In any case, they could also run an AI and do pattern recognition to identify exactly what is being transferred. Too bad my VPN doesn’t yet provide DAITA as a separate package that can be installed on a router…
Size and timing of packets. Protocols generally have consistent patterns, so say always 6 packets with the last 3/4ths filled. Then some keepalive at regular intervals (i.e. tracker updates), establising new peer connections, …
Luckily this deep inspection is illegal for isps in the eu.
Russia, China, and Iran are using the patterns to effectively block all normal VPN and proxy protocols. There, people need special tools that send fake packets, randomize timing, and split and group packets into different sizes. All of course decreasing speed and increasing latency.
For UDP you’d also usually reencode packets as http3 warp ones so it looks like a video call.
Then the other end needs the same tooling to restore the normal packets.
Obfuscating it would be possible if necessary, but it’s better when you aren’t forced to maintain such an obfuscation stack.
Obfuscating it would be possible if necessary, but it’s better when you aren’t forced to maintain such an obfuscation stack.
I’d be delighted if my VPN provider provided even an obfuscation layer that I could use on my routers, but alas…
For UDP you’d also usually reencode packets as http3 warp ones so it looks like a video call. Then the other end needs the same tooling to restore the normal packets.
Is this similar to when you mask it as webrtc?
Luckily this deep inspection is illegal for isps in the eu.
As per the GDPR or something else?
There, people need special tools that send fake packets, randomize timing, and split and group packets into different sizes. All of course decreasing speed and increasing latency.
For UDP you’d also usually reencode packets as http3 warp ones […]
Is this similar to when you mask it as webrtc?
Sorry I probably meant QUIC not warp. It is related, I think webrtc now usually uses quic, so masking as quic or webrtc are probably synonymous, but honestly I don’t know enough about the details to say for sure.
Something other than DAITA?
I know people in Russia are reporting Mullvad gets fully blocked, so I don’t think DAITA is enough. As @chimp@lemmy.dbzer0.com mentioned, Hysteria is more in the right direction, though in more modern iterations/forks and together with another layer of obfuscation.
I don’t generally like to shout out names too much, since popularity among those that don’t need the tools makes them more cracked down upon for people that do need them. So I’ll just say that for the less obfuscated but more responsive route via rtc you use an updated hysteria as the outer layer, containing a fully homogeneous encrypted stream from a tool named after a reptile.
As per the GDPR or something else?
Mainly Net neutrality rules. Net neutrality just barely allows basic DPI, though it already heavily restricts what ISPs can actually do with that inspection. Wikipedia: EU net neutrality violations. Note that the 2007 case there happened well before regulations were strictened.
This seems really cool! Although, if I already use a VPN, the packets would’ve already exited the VPN node before they were routed to a hysteria insrance. If the normal route without a proxy is:
MyVPNRouter[WireGuardInterface -> WAN] -> VPNServer/Node ->"clearnet"-> destination host (and back in reverse)
Then I don’t understand where and how I could place a proxy in a meaningful way. If I for instance ran in on my public facing, non VPN router, the decrypted traffic would be visible during the “hop” from the VPN to my router:
MyVPNRouter[WireGuardInterface -> WAN] -> VPNServer/Node ->"clearnet"-> MyHysteriaRouter[WAN -> http/3 masq -> WAN] ->"clearnet"-> destination host (and back in reverse)
Unless I use hysteria to obfuscate right here in my LAN before even sending it out to my VPN router? Because then the protocol footprint/fingerprint wouldn’t be that of a torrenting protocol, but that of http traffic?
Torrenting client -> MyHysteriaServer[http/3 masq] -> MyVPNRouter[WireGuardInterface -> WAN] -> VPNServer/Node ->"clearnet"-> destination host (and back in reverse)
And also perhaps for traffic that does not already use a VPN hysteria is a good obfuscator?
Please do forgive and correct any wrong assumptions on my part! 😊
What does frequency mean in this context?
In any case, they could also run an AI and do pattern recognition to identify exactly what is being transferred. Too bad my VPN doesn’t yet provide DAITA as a separate package that can be installed on a router…
Size and timing of packets. Protocols generally have consistent patterns, so say always 6 packets with the last 3/4ths filled. Then some keepalive at regular intervals (i.e. tracker updates), establising new peer connections, …
Luckily this deep inspection is illegal for isps in the eu.
Russia, China, and Iran are using the patterns to effectively block all normal VPN and proxy protocols. There, people need special tools that send fake packets, randomize timing, and split and group packets into different sizes. All of course decreasing speed and increasing latency.
For UDP you’d also usually reencode packets as http3 warp ones so it looks like a video call.
Then the other end needs the same tooling to restore the normal packets.
Obfuscating it would be possible if necessary, but it’s better when you aren’t forced to maintain such an obfuscation stack.
Luckily one of the most populated police states in Europe didn’t trick idiots into voting to leave the EU or anything…oh wait.
Cries in tea :'(
Said state was already a surveilance nightmare (even more so the digital kind) well before that as shown in the Snowden Revelations.
I’d be delighted if my VPN provider provided even an obfuscation layer that I could use on my routers, but alas…
Is this similar to when you mask it as webrtc?
As per the GDPR or something else?
Something other than DAITA?
Sorry I probably meant QUIC not warp. It is related, I think webrtc now usually uses quic, so masking as quic or webrtc are probably synonymous, but honestly I don’t know enough about the details to say for sure.
I know people in Russia are reporting Mullvad gets fully blocked, so I don’t think DAITA is enough. As @chimp@lemmy.dbzer0.com mentioned, Hysteria is more in the right direction, though in more modern iterations/forks and together with another layer of obfuscation.
I don’t generally like to shout out names too much, since popularity among those that don’t need the tools makes them more cracked down upon for people that do need them. So I’ll just say that for the less obfuscated but more responsive route via rtc you use an updated hysteria as the outer layer, containing a fully homogeneous encrypted stream from a tool named after a reptile.
Mainly Net neutrality rules. Net neutrality just barely allows basic DPI, though it already heavily restricts what ISPs can actually do with that inspection. Wikipedia: EU net neutrality violations. Note that the 2007 case there happened well before regulations were strictened.
https://github.com/HyNetworks/hysteria
This seems really cool! Although, if I already use a VPN, the packets would’ve already exited the VPN node before they were routed to a hysteria insrance. If the normal route without a proxy is:
MyVPNRouter[WireGuardInterface -> WAN] -> VPNServer/Node -> "clearnet" -> destination host (and back in reverse)Then I don’t understand where and how I could place a proxy in a meaningful way. If I for instance ran in on my public facing, non VPN router, the decrypted traffic would be visible during the “hop” from the VPN to my router:
MyVPNRouter[WireGuardInterface -> WAN] -> VPNServer/Node -> "clearnet" -> MyHysteriaRouter[WAN -> http/3 masq -> WAN] -> "clearnet" -> destination host (and back in reverse)Unless I use hysteria to obfuscate right here in my LAN before even sending it out to my VPN router? Because then the protocol footprint/fingerprint wouldn’t be that of a torrenting protocol, but that of http traffic?
Torrenting client -> MyHysteriaServer[http/3 masq] -> MyVPNRouter[WireGuardInterface -> WAN] -> VPNServer/Node -> "clearnet" -> destination host (and back in reverse)And also perhaps for traffic that does not already use a VPN hysteria is a good obfuscator?
Please do forgive and correct any wrong assumptions on my part! 😊