Security and Privacy

Another delay in reparing submerged cables off Taiwan coast

2007-01-17T17:38:00.000-06:00

According to EEtimes, a recent aftershock complicated the process of repairing the submerged cables off the southern coast of Taiwan. It was almost 4 weeks ago that earthquake cut off six cables carrying communication between East Asia and North America. Not a single cable has been repaired due to rough sea condition.

Asia Cable Crisis

2006-12-28T18:06:00.000-06:00

An earthquake off southern coast of Taiwan broke several undersea cables that carries majority of internet and phone communications between East Asia and North America on Dec 26. While the repair will take days or even weeks to complete, you can use open HTTP proxy in South Korea to get reasonable internet connection between U.S. and China.

News update

2006-12-20T14:18:00.000-06:00

doublelee published his/her analysis of encryption mechanism in Freegate 6.2 (in Chinese). (local mirror)

Bennett Haselton has an editorial on the current state of anti-censorship software:

So now you know most of what there is to know about the state of the art in anti-censorship software. It's just that there is less to understand than the hype originally suggests -- the programs aren't really secure, but they work because the censors aren't really trying. And there aren't any cool mathematical formulas that you can impress your friends with -- for that, you'll still have to go back to Applied Cryptography. It's a lot less impressive to be the Bruce Schneier of circumvention algorithms than it is to be the real Bruce Schneier.

Firefox's little secret with Yahoo

2006-12-07T16:26:00.000-06:00

With the successful launch of new version 2.0 web browser, Mozilla Firefox continues to earn high praises from users around world. Yet, more and more users of Firefox Chinese language version begin to voice their concerns in community forums and blogs. After upgrading to Firefox 2.0 Chinese language version, users find out that the handy internet keywords service from Firefox location bar has been quietly changed from Google to Yahoo China.

What is Internet Keywords Service?

According to Firefox knowledge base:

When entering information in the Location Bar, Mozilla attempts to convert the information into a usable URL. For example, “mozilla.org” is automatically converted to “http://mozilla.org/”. When Mozilla is unable to discern what URL the user wanted, the information that was entered may be submitted to an Internet Keywords service. This preference determines the Internet Keywords service URL.

In Firefox 2.0, the default has been changed to use Google’s “Browse by Name” service: http://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=.

What has been changed with Firefox 2.0 Chinese language version?

In Firefox 2.0 Chinese language version, the default location bar Internet Keywords Service is defined (in keyword.url) to use Yahoo! China:

http://cn.search.yahoo.com/search?ei=UTF-8&p=

For comparison;

In Firefox 2.0 English version, the default location bar Internet Keywords Service is defined (in keyword.url) to use Google:

http://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=.

Who made the decision and Why?

When questioned about this change, Mozilla China foundation responds with the following press release about "Yahoo entering into a strategic relationship with Mozilla":

(http://www.mozilla.com/en-US/press/mozilla-2005-11-29.html)

"By combining Yahoo!'s global Internet leadership with Mozilla's innovative, easy-to-use, open source Firefox Web browser and our shared commitment to end users, we will deliver an enhanced Web experience for millions of users worldwide, beginning with China, Japan, Korea and Taiwan."

When Yahoo is named as the worst offender in web search censorship in China by reporters without borders, it is really hard to understand why Mozilla chose China as its test ground for its Yahoo connection. Hopefully, Mozilla could reevaluate its decision to enter a relationship with Yahoo.

First look at Psiphon

2006-12-02T03:33:00.000-06:00

Some screen shots:
1. Main server control window

2. User log-in through browser

3. Browsing with Psiphon

4. SSL certificate of Psiphon

Overall, I find Psiphon easy to set up and quite handy for personal use on a Windows PC. However, I do have one specific concern over the SSL certificate used by Psiphon. As shown in the screen shot above, Psiphon uses "somename.somewhere.com" as the common name in its SSL certificate.(Psiphon source code is not published at the time of writing.) So if someone wants to block all Psiphon traffic, all he needs to do is to block SSL traffic when a SSL certificate's common name is "somename.somewhere.com". I hope Psiphon developers will use randomized SSL certificates in the next release.

Update:

Canuck at Psiphon forum posted instruction to change server SSL certificate

1. Delete key.pem and cert.pem.
2. Edit openssl (looks like a shortcut in windows because it has a .cnf extension that doesn't show in Windows Explorer.) using notepad. You can change all the fields such as country name, common name, etc.
3. When you save it, ensure you just click save so as not to put .txt in the end (easily fixable if you forget)
4. When you restart Psiphon, it will regenerate the key and certificate to be used based on the fields in the openssl.cnf file.

Psiphon: Your Private Secure Web Proxy Server

2006-11-30T19:08:00.000-06:00

According to NY Times, University of Toronto’s Citizen Lab will release Psiphon, a private secure web proxy server, to public on December 1. According to Psiphon's web site,

What is psiphon?

psiphon is a censorship circumvention solution that allows users to access blocked sites in countries where the Internet is censored. psiphon turns a regular home computer into a personal, encrypted server capable of retrieving and displaying web pages anywhere

Who will use psiphon?

psiphon operates through networks of trust. There are psiphon providers who install and administer a psiphon server (psiphonode) in an uncensored country, and psiphon users (psiphonites) who login and access the server from a country that censors the Internet.

What are psiphonodes, psiphonode administrators and psiphonites??

A psiphonode is a psiphon server that is operated by an administrator residing in an uncensored country (this is an integration of 'psiphon' and 'Node'). The psiphonode administrator is responsible for creating and managing user accounts and running the psiphon server. A psiphonite is a psiphon user, residing within a jurisdiction that blocks arbitrary web sites, and utilizes a psiphonode residing in an uncensored jurisdiction.

How does psiphon work?

psiphon acts as a "web proxy" for authenticated psiphonites, retrieving requested web pages and displaying them in a user's browser. psiphon uses a secure, encrypted connection to receive web requests from the psiphonite to the psiphonode who then transports the results back to the psiphonite. There is no connection between the psiphonite and the requested website, as psiphon transparently proxies the request through the psiphonode's computer allowing the psiphonite to browse blocked websites seamlessly.

Though there are quite a lot web based proxy services around, few of them provides SSL encryption that helps to get around packet filtering of Great Firewall of China. Now with Psiphon and source code, it would easy for you to set up a secure web proxy service for your family and friends.

Wikipedia blocked again

2006-11-17T12:44:00.001-06:00

It is really not surprising to me that Wikipedia web site got blocked again by Great Firewall of China on Friday. Given the current political trend in China, I could not imagine a sudden change in the government policy of blocking high profile user community web sites, such as Wikipedia, blogspot. When riots in Guangdong, Sichuan are widely reported by BBC and New York Times, Chinese government does have an urgent need to prevent "bad" news from reaching its own people.

Also, check out William Moss's analysis on this issue.

[update]
NY Times did a report on self-censoring of Chinese language version of Wikipedia. Overall, I find quality of articles on Chinese Wikipedia leaves a lot to be desired.

China: We don't censor the Internet. Really!

2006-10-31T21:32:00.000-06:00

According to Yang Xiaokun, a Chinese diplomat to the UN in Geneva:

In China, we don't have software blocking Internet sites. Sometimes we have trouble accessing them. But that's a different problem. I know that some colleagues listen to the BBC in their offices from the Webcast. And I've heard people say that the BBC is not available in China or that it's blocked. I'm sure I don't know why people say this kind of thing. We do not have restrictions at all.

Apparently, Mr Yang spends too much time in Geneva and need a trip back to China to get a reality check.

News source: Cnet Ars

BTW,

Blogspot got blocked again by Great Firewall of China

2006-10-27T07:25:00.000-05:00

Blogspot, the popular free blog hosting service of Google, recently got blocked again by the Great Firewall of China. During the past two months, internet users in China enjoyed (a sudden yet brief) free access to blogs hosted at Blogspot.com. But the wind changed again with news that China moves towards "real" name registration system for blogs.

On a side note, part of the English contents of Wikipedia remains accessible in China.

update:
A friend informs me of a special service to access blogspot from China: pkblogs:

New Tools Beat the Great Firewall of China

2006-09-04T09:37:00.000-05:00

In recent months, quite a few new tools become available for internet users to beat the Great Firewall of China. While most of them are based on the traditional squid proxy server, some begin to take advantage of the open source VPN technology in order to offer compatibility with popular instant message and VOIP applications. If you can read Chinese, qxbbs is the most active user support community for these tools. (This website is blocked in China.)

So here is an incomplete list of tools that beat the Great Firewall of China.

Freegate version 6.2 (https://www.dongtaiwang.com/loc/download.php)

squid proxy server technology (multiple proxy servers with U.S. IP addresses)
Chinese user interface
stable and compatible with both IE and Firefox

minor problems with javascript

UltraSurf version 8.0 (https://www.wujie.net/)

squid proxy server technology (multiple proxy servers with U.S. IP addresses)
English and Chinese interface
stable and compatible with both IE and Firefox
occasional problem with http file download

Gpass version 1.0.0.41 (http://www.gpass1.com/download.php)

squid proxy server technology (multiple proxy servers with U.S. IP addresses)
English and Chinese version for download
compatible with both IE and Firefox
occasional lockup problem with 100% CPU usage
somewhat wierd censor policy ( blogspot.com are off limit.)

Firephoenix version 1.0 (http://firephoenix.edoors.com/)

VPN based technology
Chinese user interface
compatible with both IE and Firefox
occasional loss of network connection
somewhat slow comparing with other tools

Anonymizer service for China back to normal

2006-07-13T19:45:00.000-05:00

After weeks of authentication problem, Anonymizer's Operation: Anti-Censorship ( http://zidanchun.com/) is back to normal. Thank you Anonymizer! A lot of internet users within the Great Firewall of China would be happy to have this service :-).

During the past few weeks, there is a lot of development in softwares that help you to avoid Great Firewall of China, such as stunnel based Freegate 6.2, FirePhenix VPN 0.30 and Gpass proxy 1.0. So, stay tuned for some brief review.

Anonymizer problem drags on.

2006-06-29T02:18:00.000-05:00

The authenitcation service of Anonymizer could not recongnize IP addresses from inside of the Great firewall of China.

Ignoring the keyword detection of “Great Firewall of China”

2006-06-27T19:37:00.000-05:00

Richard Clayton is presenting a paper (blog post here) that discusses some interesting details of the keyword detection mechanism of China's national firewall:

the keyword detection is not actually being done in large routers on the borders of the Chinese networks, but in nearby subsidiary machines. When these machines detect the keyword, they do not actually prevent the packet containing the keyword from passing through the main router (this would be horribly complicated to achieve and still allow the router to run at the necessary speed). Instead, these subsiduary machines generate a series of TCP reset packets, which are sent to each end of the connection. When the resets arrive, the end-points assume they are genuine requests from the other end to close the connection — and obey. Hence the censorship occurs.

However, because the original packets are passed through the firewall unscathed, if both of the endpoints were to completely ignore the firewall’s reset packets, then the connection will proceed unhindered! We’ve done some real experiments on this — and it works just fine!! Think of it as the Harry Potter approach to the Great Firewall — just shut your eyes and walk onto Platform 9¾.

Though it is unrealistic to have all Web servers to ingnore TCP reset from China, Clayton's study offers unique details about the implementation of Great Firewall of China.

Anonymizer's Operation: Anti-Censorship update

2006-06-23T20:16:00.000-05:00

In a recent email to its Chinese users, Anonymizer's Operation: Anti-Censorship, a special free service for internet users inside China, changed its web address and secure proxy IP address in order to counter the possible blockage by Great Firewall of China. You can get the software and updated secure proxy IP address from :

http://zidanchun.com/

However, several users inside China have reported problems with the new secure proxy IP address of Anonymizer's Operation: Anti-Censorship. The error message includes:

Authentication error: invalid country of origin
Error code = 208
Call support

Hopefully, this error could be soon corrected.

Testing

2006-04-25T09:01:00.000-05:00

Opening Test