!chapotraphouse@hexbear.net will love this.
After a discussion that lasted for way too long, it appears that they like censorship.
They think that this is a perfectly reasonable argument: https://youtu.be/QFgcqB8-AxE and that the government knows better and thus information should be suppressed.
Absolutely ridiculous…
Here is an alternative Piped link(s): https://piped.video/QFgcqB8-AxE
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I’m open-source, check me out at GitHub.
!chapotraphouse@hexbear.net will love this.
yo thanks for the hookup was looking for another based instance
subscribed!
Peeps on hexbear are atrocious
Yes they are. And they shadow delete comments! That’s after several of their members straight up sent abusive messages to me. I of course reported them. That’s when I noticed my comments deleted.
I’m not too worried about it. If that’s how they are with others, their message and community won’t reach far. Fuck em
I would love to see true metrics on what percent of them are Russian, Bots, Eastern European and people living in western countries… considering every other comment from that instance seems to simply be “fuck the west”
Can someone explain from a technical standpoint how they can block OpenVPN running on port 443? my admittedly limited understanding is that port 443 is the common port for https. If they blocked that port wouldn’t that mean that they would be blocking nearly the entire internet?
From my understanding, they are most likely just blocking the defualt port of wireguard / openvpn and IPs associated with the VPN servers of VPN providers they dont like.
If they wanted to block VPN traffic over 443 to any IP, they would have to do deep packet inspection, which I would imagine is infeasible for Russia.
Supposedly, the Chinese great firewall does use deep packet inspection, so it is possible to do this at the country level.
They specifically mention it’s on the protocol level which would imply it’s doing more than just blocking some ports. Not sure why you’d think China could pull that off but it would be infeasible for Russia?
I don’t know what they actually do but one possibly is to look for (absence of) the TLS handshake. Or maybe they simply infect all devices on the Chinese market with MITM certificates to be able to decrypt all TLS encrypted traffic. Should be easy to force companies to do that in such a country.
The port isn’t their focus, they’re looking at the protocol that is being used, regardless of the port. The protocol is still visible when not doing deep packet inspection. That’s why there suggesting a socks proxy for Russian citizens, because that uses HTTPS to tunnel traffic, so it wouldn’t be caught up in protocol analysis.
can you maybe link some ressources on how the protocol used can be detected? i did not know about this and would like to read into it some more :)
Look up NBAR for the basic idea. Each vendor has their own ‘secret sauce’ implementation, Palo Alto only needs 9 bytes of payload for disambiguation, iirc.
thank you! so it is basically looking at identifiable patterns in the packet flow and matching them to protocols. i also found this paper about traffic identification interesting.
Time to up the spoofing game. Maybe some AI-generated traffic to throw off the packet analytics.
You can analyze the traffic, detect common patterns and also detect source of the request. Russian IT specialists are now using very complex solutions to come around the block which work a lot like MITM attacks.
annnd another dictatorship box checked off the list… wont be long now
Until what? Until Russia is a dictatorship? That ship sailed a long time ago.
Until he stops pretending?
Didn’t he say that’s so sure to be re elected that it doesn’t even need to waste money on useless elections?
Won’t be long before Putin catches up to Kim Jong Un in the Oppression Olympics
No drug testings pls
Still wouldn’t be able to catch up with the US, they are gold medalists
This is utter nonsense. If the US was a dictatorship, I wouldn’t be scared to death of the upcoming elections.
Ask anyone who lived in a US controlled military dictatorship if they are scared of the upcoming elections. (Read the Jakarta Method by Vincent Bevins). Besides, both parties are bought out by the bourgeoisie of you country, so nothing is ‘dangerous’, about voting since it will serve the same interests either ways.
I have never before encountered someone who used the word “bourgeoisie” unironically. So cute! Now say something about the proletariat and the means of production!
How about I say that your country will collapse in the next 30ish years, while the rest of the world celebrates. Hopefully you can enjoy the horrors of war that you inflicted in so many places.
The US has some serious issues with corruption, but it’s FAR from a dictatorship, lol.
You are talking to someone who has Stalin’s portrait as his avatar. You might not want to be investing the time into talking to him.
That’s ok, just know that we are the biggest left wing ideology and cry about it
It’s getting there though due to what Trump did. Hopefully people have the smarts to vote in the next election.
Highest prison population w/ privately owned prisons, besides the elite class of your country controls what happens in your country (media included), you have no say in it.
That would be a oligarchy, not a dictatorship.
So you admit the US has the same form of governance that Russia has? Also you could argue that all parliamentary ‘democracies’ are oligarchies or as Marx said ‘dictatorship of the bourgeoisie’
The dollar rules in the US. That is 100% true and is definitely not a good system. However, that doesn’t make it a dictatorship unless you consider money to be their dictator.
Money cannot be a a dictator, it’s just pieces of paper with value, however the people who hoard it in massive amounts and use it to exert influence on the system, resulting in laws that favor them and their companies, are.
besides the elite class of your country controls what happens in your country (media included), you have no say in it.
Is there any state, current or historical, that was not a dictatorship according to this metric?
Edit: ignore the question, I noticed the Stalin profile pic
It was not working 2 day on mobile operators, now waiting full shutdown
yup. kinda same experience. tele2. complete shutdown on my vpn.
Shadowsocks worked fine
Shadowsocks is very difficult to block. What provider do you use for shadowsocks?
Is this just address/port blocking, or DPI of some kind? I’m wondering what they can trigger off?
vpn traffic isnt directly hidden, but it can be helped along.
youd need to encapsulate your vpn traffic in a different protocol, make sure you shape your traffic to expected values for that protocol and then avoid known vpn endpoints.
Interesting read: https://www.ntkernel.com/how-to-bypass-egypts-wireguard-ban/
Can this actually work? If you run Wireguard on a non-default port, is it possible to tell that it’s wireguard?
Most open source vpn protocols, afaik, do not obfuscate what they are, because they’re not designed to work in the presence of a hostile operator. They only encrypt the user data. That is, they will carry information in their header that they are such and such vpn protocol, but the data payload will be encrypted.
You can open up wireshark and see for yourself. Wireshark can very easily recognize and even filter wireguard packets regardless of port number. I’ve used it to debug my firewall setups.
In the past when I needed a VPN in such a situation, I had to resort to a paid option where the VPN provider had their own protocol which did try to obfuscate the nature of the protocol.
Chinese firewall can detect it, AFAIK
Wireguard through gfw worked fine when I tried it. The other client did have a static IP and static Port tho, that probably helped
Gfw is mostly picky about anything udp or where both ports are unknown. Also if the known port (server) isn’t from a licensed block.
Basically there are heuristics that lead to either a reset, a temp block, or a perm block, but it seems to vary from time to time a lot.
Yes ofc they can. The Wireguard protocol is not designed to be hidden.
Interesting read: https://www.ntkernel.com/how-to-bypass-egypts-wireguard-ban/
However will they get messages through??
using a vpn is also illegal in russia since 2017 😅
But also laws don’t really matter in Russia.
well 😅
I’d appreciate a source for that statement. :o
In November 2017, the Russian government passed a law banning the use of VPNs, Tor, and proxies to access unauthorized content. Since that time, it has been used to restrict specific VPN services.
The ban targets VPN providers who refuse to submit data to the Russian government. The threat of bans came in 2019. Two waves of bans followed in 2021, covering 15 VPNs. Only one Russia-based provider is known to have complied with the rules.
https://surfshark.com/blog/vpn-in-russia
https://www.reuters.com/article/us-russia-internet-idUSKBN1AF0QI
I see! So, to quote the sources you provided:
“Despite widespread speculation, the law does not directly ban the operation of VPNs and anonymisers. However, it does restrict access to banned websites with the help of these tools.”
I.e. the VPN providers themselves are not illegal, though the VPN providers technically have to not allow users to access content listed by rospotrebnadzor. That’s responsibility on the side of the providers, not a ban on use. Practically speaking it still is attempting to censor content, but neither of the three sources claim that VPN use is illegal in Russia.
You can argue as much as you want, but the full usage of a vpn is illegal in russia by law, because you could access real informations instead of their bullshit propaganda.
Yes you can install it freely and “use” it to a certain degree to browse on pages uncle Putin allows you, but you can’t use it completely without any restrictions, e.g the definition of real usage in my opinion. So in my understanding the (full) usage of a vpn is prohibited by law in russia.
And they are now actively blocking protocols…so 🤷♂️
Don’t get me wrong, I think those restrictions are horrible and Putin is a tyrant, but it’s irresponsible to say that VPNs are illegal. They are not. People should use them to access alternative media like Meduza instead of accepting that there’s only state media. VPNs are still incredibly useful and we shouldn’t play into the scare tactics of the Russian government by insinuating that you can end up in jail by using VPNs. I think that’s coming, too, but these tools are still available to get around lots of the censorship. As you yourself noted, most of the VPN providers aren’t actually complying with the law, so you can access way more material, without current legal repercussions to the individual, at least based on the sources you provided.
IIRC Pakistan also do this (vpn is blocked by default and you’ll need to submit documentation to justify using VPN if you want to use VPN in your company), though their main reason is to reduce VoIP spammers.
It has got to be better to just make phone authentication better than to hope that nobody in the country is going to spam and then block VPNs to the outside.
This has nothing to do with phone security though. Pakistan is the source of spam calls in many developed nations. Those spam call center operators was able to operate on the cheap from Pakistan due to cheap labors and cheap access to international calls via VoIP, so by blocking unregistered VoIP and VPN, they hoped to kill the spam call center industries (or at least that’s what they tell people when they started cracking on vpn a few years ago, might be legitimate if they’re getting pressure from western goverments to control the spam situation). This will also increase tax revenue because legitimate call centers will have to use licensed VoIP services that pay tax to Pakistan government.
Oh, okay, I gotcha. I figured that it was the other way around, that people spamming from outside Pakistan were targeting people inside.
This is not accurate information. VPN usage is not banned.
Using is not illegal
if you want to use it in its original purpose it’s illegal. If you use a vpn not registered with Roskomnadzor, it’s illegal because you can access stuff that putin does not want you to see.
therefore using a vpn with its normal purpose to create your private tunnel and access what you want is in fact illegal in russia.
Illegal to show how bypass bans, it is allowed to use VPNs
Shithole country
Worse: shithole country that turns everything they touch into shit too.
Bootlicking simply comes naturally to the Russian culture.
Edit: my apologies to the Russian brothers and sisters still fighting the good fight by blowing up Putin’s shit.
Racism comes naturally the Anglo brainpan.
Edit: My apologies to my Anglo brothers and sisters still fighting the good fight and blowing up US government property.
1: Russian isn’t a race, I’m actually being jingoist, you damn racist.
2: I’m Suomi/Celt. Slavs and Germanics can all get fucked, ancestrally speaking, you slaving imperialist pigs.
3:That was clearly a joke, go grow some sunflowers.
deleted by creator
I suspect that if things continue in the trajectory that they seem to be heading, that people from Russia who exit may likely be better-off too, as much as moving countries is a significant barrier.
Wouldn’t those be jobs that typically require advanced education? Why would they want to throw that subset of the population into the meat grinder?
deleted by creator
Good read. So it sounds like your analysis of the situation is that it is short sighted and Putin is simply a Megalomaniac attempting to hold onto power, would you say that is an accurate summary? Or is he just crazy and super optimistic that things will change all the sudden one day?
Because even if you kept all the people physically producing bombs and shells, eventually you will run out of the educated people that run the other industries that support the military industrial system in Russia if this goes on for long enough.
deleted by creator
Proton vpn has a feature that can be turned on for oppressive governments, ‘alternate routing’ I believe. Would that be sufficient or no?
deleted by creator
Theoretically, yes, since there are options other than WG/OVPN available through Smart Protocol, which Alternate Routing leverages.
Couldn’t you just use any server/droplet/AWS instance via SSH to get around this law? Seems much simpler.
If you’re savvy enough, sure. But for the lay person who doesn’t want a clouded view of the world, they likely won’t have the same resources or technical capabilities.
that’s assuming you can get one, which is challenging since most hosting companies don’t/can’t offer services in russia anymore
It’s not without drawback though. SSH tunnel consumes a lot more cpu compared to wireguard. If your vps has a weak cpu, it might not even able to fully saturate a 1gbps connection due to cpu bottleneck on certain ciphers. If you’re using a mobile device, it will drain your battery faster than wireguard.
So it’ll take you 10 minutes, instead of 5, to download a DVD rip of a movie… This limitation would have next to no practical impact on being able to communicate with the free world.
True, it’s not like Russian need to use VPN to pirate stuff anyway.
Wait! You got it. We just encapsule https in the bittorrent protocol!
I was talking to someone from the UAE in some thread on lemmy.blahaj.zone a month back. Apparently, because the UAE doesn’t like LGBT stuff, they block images hosted on that server.
I was seriously thinking there about what it would take to hide a VPN connection, and that BitTorrent Is actually not a terrible choice, as it generates a lot of bidirectional traffic.
IIRC I went looking and some guy did a prototype as his masters thesis some years back.
Lemme see if I can find it.
googles
Yeah.
https://github.com/danoctavian/bit-smuggler
China started killing VPN connections.
watcha gonna do.
bit-smuggler might be the tool for you. keep those pesky internet censors off your back, get your tweets through and read your wikipedia in peace.
bit-smuggler is a tool designed to allow you to defeat internet censorship by tunneling your network traffic through what appears to be a genuine bittorrent peer connection, fooling censorship firewalls into thinking it’s harmless.
EDIT: Ah, now I remember. Wasn’t that they block images, but that they block the server. Gay UAE dude could use a permissable Threadiverse server and federation would let him talk to people on lemmy.blahaj.zone. However, the image-hosting is not federated. If someone put a post with an image up, he could view the text on another Threadiverse server, but couldn’t see the images, because the images don’t propagate to federated servers. The browser still tries to talk to the original server for that.
People in western countries use VPN to hide bittorrent traffics, while people living in an authoritarian countries uses bittorrent to hide VPN traffics. Life is sometimes stranger than fictions.
Very interesting project though. Thanks for mentioning it.
But how are their propaganda farms going to be able to pretend they are in your country now?
official companies are still able to use vpn 😏
Maybe they don’t actually have all those propaganda farms that the dems were crying about, did that thought cross your mind?
Before it was widely reported, Twitter’s geocoding feature showed a ton of Russian-based accounts posing as “Americans” and only discussing politics. Would love to see lemmy be more transparent about accounts posting here too, tbh.
In all honesty, I would expect at least an organized troll farm to use VPNs ending outside Russia.
Random people in Russia might just act directly, but it’s a red flag that’s easy to pretty-inexpensively eliminate.
googles
It sounds like at least the Internet Research Agency troll farm used VPNs.
https://www.bbc.com/news/technology-43093390
According to court documents, the IRA took several measures to hide its tracks, duping the technology companies who were unaware, or unable, to stop what was filtering through their systems.
The key - and obvious - move was to hide the fact that these posts were coming from Russia. For that, the IRA is said to have used several Virtual Private Networks - VPNs - to route their operations through computers in the US. The operatives allegedly used stolen identities to set up PayPal accounts using real American names.
Even if it’s just a hash of an ip4, that would go a long way towards identifying who is coming from where
I’d say you probably want to check my geolocation?
They exist. Inform yourself on the Internet Research Agency, one of Russia’s state sponsored troll farms. A handful of their activities are well documented in factual records. ‘Dems’ weren’t crying about it, every rational person who doesn’t want foreign interference and disinformation flooding our spaces is concerned about it. This should not be a partisan issue whatsoever.
Yeah, I don’t even really have a problem with RT, as long as it’s labeled so that people understand that it’s the Russian state speaking. But a lot of forums rely more-or-less on the idea that people are more-or-less good faith actors. Very large scale efforts to have people pretend to be someone else and make non-good-faith arguments is something that I think that a lot of our forums can’t today handle well.
Arguably, that’s a technical problem that needs to be fixed in some way.
Sadly, but we have. There is a big propaganda campaign have been raised for the last 2 years. It was here before but not in a such huge amount.
Maybe, but get fucking real.
Exemptions that only apply rules to the common people. Maybe device registration with an exception using ipv6 address
In case anyone wondered how to potentially get around this…
- Pay for a server in another country that gives you SSH access
- Create SSH SOCKS tunnel:
ssh -N -D 8008 your-server-ip - Open your browser and set the SOCKS server to
localhost:8008(in Chromium/Firefox you can search for this in Settings)
This is actually pretty interesting, thanks for sharing. Although i live in a third world country that doesnt care about anything at all including piracy, but this tunneling thing looks pretty handy
Unfortunately it would be trivial to block an SSH tunnel like this. I recall reading news 10 years ago (maybe even earlier) some foreign journalist tried this at a Beijing hotel room and got shut down in minutes. That was when people are still using PPTP and L2TP protocols to get around censorship, Wireguard and shadowsocks wouldn’t be born for another couple years.
trivial to block an ssh tunnel like this
Far from trivial unless you’re willing to brick ssh completely, or at least cripple a bunch of non-VPN uses for tunneling. Of course it’s trivial to just block ssh outright, or block tunneling above a certain bandwidth. But that would also block, as an example, most remote IDE sessions, loopback-only server management frontends, etc.
The Kremlin could maybe have something set up that looks for accesses to stuff inside Russia from outside Russia, then flag that IP as suspicious as being a VPN endpoint outside Russia.
So, okay, take this scenario:
-
IP A, user inside Russia.
-
IP B, VPS outside Russia.
-
IP C, service inside Russia that state can monitor.
User in Russia on IP A has an SSH tunnel to VPS on IP B with SOCKS that they control.
That’s fine as long as user is only browsing the Internet outside Russia. But if you’re routing all traffic through the VPS and you use any sites in Russia, the Great Russian Firewall can see the following:
-
IP A has a long-running SSH connection to IP B.
-
IP B is accessing stuff in Russia.
You could maybe also do heavier-weight traffic analsysis on top of that if you see 1 and 2, or gather data over a longer period of time, but seeing 1 and 2 alone are probably enough to block IP A to IP B connections.
That can be defeated by using two external VPSes, opening an SSH tunnel to the first one, and then talking to SOCKS on the second (maybe with another SSH connection linking the two). But that’s increasing complexity and cost.
can be defeated with two VPSes, but that’s increasing complexity and cost
A marginal increase, perhaps. You don’t need a separate VPS - just a second IP. Accept incoming traffic on port 22 on one, and set the default route for outbound traffic to the other.
-
Couldn’t you also just set the VPN to use port 443?
E: Apparently this isn’t enough. IE, for Wireguard, you would need to find a way to obfuscate the handshake.
So, that’s definitely better than nothing, but your browser isn’t the only thing – though these days, it is a very important thing – that talks to the Internet. If, for example, you’re using a lemmy client to read this, I’d bet that it’s good odds that it doesn’t have SOCKS support.
Though I wouldn’t be surprised if someone has made VPN software that intercepts connections and acts as a proxy SOCKS client, which would make it work more like a traditional VPN if you can reach a remote SOCKS server, though maybe with a performance hit.
googles
Yeah, okay, looks like stunnel can do this on Linux. So it’s a thing.
You don’t need a 100% solution, though, to have a pretty big impact on society. Combine technical barriers with it just being easier to not think about what’s going on outside, maybe some chilling effects from legally going after people who do start doing things that you don’t like (viewing websites, spreading information, etc), and you can control people’s information environment a lot. Make using circumvention solutions illegal – okay, maybe you can bypass their system if you don’t get caught, but do you want to risk it? Make creating or spreading circumvention solutions really illegal. Do you want to risk getting in a lot of trouble so that random other person can get unrestricted or unmonitored Internet access?
On that note, I was reading about the way North Korea does it in an article from someone who got out of North Korea. That is about as close as it gets to a 100% solution. Only a few thousand people are authorized to get Internet access. You need to apply to use the Internet with a couple of days lead time. Each pair of computers has a “librarian” monitoring what the Internet user on each side is doing, and every five minutes or so the computer will halt with whatever you were doing on the screen and require fingerprint re-authorization from the “librarian” to continue. Users are not allowed to view pages in Korean, just English and Chinese (I assume because most information out there that you’d have to go outside North Korea to get access to is likely available in either English or Chinese, and they definitely don’t want people seeing anything out of South Korea).
That pretty much screws North Korea in terms of access to information, is a costly solution, but if you place an absolute priority on control of the information environment, North Korea does prove that it’s possible to take a society there.
North Korea does prove that it’s possible to take a society there.
I don’t think NK took themselves there, they were already there when the internet was invented. Easier to limit access to few people when you have draconian measures in place when access becomes possible.
Having a society that already widely has access to one that has extremely limited access is a lot more difficult.
This is a good point that many don’t think about. Even if you could somehow drop hardware and free starlink into North Korea it wouldn’t even matter because the citizens never grew up on internet culture. No one would be able to figure out what to do with it by the time they got caught.
I’m not 100%, but I think you could set this up for free with an Oracle AlwaysFree tier VM.
(Boo Oracle, yes I know. Still very handy.)
Just looked up Oracle Always Free… Good to know about, thanks!
I am pretty confused by the article.
What I’d expected based on what I’ve seen so far was that the Kremlin would not care what protocols are used, just whether the a given VPN provider was in Russia and whether it provided the government with access to monitor traffic in the VPN.
So, use whatever VPN protocol you want to talk to a VPN provider where we can monitor or block traffic by seeing inside the VPN. You don’t get to talk to any VPN providers for which we can’t do that, like ones outside Russia, and the Russian government will do what it can to detect and block such protocols when they pass somewhere outside of Russia.
But that doesn’t seem to fit with what the article says is happening.
The media in Russia reports that the reason behind this is that the country isn’t banning specific VPNs. Instead, it’s putting restrictions on the protocols these services use.
According to appleinsider.ru, the two protocols that are subject to the restrictions are:
- OpenVPN
- WireGuard
A Russian VPN provider, Terona VPN, confirmed the recent restrictions and said its users are reporting difficulties using the service. It’s now preparing to switch to new protocols that are more resistant to blocking.
I don’t see what blocking those protocols internal to Russia buys the Kremlin – if Terona conformed to Russian rules on state access to the VPN, I don’t see how the Kremlin benefits from blocking them.
And I don’t see why Russia would want to permit through other protocols, though maybe there are just the only protocols that they’ve gotten around to blocking.
EDIT: Okay, maybe Terona doesn’t conform to state rules or something and there is whitelisting of VPN providers in Russia actually happening. Looking at their VK page, it looks like Terona’s top selling point is “VPN access to free internet” and they have a bunch of country flags of countries outside of Russia. So maybe Russia is blocking VPN connectivity at the point that it exits Russia, and it’s affecting Terona users who are trying to use a VPN to access the Internet outside Russia, which would be in line with what I would have expected.
Your edit makes sense, it would be possible to block all VPN traffic but just whitelist traffic from trusted IP addresses (like those in Russia). But I don’t think we have enough info to say for sure that’s what’s happening.
Use scramble features
