Slashdot Mirror
China Tells Carriers To Block Access to Personal VPNs By February (bloomberg.com)
China's government has told telecommunications carriers to block individuals' access to virtual private networks by Feb. 1, people familiar with the matter said, thereby shutting a major window to the global internet. From a report: Beijing has ordered state-run telecommunications firms, which include China Mobile, China Unicom and China Telecom, to bar people from using VPNs, services that skirt censorship restrictions by routing web traffic abroad, the people said, asking not to be identified talking about private government directives. The clampdown will shutter one of the main ways in which people both local and foreign still manage to access the global, unfiltered web on a daily basis. China has one of the world's most restrictive internet regimes, tightly policed by a coterie of government regulators intent on suppressing dissent to preserve social stability. In keeping with President Xi Jinping's "cyber sovereignty" campaign, the government now appears to be cracking down on loopholes around the Great Firewall, a system that blocks information sources from Twitter and Facebook to news websites such as the New York Times and others.
How will business users be impacted, since they will typically need to use a VPN if working remotely?
At the same time I wonder how long it will be before the mouse works out how camouflage the VPN access? It really is a cat and mouse arms race.
Jumpstart the tartan drive.
President Xi should study his people's history. Every dynasty eventually loses the 'mandate of heaven'.
The biggest surprise here is that this loophole hadn't been closed down years ago.
"That's the way to do it" - Punch
Whenever something unpleasant happens to human rights online, a lot of people shout, "Just use a VPN, and all your problems are solved!"
In a small way, they're not wrong. But this misses the big picture: VPNs are few and easy for centralized authorities to block. The ultimate answer cannot be narrow and fragile circumvention measures. It has to be a robust, decentralized, and authoritarian-resistant internet architecture. It needs to be all-or-nothing: either authoritarians block the entire internet, or none of it, because all content is safe from snoops and they cannot tell the things that please them, from the things that displease them.
VPNs are at best a fragile workaround for a systemic problem. And what's happening in China can easily come to the USA and Europe, because terrorists and because the children. The technical community has to take back the internet, before it's too late, or we will have lost the most important revolution in human communication to happen since the printing press to authoritarians.
Network engineer here. My theory is that any blocking attempt where the users seek to avoid being blocked is doomed to fail unless literally no traffic of any kind (even DNS etc.) is allowed through. This is because all serious network kit uses ASICs to achieve acceptable performance at the cost of flexibility, but all the endpoints are CPUs that are inherently flexible. If the users have an orchestration system that allows the developers to change the protocols as and when, and they play to the weaknesses of ASICS, the network vendors will never be able to keep up. Anytime you let any traffic through whatsoever between two parties you don't fully control, it's game over for your perimeter. Hurray!
Wait till their real estate bubble pops. It's going to be ugly as fuck.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
...what are they afraid of them learning on the open internet?
Also, if they block VPNs, then the people will just start tunnelling over SSH. Can they block all VPN an SSH connections? That would basically disable a huge portion of the internet.
They don't have to. They just put you in jail or worse you if they catch you using a VPN.
"The government now appears to be cracking down on loopholes around the Great Firewall, a system that blocks information sources from Twitter and Facebook to news websites such as the New York Times and others."
So China is protecting itself against communist, leftist, progressive, NWO fake news? Are they "MACA" (Making China Great Again)?
As for the inevitable snowflake trolls that will moderate this down - Are you familiar with the concept of self-fornication?
"I say we take off, nuke the site from orbit. It's the only way to be sure."
China is playing an open-ended game of Whack-a-Mole with it's citizens, with the global Internet as the venue. It's obvious that Chinese citizens want free and unfettered access to the Internet and all the information on it. The communist Chinese government can keep trying to deny them, but just like with copy protection schemes, DRM, and all other censorship-like things, people will find a way around it.
Memo to Communist Chinese government: You can't stop the signal. You're going to fail; it's inevitable. Why not give up now, and stop oppressing your people? When the revolution comes, are you going to change, or are you going to fight the future, and go the way of Bashar al-Assad and start slaughtering your own people en masse? It's up to you how History will view you, China. Choose wisely.
Just recently it was reported that China will start censoring videos on certain video platforms, taking down content that criticizes the government or depicts LGBT people. http://www.independent.co.uk/n...
People were saying it wasn't a huge deal because citizens "mostly use VPNs anyway" to access foreign videos, but this kinda throws a wrench in that plan.
This looks a lot like what happens in mid-eastern countries like Saudi Arabia, where you can get fined $50K US for using a VPN. It isn't a security issue so much as they do not want people not paying the local voice carriers the $6 US/minute or whatever for voice communications. The owners of the carrier are typically relatives or close business associates of the ruling government.
China of course want to monitor online political activity so they want to make sure that nobody can post online content anonymously. I suspect even with them that is the second reason.
The more will slip though your fingers...
China will eventually faced with the prospect of just disconnecting from the rest of the world or giving up on censorship. Depends on if they want to turn into a huge version of North Korea or not. I'm guessing, not.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Any Chinese person I know would scoff at that threat, only Americans are so dedicated to law and order.
Americans aren't the ones with the giant firewall. (Our government is more subtly evil in how it spys on us) You seem to have missed the point. The point isn't that the Chinese government will catch everyone, merely that they will deter VPNs through threats of jail and/or other punishment. I'm sure lots of people will ignore the laws but the stakes just got higher.
Breaking the law is a way of life in many places (and in some places in the US, ask any NYer).
Every citizen breaks the law dozens of times a day. Nevertheless the punishments for some "crimes" are much harsher depending on the locale. China punishes some stuff harshly that wouldn't even be a crime in the US, particularly political dissension.
...what are they afraid of them learning on the open internet?
All kinds of things. But they are actually more afraid, believe it or not, of the power of social media to encourage wild cat demonstrations against the government. The main job of the CCP (Chinese Communist Party) is not really to make China better. They do want to do that, but the main job is to protect the CCP itself at any cost. Did you know that the Chinese constitution (yes, they have one) actually has something in it pledging the military (so called People's Liberation Army) to protect the CCP? Not the country. The CCP. Anyway, things China doesn't want its citizens to know, include...
1) The truth about the government surpression of the 1989 Tiananmen Square protests. By the way, these are known in China as "the student protests of 1989" or "the student protests of June 1989". If you use the term "Tiananmen Square protests" to people raised in China, they may not know what you are referring to.
2) Anything at all about Falun Gong. Different sources disagree on exactly why the PRC (People's Republic of China) has a problem with it, but it may mostly be because it showed years ago a very strong ability to have large numbers of protesters show up and the CCP fears being overthrown in a spontaneous revolution.
3) Information about corruption by government officials and their family members as it threatens the stability of the CCP.
4) Any meaningful contact and knowledge of Taiwan beyond the superficial because greater knowledge of Taiwan's democratic processes are a threat to the CCP's very existence.
That's not a complete list but it'll do for here. You can see a general thread of paranoia in everything that the CCP might be overthrown quickly by a spontaneous protest that spins out of control faster than the PLA can stop it (and some members might join in anyway). It's not really aimed at secret keeping so much as making sure people can't organize to overthrow the government.
Don't give Theresa May and Amber Rudd ideas.
Zone Transfer.
This is how one DNS server shares its list of DNS entries with another. The transfer could also include a bunch of TXT records with cleverly included "certificates" as part of its payload.
I am thinking all that Facebook has to do to make WhatsApp global would be to sponsor one of the root servers that can use UDP 53 with cleverly encoded TXT records for the transaction. It would also work for DNS delegation where direct connections are not possible.
The Roman Rule: The one who says it cannot be done shall not interrupt the one who is doing it.
"orchestration system"? What on earth are you talking about, that won't solve anything.
Real System Engineer here, this has already been happening for years. China can and does block VPN users, it's just they don't have a complete crackdown on it yet. We _do_ have employees in China who are kept behind internal walled gardens due to that.
In case anyone else has been asleep the last 10 years, VPNs are very easily detectable, as is SSH. The problem is with the initial exchange, it's all in clear. Try it, mitm an ssh between two hosts, you'll see a banner like
Edit: Appears Slashdot eats this with packet headers.. trimmed.
Followed by at least three other packets while the negotiation happens. There are in total at least a dozen strings one could trigger on. It's all by design too.. And yes, HTTP has the same problems.
This idea that VPNs are somehow an answer to censorship is ridiculous. The very organization whom were supposed to prevent these kinds of BASIC attacks, shrugged it off either because they were paid to undermine it, or incompetent.
Capatcha: privacy.
limiting the rate of queries to 1 query per second.
Great, now every web page takes several minutes to load by the time you look up all the caching servers, ad networks, and social network scripts.
As a frequent traveller in China :
1) Incorrect for the people I deal with
2) As above
3) To some extent, but it is still discussed
4) Taiwan is a funny thing, but I discussed it many times, and the locals seems well informed. ( I am often in Xiamen, very close to Taiwan - in viewing distance...)
BTW: All major hotels in China has their own VPNs, so I can access EVERYTHING when on the hotel network. Be it in Shenzhen, Qingdao, Xiamen or Ningbo....
I will wait to see this go away.....Wont happen....
You don't have to block 100% of the traffic. Just 5-10% (with logging) can be a sufficient deterrent. About the only way around it is a peer-to-peer network on both sides of the firewall where the amount of external data transfer is limited, but they don't necessarily need to allow local VPN traffic either.
Chain has also just started a program that makes it very hard for foreigners to renew their residence permits too. They are starting to use a point system that is all but impossible for most of the foreigners to be eligible. The Resident permits for all non-Han worked have been one year permits; so there is a near exodus of foreign workers going on right now.
You should be able to stealth your VPN behind a legit appearing website.
Same IP, same port
And if you feared that happening, what would you do about it? Today's idea: install Great Firewall to control most peoples' media, and by extension, their thoughts.
"Believe me!" -- Donald Trump
As the IT manager at a company that has a sister company in China this sucks. As it is they block DropBox, OneDrive, Google, etc. which makes transferring large files a pain in the ass. They are also trying to force everyone to use WeChat which I don't trust at all, so I'm expecting Skype to have even more issues then it does now when using it in China. They really make life hell for IT who have to deal with them and this will be the icing on the cake. I don't understand how they intend to do business globally if they keep making it so difficult to deal with all the restrictions.
So relax the rate limit for queries that can be answered from cache.
Whose cache? Does China already block the use of 3rd-party DNS servers?
While I love SoftEther and the VPNGate project... if all traffic from x-node is going to the same route, it likely is a VPN. The next phase of VPNGate is to make bouncing nodes and fake traffic with a huge number of servers or cloud providers. Have real, popular, sites hosted on the same https paths, etc. Have those sites implement a push notification system on them, so there is always a constant need for open sockets, etc. I'm just throwing out ideas, but SoftEther, alone in it's current state would not be enough.
2400 baud? You mean the BBS or internet Dialup circa late 80's? Oh yeah, NOBODY used that... lol
You should buy condos in China. It's a good investment!
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
So do it. Talk is cheap.
The Chinese are babes in the capitalist woods. They still think keeping their currency low for all these years was a good move. I predict a Chinese revolution inside 10 years, after their savings evaporate. It's going to be _ugly_. Central committee members children will be hanging from lampposts.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
Everybody in China want's land (or real estate anyhow). It's cultural.
Unfortunately for China, they are parking their money in a huge bubble. Their big cities are massively overbuilt to shit construction standards.
The truism in real estate is the real value of property is the loan that rent would cover. In China that's about 10% of the current market price. Chinese people often keep investment properties empty as the rent doesn't cover the added cost vs just leaving it.
China has a government set currency peg. It's not priced on any market. They don't need to buy their currency to keep it up. They just set the peg. They are currency manipulators.
As to educating yourself I suggest Googling 'China Currency manipulation'. In recent years China has made efforts to keep it's citizens from getting out of the yaun. But Bitcoin. IT IS GOING TO BE UGLY.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'