Ask HN: The government of my country blocked VPN access. What should I use?

DAITA was introduced after my time in the industry, but this isn't a new idea (though as far as I know, it's the first time this kind of thing's been commercialized).

It's clever. It tries to defeat attacks against one of the tougher parts of VPN connections to reliably obfuscate, and the effort's commendable, but I'll stop short of saying it's a good solution for one big reason: with VPNs and censorship circumvention, the data often speaks for itself.

A VPN provider working in this space will often have aggregate (and obviously anonymized, if they're working in good faith) stats about success rates and failure classes encountered from clients connecting to their nodes. Where I worked, we didn't publish this information. I'm not sure where Mullvad stands on this right now.

In any case -- some VPN providers deploying new technology like this will partner with the research community (because there's a small, but passionate formal research community in this space!) and publish papers, studies, and other digests of their findings. Keep an eye out for this sort of stuff. UMD's Breakerspace in the US in particular had some extremely clever people working on this stuff when I was involved in the industry.

A country can and absolutely will block known VPN ingress points. There are two tricks that we can use to circumvent this:

- Host on a piece of infrastructure that's so big that you can't effectively block it without causing a major internet outage (think: S3, Cloudflare R2, etc). Bonus points if you can leverage something like ECH (ex-ESNI) to make it harder to identify a single bucket or subdomain.

- Keep spawning new domains and subdomains to distribute your binaries.

There are complications with both approaches. Some countries block ECH outright. Some have no problem shutting the internet down wholesale for a little bit. The domain-hopping approach presents challenges w/r/t establishing trust (though not insurmountable ones, much of the time).

These are thing that have to be judged and balanced on a case-by-case basis, and having partners on the ground in these places really helps reduce risk to users trying to connect from these places, but then you have to be very careful talking to then since they could themselves get in trouble for trying to organize a VPN distribution network with you. It's layers on layers, and at some point it helps to just have someone on the team with a background in working with people in vulnerable sectors and someone else from a global affairs and policy background to try and keep things as safe as they can be for people living under these regimes.

It doesn't matter, he should look into the open source protocols that these services use. He doesn't have to use them.

VLESS / v2ray works in Russia, as far as I know.

Mr. Kafka, suspicion is healthy. However, abstraction provides no way forward when faced with practicalities instead of theory. Creates a Kafka-esque situation - anything suitable is by definition unsuitable. Better to focus on practical technical advice.

Well, you have to host your free open-source VPN software somewhere. And then, (N. B.: technical and usability stuff aside, I'm talking only about privacy bits here) everything boils down to two equally nightmarish options.

First, you use well-known cloud or dedicated hoster. All your traffic is now tied to the single IP address of that hoster. It may be linked to you by visiting two different sites from the same IP address. Furthermore, this hoster is legally required to do anything with your VPN machine on demand of corresponding state actors (this is not a speculative scenario; i. e. Linode literally silently MitMed one of their customers on German request). Going ever further, residential and company IPs have quite different rules when it comes to law enforcement. Seeding Linux ISOs from your residential IP will be overlooked almost everywhere (sorry, Germany again), but seeding Linux ISOs from AWS can easily be a criminal offense.

Second, you use some shady abuse-proof hosting company, which keeps no logs (or at least says that) and accepts payments in XMR. Now you're logging in to your bank account from an IP address that is used to seedbox pirate content or something even more illegal, and you still don't know if anyone meddles with your VPN instance looking for crypto wallet keys in your traffic.

VPN services have a lot of "good" customers for a small amount of IP addresses, so even if they have some "bad" actors, their IPs as a whole remain "good enough". And, as the number of customers is big, each IP cannot be reliably tied to a specific customer without access logs.

Do you have any evidence for either of these claims?

For 99% of use cases - piracy and porn, does that matter?

I mean multiple VPSs for redundancy. Contabo is maybe the cheapest I've seen and it's like 3$ mtl for the smallest?

Yeah they can be cheap, but I would definitely recommend having at least 3 for redundancy. If one get shut down or it's IP blacklisted you still hopefully have a backup line to create a replacement.

No, unless you pay month to month. If you wait till BF you can find some really good deals on sites like lowendspirit

Normally I would agree with you, but the ability to pull this kind of thing off hinges on there being enough shadows that the Eye doesn't look at for prolonged periods of time. And the overall trajectory of technological advance lately is such that those shadows are rapidly shrinking. First it was the street cameras (and UK is already one of the most enthusiastic adopters in the world). And now comes AI which can automatically sift through all the mined data, performing sentiment analysis etc. I feel that the time will come pretty soon when "a guy" will need to be so adept at concealing the tracks in order to avoid detection that most people wouldn't have access to one.

Don't worry, you shouldn't underestimate the capability of society.

You should be worried. Don't underestimate the capabilities of the government bureaucrats. That "guys down the pub" will quickly disappear once they start getting jail time for their activities.

That absolutely sounds like a world I should be worried about, where our only choices are dodgy ones

> red states

Well you'd be surprised to find out that this stupid policy (and many more) have been brought forward by Labour (Left).

> 90% of “citizen journalism” is (trash)

You're right. But compared to what?

I guess 99% of mainstream "journalism" is irrelevant and/or inaccurate, hence citizen journalism is a 10x improvement in accuracy and relevancy! Not 10% better, 900% better! This makes a huge difference to our society as a whole and in our daily lives!

But this misses the most important point which is that the user should have the right to choose for themselves what they say and read. Making citizen journalism unduly burdensome deprives everyone of that choice.

Preach comrade!

Those citizen journalists with their primary sources, disgusting.

Thats nothing but propaganda.

Remember it doesnt matter what the video shows, it only matters who showed it to you.

Well, think about it - almost every other interaction you can have with an individual in another country is mediated by government. Physical interaction? You need to get through a border and customs. Phone call? Going through their exchanges, could be blocked, easy to spy on with wiretaps. Letter mail? Many cases historically of all letters being opened before being forwarded along.

We lived through the golden age of the Internet where anyone was allowed to open a raw socket connection to anyone else, anywhere. That age is fading, now, and time may come where even sending an email to someone in Russia or China will be fraught with difficulty. Certainly encryption will be blocked.

We're going to need steganographic tech that uses AI-hallucinated content as a carrier, or something.

That is how you know they haven't got a clue on what they're doing.

One alternative would be to set up a VPS, run VNC on it, run your browser on that to access the various web sites, and connect over an SSH tunnel to the VNC instance. Then it actually is an interactive ssh session.

The issue these days is that all of the EC2 IP ranges are well known, and are usually not very high-reputation IPs, so a lot of services will block them, or at least aggressively require CAPTCHAs to prevent botting.

Source: used to work for a shady SEO company that searched Google 6,000,000 times a day on a huge farm of IPs from every provider we could find

I watched a season of Doctor Who that way back when the BBC were being precious about it. But Digital Ocean, so $5.

There are many instances of Mastodon, and due to its federated nature, you can use any of them to access it, and even host your own.

Sure, but if you have an account on a different server, you can still see things posted on mastodon.social if you have followed someone there.

Very possible, though many of our users are saying that in network environments where WireGuard is blocked they were able to use Obscura.