Security and Privacy

According to EEtimes, a recent aftershock complicated the process of repairing the submerged cables off the southern coast of Taiwan. It was almost 4 weeks ago that earthquake cut off six cables carrying communication between East Asia and North America. Not a single cable has been repaired due to rough sea condition.

An earthquake off southern coast of Taiwan broke several undersea cables that carries majority of internet and phone communications between East Asia and North America on Dec 26. While the repair will take days or even weeks to complete, you can use open HTTP proxy in South Korea to get reasonable internet connection between U.S. and China.

Labels: News

doublelee published his/her analysis of encryption mechanism in Freegate 6.2 (in Chinese). (local mirror)

Bennett Haselton has an editorial on the current state of anti-censorship software:

So now you know most of what there is to know about the state of the art in anti-censorship software. It's just that there is less to understand than the hype originally suggests -- the programs aren't really secure, but they work because the censors aren't really trying. And there aren't any cool mathematical formulas that you can impress your friends with -- for that, you'll still have to go back to Applied Cryptography. It's a lot less impressive to be the Bruce Schneier of circumvention algorithms than it is to be the real Bruce Schneier.

Labels: Censorship, Proxy Services

With the successful launch of new version 2.0 web browser, Mozilla Firefox continues to earn high praises from users around world. Yet, more and more users of Firefox Chinese language version begin to voice their concerns in community forums and blogs. After upgrading to Firefox 2.0 Chinese language version, users find out that the handy internet keywords service from Firefox location bar has been quietly changed from Google to Yahoo China.

What is Internet Keywords Service?

According to Firefox knowledge base:

When entering information in the Location Bar, Mozilla attempts to convert the information into a usable URL. For example, “mozilla.org” is automatically converted to “http://mozilla.org/”. When Mozilla is unable to discern what URL the user wanted, the information that was entered may be submitted to an Internet Keywords service. This preference determines the Internet Keywords service URL.

In Firefox 2.0, the default has been changed to use Google’s “Browse by Name” service: http://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=.

What has been changed with Firefox 2.0 Chinese language version?

In Firefox 2.0 Chinese language version, the default location bar Internet Keywords Service is defined (in keyword.url) to use Yahoo! China:

http://cn.search.yahoo.com/search?ei=UTF-8&p=

For comparison;

In Firefox 2.0 English version, the default location bar Internet Keywords Service is defined (in keyword.url) to use Google:

http://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=.

Who made the decision and Why?

When questioned about this change, Mozilla China foundation responds with the following press release about "Yahoo entering into a strategic relationship with Mozilla":

(http://www.mozilla.com/en-US/press/mozilla-2005-11-29.html)

"By combining Yahoo!'s global Internet leadership with Mozilla's innovative, easy-to-use, open source Firefox Web browser and our shared commitment to end users, we will deliver an enhanced Web experience for millions of users worldwide, beginning with China, Japan, Korea and Taiwan."

When Yahoo is named as the worst offender in web search censorship in China by reporters without borders, it is really hard to understand why Mozilla chose China as its test ground for its Yahoo connection. Hopefully, Mozilla could reevaluate its decision to enter a relationship with Yahoo.

Labels: News

Some screen shots:
1. Main server control window


2. User log-in through browser


3. Browsing with Psiphon


4. SSL certificate of Psiphon


Overall, I find Psiphon easy to set up and quite handy for personal use on a Windows PC. However, I do have one specific concern over the SSL certificate used by Psiphon. As shown in the screen shot above, Psiphon uses "somename.somewhere.com" as the common name in its SSL certificate.(Psiphon source code is not published at the time of writing.) So if someone wants to block all Psiphon traffic, all he needs to do is to block SSL traffic when a SSL certificate's common name is "somename.somewhere.com". I hope Psiphon developers will use randomized SSL certificates in the next release.

Update:

Canuck at Psiphon forum posted instruction to change server SSL certificate

1. Delete key.pem and cert.pem.
2. Edit openssl (looks like a shortcut in windows because it has a .cnf extension that doesn't show in Windows Explorer.) using notepad. You can change all the fields such as country name, common name, etc.
3. When you save it, ensure you just click save so as not to put .txt in the end (easily fixable if you forget)
4. When you restart Psiphon, it will regenerate the key and certificate to be used based on the fields in the openssl.cnf file.

Labels: Proxy Services

According to NY Times, University of Toronto’s Citizen Lab will release Psiphon, a private secure web proxy server, to public on December 1. According to Psiphon's web site,

What is psiphon?

psiphon is a censorship circumvention solution that allows users to access blocked sites in countries where the Internet is censored. psiphon turns a regular home computer into a personal, encrypted server capable of retrieving and displaying web pages anywhere

Who will use psiphon?

psiphon operates through networks of trust. There are psiphon providers who install and administer a psiphon server (psiphonode) in an uncensored country, and psiphon users (psiphonites) who login and access the server from a country that censors the Internet.

What are psiphonodes, psiphonode administrators and psiphonites??

A psiphonode is a psiphon server that is operated by an administrator residing in an uncensored country (this is an integration of 'psiphon' and 'Node'). The psiphonode administrator is responsible for creating and managing user accounts and running the psiphon server. A psiphonite is a psiphon user, residing within a jurisdiction that blocks arbitrary web sites, and utilizes a psiphonode residing in an uncensored jurisdiction.

How does psiphon work?

psiphon acts as a "web proxy" for authenticated psiphonites, retrieving requested web pages and displaying them in a user's browser. psiphon uses a secure, encrypted connection to receive web requests from the psiphonite to the psiphonode who then transports the results back to the psiphonite. There is no connection between the psiphonite and the requested website, as psiphon transparently proxies the request through the psiphonode's computer allowing the psiphonite to browse blocked websites seamlessly.

Though there are quite a lot web based proxy services around, few of them provides SSL encryption that helps to get around packet filtering of Great Firewall of China. Now with Psiphon and source code, it would easy for you to set up a secure web proxy service for your family and friends.

Labels: Proxy Services

It is really not surprising to me that Wikipedia web site got blocked again by Great Firewall of China on Friday. Given the current political trend in China, I could not imagine a sudden change in the government policy of blocking high profile user community web sites, such as Wikipedia, blogspot. When riots in Guangdong, Sichuan are widely reported by BBC and New York Times, Chinese government does have an urgent need to prevent "bad" news from reaching its own people.

Also, check out William Moss's analysis on this issue.

[update]
NY Times did a report on self-censoring of Chinese language version of Wikipedia. Overall, I find quality of articles on Chinese Wikipedia leaves a lot to be desired.

Labels: Censorship, Great Firewall

According to Yang Xiaokun, a Chinese diplomat to the UN in Geneva:

In China, we don't have software blocking Internet sites. Sometimes we have trouble accessing them. But that's a different problem. I know that some colleagues listen to the BBC in their offices from the Webcast. And I've heard people say that the BBC is not available in China or that it's blocked. I'm sure I don't know why people say this kind of thing. We do not have restrictions at all.

Apparently, Mr Yang spends too much time in Geneva and need a trip back to China to get a reality check.

News source: Cnet Ars

BTW,

Labels: Censorship, Great Firewall

Blogspot, the popular free blog hosting service of Google, recently got blocked again by the Great Firewall of China. During the past two months, internet users in China enjoyed (a sudden yet brief) free access to blogs hosted at Blogspot.com. But the wind changed again with news that China moves towards "real" name registration system for blogs.

On a side note, part of the English contents of Wikipedia remains accessible in China.

update:
A friend informs me of a special service to access blogspot from China: pkblogs:

Labels: Censorship, Great Firewall

In recent months, quite a few new tools become available for internet users to beat the Great Firewall of China. While most of them are based on the traditional squid proxy server, some begin to take advantage of the open source VPN technology in order to offer compatibility with popular instant message and VOIP applications. If you can read Chinese, qxbbs is the most active user support community for these tools. (This website is blocked in China.)

So here is an incomplete list of tools that beat the Great Firewall of China.

1. Freegate version 6.2 (https://www.dongtaiwang.com/loc/download.php)
• squid proxy server technology (multiple proxy servers with U.S. IP addresses)
• Chinese user interface
• stable and compatible with both IE and Firefox
• minor problems with javascript
2. UltraSurf version 8.0 (https://www.wujie.net/)
• squid proxy server technology (multiple proxy servers with U.S. IP addresses)
• English and Chinese interface
• stable and compatible with both IE and Firefox
• occasional problem with http file download
3. Gpass version 1.0.0.41 (http://www.gpass1.com/download.php)
• squid proxy server technology (multiple proxy servers with U.S. IP addresses)
• English and Chinese version for download
• compatible with both IE and Firefox
• occasional lockup problem with 100% CPU usage
• somewhat wierd censor policy ( blogspot.com are off limit.)
4. Firephoenix version 1.0 (http://firephoenix.edoors.com/)
• VPN based technology
• Chinese user interface
• compatible with both IE and Firefox
• occasional loss of network connection
• somewhat slow comparing with other tools

Labels: Great Firewall, Proxy Services