchy from the get go but that was listed in the VPN's FAQ as well. Also China appears to throttle UDP traffic quite heavily so TCP based connections to the USA seem to be most reliable for me.
Basically I haven't seen any change in the past month or so.