Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/1113 Thanks!
[Music]
so and without stealing further time
from Keith McManaman who's coming here
from Toronto who's working at siphon a
censorship Circ convention NGO and uh
she's speaking about evading the censors
in 2018 now so uh censorship our year
Roundup I'm very happy to have you here
and to yeah see your talk now on the
last day of Congress thank
[Applause]
you
hello thanks everyone for coming this
afternoon hope you had a fantastic
Congress this year I know I did uh
thanks for sticking around to the final
sessions um for many of you this will be
the last talk you see until next year so
I hope it's
worthwhile um and to everyone watching
uh the stream online um hello and
welcome my name is Keith McManaman I'm
an analyst at siphon where we operate a
circumvention network that's used
worldwide by tens of millions of people
and we provide free open source
circumvention tools for Windows Android
and
iOS yes there is a circumvention tool
that's running whole device VPN for iOS
it's
iphon due to its accessibility uh
freeness localization and overall
Network
resilience uh that has that has made
siphon a widely adopted circumvented
Tool uh which provides a decent sample
size of Internet users and therefore a
reasonable barometer of circumvention
tool usage in a
country which makes it an apt vantage
point from which to analyze the impacts
of Internet
censorship in my work the kinds of
questions that I'm interested in are how
the social and political dynamics of
information controls in different
places for example the trends in the
censorship legislative environment
political Cycles social unrest and
social movements emerging disc courses
in the media and online how do these
factors add up and determine what
content is accessible and how does that
shape people's online behavior and their
use of circumvention tools including
siphon
oops this is an overview of what we'll
be talking about today I'm going to go
over the basic uh
basics of censorship technology and how
it's
deployed I'll talk about some of the
circumvention methods and technologies
that are in use today I'll recap some
notable events from the past year and
and then talk about some notable trends
that we've observed um in this
environment just a short note on uh
Framing and
metaphors um the Caden Mouse game is a
terminology that's kind of widely uh
used to describe the interplay between
the excuse me the circumvention tool
providers and the
sensors um sometimes you'll hear like
militaristic kind of framing like the
battle for for the free internet or uh
the technological excuse me the
technological arms
race um I just want to say that there's
nothing really uh there's no Sylvester
inti uh there's no there's nothing
madcapper wacky about it as you will see
so what is internet censorship it's the
control or suppression of what can be
accessed published or viewed on the
internet I just took this definition
from uh the
Wikipedia it comes in many different
manifestations and and
forms I'm going to be focused on the
digital interceptive form of of
censorship which is what circum
circumvention tools are designed to deal
with but as you can see there are other
um very
important there are other very important
uh categories that uh have increased in
their
prevalence in in recent years
specifically the shift from uh direct
interceptive forms of censorship
sometimes referred to as the first
generation of information controls to
the second and third
generation which is characterized in
this excellent series of uh called the
access series by Ron debert and the
citizen lab and his colleagues which
really is which is really the seminal
work
on on that
transition um so this is what we'll
focus on for this
talk
censorship is preventing you from
treading all of
these fascinating
wonderful uh
paths and it does that by it does that
by taking advantage of certain features
in the way the internet
works how they're able to do that is the
sensors
control uh all connections across the
International gateway to the respective
country through the information
Ministries they control the internet
service
providers and they possess powerful
methods of
detection increasingly the internet
censorship space is enabled by private
sector
actors uh the cost of purchasing and
running um those technologies that allow
you to maintain National
blacklists
um sort and filter different types of
traffic uh have become much more
accessible for National governments and
to deploy at
scale the methods that we're going to go
over uh vary in their complexity and
their resource
intensity this is something called The
OSI
model of uh basically computer and
telecommunication
systems suffice to say that censorship
can happen at all layers
from the application layer all the way
down to the physical
infrastructure so one of the lower level
tactics is IP address IP address
blocking sensors can learn the IP
addresses of the sites that they want to
block and add those to a a blacklist of
forbidden
IPS so requests to those addresses will
be
discarded simple diagram of how that
looks so when you attempt to visit a
site that's
blacklisted you'll either get a
connection re a connection reset or a
404
air the weakness of IP address based
blocking is that a lot of ips are not
static in many cases they're hosted on
content delivery networks which
uh are ephemeral in a way they shift
from place to place and people
IP address could constantly be migrating
to a new
location so it's not effective and it's
a lot of work to maintain often
times uh it also comes with a high risk
of collateral damage
like you'll tend to block other parts of
content that uh are hosted on the same
IP and uh generally this this kind of
works better for blocking
either uh specific apps basically rather
than specific uh
content in the same vein uh URL blocking
involves a blacklist of uh forbidden
URLs and when you attempt to visit that
uh or a keyword then um or a blacklisted
keyword then your your request will
similarly be
rejected Port blocking also works the
same way so the sensor can choose a
certain Port that they don't want to
allow any traffic through and uh
similarly you would not be able to
connect to those end
points okay uh DNS hijacking or
sometimes called DNS poisoning DNS
spoofing um this involves basically the
uh DNS lookup process so how uh how our
URL Is Res resolved into an IP
address um because that's controlled
from um a highly centralized vantage
point the sensor can actually intercept
your DNS resolution request and and
deliver uh a a page of their choosing
basically instead of the page that
you've
requested typically that involves a uh a
Blog Page of some kind saying that um
you know the site you've requested to
visit is uh
forbidden U but they can also even
deliver a malicious page pretending to
be the page that you've requested but
actually isn't there was a case in China
before Wikipedia was a https enabled or
SSL
enabled um if you requested the page for
Tian Square the Wikipedia article
they're actually delivering a kind of
sanitized version of that of that site
instead of the legitimate
article uh of course H https adoption
kind of prevents blocking specific
subpages for um
nowadays so if you're in Iran for
example this is a page that you might
see uh that says you can't go to this
site but here are some uh great other
sites that you can
visit uh in Saudi Arabia this is a block
page if you would see uh that you would
see that's put there by the information
Ministry so in both cases there's a
clear kind of accountability someone
someone that you can contact an email
address someone that you can contact
about your uh inability to access that
content but often times your request
will just fail to complete you might get
a 404 error and uh there's not a clear
indication of is this site uh ban
content is there a problem with my uh
with the content provider or uh is there
a problem with my own internet
connection so some kind of ambiguity as
to why you're not able to to visit that
content keyword filtering is kind of an
escalation because it allows the center
to filter uh URLs based on keywords
anywhere in the path name again pre
https that was a bit more relevant
because uh TLS or SSL enable connections
you can't see into into the path into
the bth name except for the top level
domain and uh
it also allowed them to block new or
unknown pages that are related to that
type of content uh rather than having to
discover the domain and the IP address
and add it to the Blacklist
manually um they also have the ability
to Blacklist or wh list entire
protocols say uh https if they can't see
into it uh this is something that
happened in Iran in the 2013 election
there a gradual escalation between the
circumvention providers and the sensors
there which culminated in eventually
only HTTP traffic being wiel
listed uh and obviously I I come back to
the term collateral damage that really
is something that can uh break a lot of
other essential internet services and uh
make that essentially
unusable deack and inspection this is a
word that uh some may have heard uh
spoken about through the Congress
earlier in the week um this is basically
a highlevel processing method that
allows the sensors to look throughout
the content of a web request in the
header in the inner traffic uh as well
as the URL for certain uh keywords and
other specifications that pertain to a
repository of Blacklist arguments and
choose to block that
traffic so with the keyword filtering
and deep packet inspection the sensors
need to process a lot more data it's
very very much uh more resource
intensive um and it really depends how
deep they want to
dig uh and as I mentioned at the
beginning the technology has gotten much
more widely available cheaper and easier
to
implement uh and more
effective
traffic fingerprinting is something
that's enabled by that because even
without knowing the domain or the IP
address or being able to see it through
encryption the sensor can record what a
browsing session looks like and create
rules for how the user sees that page or
if they
do uh because encryption doesn't doesn't
change that technical
configuration and so they can block a
page based on its size load time and
other kind of technical
details um which would even allow them
to block say specific subpages of
Wikipedia that are https
enabled they might incidentally block
some other page that follows that uh
specification but that's kind of uh the
trade-off that's being
made uh and I will come back to this but
just to mention uh VPN traffic SSH
traffic um though they are encrypted
they have a very obvious signature a
size and shape that's identifiable on a
network perspective uh that can be
fairly easily
fingerprinted which is definitely a
vulnerability now I'm going to switch
tracks and talk about some uh
circumvention
methods so uh to each of the censorship
methods that I discussed there's kind of
a circumvention answer and it escalates
from there so if your DNS is being
poison then you could switch to an open
DNS resolver or a third party DNS
resolver you've often heard of people
switching their DNS to
8888 the Google which is the Google DNS
or 1111 the cloud flare DNS it's like
Google and Cloud flare maybe aren't
going to censor us you could argue or
it's at least better than trusting your
ISP if you're in China or Iran or
something like that
if you're a content provider and uh you
think that your domain is blacklisted or
your uh the IP of your domain is
blacklisted you can migrate or mirror
your uh block domain to a new one I mean
you're always racing the sensors in that
case like chances are they can discover
your new site just as fast as your
readers can but that's another way of
kind of evading the lower level
censorship
techniques um another circumvention
method you can use is by uh connecting
to a web proxy so first you connect to
some other website that's uh not on The
Blacklist and from there you use that as
your Vantage Point to kind of browse the
open
internet of course you can use a VPN and
uh you can use other circumvention tools
like siphon or tour which I'll tell you
more
about so SSH this is
a uh a protocol that's used to
communicate with servers and
administrate
them uh it's it's great because it's
encrypted anyone any man in the middle
that's trying to look at this request
they're only going to see something that
they can't
interpret but again uh because of its uh
regular size and shape on a network
perspective SSH can be fingerprinted
using uh the off-the-shelf technology
same thing with VPN and so for most
censorship regimes it's e easy enough to
block uh VP all VPN traffic in and out
of the country just by flicking the
switch that says we're not going to
allow
VPN and increasingly this year we've
seen during say uh politically
politically important moments like
elections or public
demonstrations that uh the sensors will
uh utilize this ability and and leverage
that over the networks they
control so uh which brings me to
OSS OSS is an off fiscated protocol it
stands for off fiscated
SSH um there's basically ways that you
can innovate on the existing SSH
tunnel um to make it as much as possible
indistinguishable from random bytes of
generic web traffic so rather than
looking like this strange strange
encrypted thing that the sensors can
pick out and block uh it's designed to
blend in with all the rest of the web
traffic that's that's going on and there
are a lot of different things that you
can do to sort of change the exact
configuration that it follows so that uh
it's as random as possible and some of
the things that you can do are uh insert
random packets uh alongside the tunnel
like random web traffic both ways uh you
can vary the the packet size the packet
interval um and other kind of
uh ways of making that as amorphous as
possible
um again back to the concept of
collateral damage a sensor that's going
to Endeavor to block something that's
indistinguishable from random web
traffic based on certain features that
they identify probably cause them to
block incidentally block some generic
web traffic as well which is a calculus
that they're always going to have to
make what deepack what deepack and
inspection is doing is it's scanning
deep into every web
request um but that Pro process as I
mentioned is quite resource intensive
so generally the the sensor can only
look at the first subset of packets try
to make a decision based on what C what
their categorization of that traffic
might be and decide to either let it
pass or filter it so um what
circumvention technology is trying to do
is make that more computationally
intense for them and it really depends
how deep uh they want to dig and they do
risk kind of slowing slowing down
general internet performance in the
country if they do
that uh this is another technique called
uh Meek or domain fronting basically
involves routing traffic through what's
referred to as high value domains so
typically large infrastructure pieces of
the
internet and hiding the uh real request
inside the encrypted um the TLs
encrypted
connection um for example forcing
traffic through CDN data centers that
typically get a different blocking
treatment because they are large
infrastructure components of the
internet that a lot of essential
Services require uh to run
on um this is a diagram just showing how
that request is passed
along and uh if you're interested in
learning more I'd encourage you to refer
to the paper um David ffield and uh
colleagues worked on including some
siphon
developers what are some vulnerabilities
of circumvention
tools the sensor can attempt to disrupt
your
distribution if people can't get your
apps then they can't use them so um one
thing that we do is we have multiple
redundant kind of distribution
methods uh the censor can always block
your website where you have your uh
applications available for
download they might even uh Blacklist
the play store or the Apple App Store
or um some countries that's uh embargoed
and and not available
anyway um so one of one of the
innovations that we use at siphon is
email uh autoresponders basically you
can request a number of generic email
addresses
and uh the return email you will get has
links to secure Cloud hosted download
sites and uh even the uh APK or exe file
as an
attachment uh the ensors might also be
able to enumerate your servers one by
one even if you have thousands and
thousands of servers if they have enough
people running enough discret copies of
your software you have to make sure that
they can't catch up with uh all your all
all your endpoints before you roll them
over so um on the siphon Network it's
fairly ephemeral like uh no IP addresses
are really static and uh the servers are
constantly turning over um really
protects us against that um that Vector
of attack another thing is no uh
individual copy of the software is ever
going to know more than a very very very
small subset of the servers like maybe
1% or
less uh protocol based attacks are
interesting siphon is using um what we
call a multi-protocol architecture
basically protects against uh the
blacklisting of one or even a few
protocols because there's always
redundant transport methods that uh the
traffic can can
use and then as I mentioned um we do
various traffic officiation methods to
be resilient to traffic fingerprinting
as
well in terms of
transports what makes a protocol
relevant so one is it effective does it
work does traffic get through uh is it
able to actually transport um enough
data like through actual
throughput um secondly resilience for
how long is it going to work before it
gets figured out and and
blocked um another thing is it should
have low overhead you can't insert too
much extra data into the
tunnel um and lastly uh not placing too
much Demand on users for instance
peer-to-peer traffic it requires users
to actually do something to run
themselves as a proxy node in a network
and uh that could affect uh scalability
and and even
performance the reason I say that is
because even though some circumvention
methods experimental new methods that
have been discovered and worked on are
are uh excellent but they're
not they're not as easy to scale from
tens or hundreds of people to tens of
millions of people especially not
especially not rapidly and some of the
examples I'm going to show will will
show you how this network has really the
availability the ability to rapidly
scale itself uh in critical events and
that keeps people connected to the open
internet
just a small note on network data as
well I'm sure everyone in this crowd has
at one time or another or regularly uses
a VPN and
uh not all VPN providers are created
equal not all of them are to be trusted
so um I wanted to just make a note on
how to be privacy
conscious as a vpm provider
you're not technically Anonymous from uh
your vpm provider because at the end of
the day you are agreeing to Tunnel all
the traffic from your device across some
third party servers that you don't know
them and you don't really know what
they're doing with your traffic and you
have to click that button that says I
trust this
provider um so with siphon we make sure
that we don't loog log anything the only
data that we're privy to is uh
statistics that come from the network
aggregate Network
statistics and uh no personally
identifying information on uh any
users you can know where people are
without collecting their IP addresses
because you can do the uh goip look up
on the client side and uh discard their
IP address without it ever having to
leave their
device and another great feature um that
siphon offers is you just download an
application you you don't have to
register you don't have to provide your
email address your phone number credit
card
Etc so what this data allows us to
do is um make some conclusions about the
censorship environment that's being
faced uh in different places and try and
make sense of how uh how our our Network
Protocols are being affected by those
Dynamics
uh it allows us to see how the software
is performing and how that could be
improved and uh it also allows us to
ensure that we stay one step ahead of
the
sensors this is a map uh in real time of
just showing uh where uh Sion users are
in the world there are at least some
users in every country I've High have
highlighted Sudan in the center there
because uh the recent blocking event uh
that occurred starting December 19th uh
it involved basically centrally uh
orchestrated blocking of all the major
social media platforms Facebook Twitter
WhatsApp and uh within a matter of days
as you can see we've gone up to half a
million users a day
there uh interestingly a lot of VPN
tools are not available in Sudan because
of the uh sanctions economic sanctions
so um
I think that's another another Factor
driving uh adoption and it
works it's not the first time that we've
seen um a rapid spike in siphon usage uh
in response to social social media
blocking there was a case earlier this
year in the
summer um starting about mid July in
Iraq where there were protests in bazra
and the Southern Southern regions and
again the government reacted by
blocking Facebook Twitter WhatsApp
basically essential social media and
communication platforms that people rely
on like uh anyone from the Mina region
like you know WhatsApp is uh what's up
is life a lot of other regions
too um and
uh we were above 4 million users a
day uh over that time
period
this is a snapshot of the protest period
that began uh near the end of December
last year in
Iran where thanks to uh I guess like
good overall good Network
performance in the country uh where
sometimes uh VPN connections uh or other
circumvention methods like the tour
Network aren't as reliable um siphon has
a fairly good reputation there and uh we
reached a peak of 14 million users a
day uh after they blocked uh telegram
the basically the only
essential uh instant messing instant
messaging service You could argue that
was uh already like left uncensored by
by the authorities there uh as well as
Instagram same case and so B basically
there was an Countrywide and
for uh ways to stay connected with that
and that kind of represents almost uh A
fifth or even a quarter of all internet
users in Iran were using siphon during
this time
period another note on scalability is
that the network is pushing at the peak
like 1.4 pedabytes of data per per
day uh on a on networks that are known
to be like average average speed of two
MVPs connection or something like that
um it's pretty pretty
impressive and again I I I did mention
the sort of uh the challenges of scaling
peer-to-peer type uh circumvention
Services
um one of the advantages of having a
kind of cloud cloud-based uh centrally
manage system is that we are able to to
uh provision servers rapidly when there
are uh incidents like
this um Iran has been some of the most
challenging some of the most
sophisticated some of the most
aggressive uh censorship that we've
encountered over the past
year
um and that comes from their motivation
not just to block content but also to
block the methods that people use to get
around the filtering there which is uh
become in in the past decade or so a
regular part of going on the
internet telegram was finally banned via
a court
order which also stated that telegram
must be blocked in such a way that no
Iranian can access it not even with
circumvention tools and so there there
was a push from the internet providers
there which are uh so some countries you
might see a lot of heterogeneity in uh
the the blocking
enforcement as
uh say the talk that was about the
telegram blocking in Russia uh which was
given by Leon
yesterday uh his research showed that
there was some some uh varied compliance
or delayed compliance from uh some
internet providers there in Iran uh the
ice PS seem to be very centrally
controlled and uh so uh the blocking
rule was basically implemented
Countrywide so these statistics are
showing uh daily users of siphon and uh
a telegram client that was deployed
integrated with our
library called telegram Dr which uh
within the first day was U like already
up to close to a million
users this is uh a shot of tour usage
during the same time you notice uh tour
direct connections start to drop off in
favor of
bridges
um but that's uh maybe 10,000 users a
day compared
with 10 times 100
times this is an example of the
advantage of the multi-protocol uh
architecture that siphon is using for
transport
it protect uh these are just by Pro
protocol group showing hourly
connections and you can see when one or
two types of protocols get knocked out
uh the balance of connections is picked
up by uh by the other transports that we
use so effectively without blocking all
the
protocols uh the network will remain uh
resilient
this is another example showing uh China
during the uh 19th party Congress which
happened uh last
October basically beginning in uh in
July of that summer uh WhatsApp voice
and video calls were beginning to be
blocked and only messaging was working
sort of drove the adoption of uh lots of
different circumvention tools tools but
there was simultaneously an order to ban
vpns in in China as well uh which which
was slowly being orchestrated and even
uh complied with by parties like uh say
apple which removed VPN apps from the
App
Store um finally in about mid-september
WhatsApp was blocked
completely uh and you can see that uh
our usage there started to increase a
lot then at the beginning of the party
Congress actually an attempt to filter
siphon based on protocols and actually
the protocols that were targeted were uh
not connecting successfully or were
taking a long time to connect but uh
nonetheless we were able to sustain um
usage through that time period to make
sure that people had open access to
information
okay so just a recap of some of the
trends that have been uh noticed over
the the past
year uh for sure deack and inspection is
getting uh cheaper and easier to
implement uh possibly even um able to
look deeper into web traffic without
sacrificing
performance uh a spec that I saw uh it
was an article from Radio free Europe
Radio Li Liberty uh which was about a
meeting of the uh B basically DPI
filtering providers
in Russia uh the the newest spec was
they wanted these systems to be able to
run at scale at scale on a one terabit
per second feed of data which uh I mean
that's really shocking uh shockingly
High number so that uh that's possibly
the next generation of this technology
that we're going to see um as I
mentioned a Crackdown not just on
content but on on circumvention tools
and vpns um vpns especially especially
becoming a lot more easy to block not
just for the sort of
notoriously uh notoriously sophisticated
censoring Nations like China and Iran
but anyone any government can really
afford a DPI box nowadays and it really
has just a switch that you can turn off
vpns if if you want
to um another good point is collateral
damage is becoming less
reliable so the example that I showed
from
Iran uh we observe that uh so um this is
just an anecdote on the same story
basically uh even when you have
encrypted communication on the
internet some part of that transaction
happens unencrypted it's called the TLs
handshake so basically when you're going
to communicate encrypted to that server
you are going to say hey there server
I'd like to talk encrypted with you the
server is going to say okay like I can
talk
tls1.1 1.2 1.3 and then you agree and
then you talk
encrypted so uh Iran blocked traffic
based on some uh TLS handshakes that
were suspected to be being
used the the TLs handshakes that cipon
was
using at that time were emulating some
of the most ubiquitous and common TLS
handshakes that are used online like
like Google Chrome Firefox Chrome
Android there like most widely used kind
of web
browsers in in the
country and when this filtering rule was
implemented users reported uh problems
with uh using those Central internet
services your web browser starting
starting to break because of filtering
rules that were deployed to Target one
specific thing but not surgically
enough uh that said it seems that
sensors in 2018
oops
yikes sorry about
that sensors in 2018 are willing to
sustain large amounts of collateral
damage or block unreasonable amounts of
benign web traffic going in and out of
the country just in an effort to enforce
their uh blackless
rules um another thing that we've seen
not in 2018 but in PR previous years is
the willingness to even block entire uh
cdns so using kind of critical
infrastructure pieces as a way of uh
concealing or offis offis skating
circumvention traffic may not be the
most reliable uh method going forward
another thing that that has been
observed is
uh sensors are beginning to block only
certain IP ranges at the suevel of the
CDM as well that are suspected to be
involved in circumvention traffic and
kind of like being able to block just
part of a CDN instead of the entire
domain so that's something to look up
for in the in the coming
year so uh by way of conclusion what can
you
do uh one don't settle for partial
internet anything less than the entire
open internet is uh not the worldwide
web
secondly you can blow the whistle on
censorship if it's safe for you to do
so uh thirdly you should use free open
source circumvention software and
support
it uh fourthly come work with us if
you're a researcher if you're a
developer uh if you're a media
provider um we can work together and uh
we'd love to call out
collaborate and lastly um especially app
developers you can use our open source
libraries they're all on our GitHub uh
if you want to add some uh censorship
resilience to applications that you're
working on then uh that's uh something
that's highly encouraged and uh we'd
love to speak more about
that and we have about 10 minutes for
questions so I will uh leave it at that
thank you very
[Music]
much so
and I already see people lining up at
the microphones and we also have
questions from the signal Angels so we
just hurry to your questions microphone
one please uh hi I wonder uh you didn't
mention like uh I see the biggest stress
to and censorship from censorship is
from uh big teag giants like Google
Facebook and their manipulative
algorithms so this is like the biggest
threat and you kind of didn't mention I
think this this would be like uh I think
this should be the focus like how do we
bypass this uh
yeah because this these Tech Giants
become more powerful than any like head
of any state and uh they're like really
you know I I experienced just uh days
ago uh we started petition you know
which was totally Shadow banned on
Twitter and Facebook so this is the
biggest threat from from censorship even
bigger than State
uh
parties I mean what you haven't
mentioned anything what what's your
perspective on that I think I did
mention at the very beginning kind of
the shift from first generation that's
interceptive forms of censorship to the
second and third generation of of
information controls which is like uh
one being able to have legal mechanisms
that enforce uh the blocking of content
and even the takedowns of content from
say major social networks like Facebook
and Twitter
uh and and other apps too telegram uh
has kind of ad administrators on on
their channels and groups now that are
accountable to sort of local
laws that's something that circumvention
technology doesn't expressly deal with
at this time um we are more concerned
with maintaining access to the sort of
the web platform itself when it gets
blocked uh but sure that's definitely a
concern I would say an even greater and
uh more difficult concern uh in this day
and age than then simply being able to
access content is being able to preserve
content that's up there um so that's not
something that I have an easy solution
for but definitely something that uh
that I'm Gravely concerned with
sure democracy can be pre-programmed by
their algorithms and censorship so this
is kind of the biggest threat from
censorship as this herea but thank you
thanks so next one from the signal angel
please so you mentioned the OS s
protocol that of you Cas ssh what
clients and servers can you recommend
that Implement that
protocol uh as far as I know it's it's
implemented in siphon I'm not aware of
any other clients that uh that use it
but uh I believe it's an open source
transport so uh probably there are some
people out there using
it uh and I should add to that um it's
not always guaranted be guaranteed to be
the same thing like
um it it doesn't stay it doesn't stay
the the same for long and probably other
implementations of it have different
ways of arisca the traffic
specifically hi we have more questions
on microphone
to um thanks for your talk I'm I have
two questions one is um as I understand
right the um end user software is open
source um um how about these server
components um can I run my own VPN
provider um and um do you plan to to
open source the the software on the
server side uh second question would be
like I can imagine that uh running a
infrastructure that serves uh so many
users at this scale is pretty uh um
costly so what is the the bimas model if
uh you don't need to register um and it
donation based Where do you um get the
money to pay the bill at the end of the
month okay first question thank you for
your question first question first uh
siphon is open source the client client
software server software um or server
code it's all in our GitHub
theoretically you could compile your own
circumvention client um run your own
network if you have like some servers at
your disposal that you want to do that
then there's nothing stopping you from
doing that
um second question sure that it's
definitely a challenge maintaining um a
user a user base this large on on a free
on a free service so um some of the ways
that that's supported is um one we we
have a an app that allows you to
subscribe for premium service for like
the sort of
uh not explicitly censored countries
like the United States or European union
or whatever uh people that uh feel
conscious enough that they want to
support internet freedom for others by
supporting the network that that's
really encouraged we also work with
International broadcasters that have a
mandate to support internet Freedom
around the world and uh we can work with
them to uh basically provide
circumvention technology that helps them
deliver content into closed societies uh
and and in exchange uh we have a way of
supporting the free
users okay thank you I would take the
signal Angel again because the others
can also come in front then
later have you seen countries with
surprising amount of users countries
which are not usually considered to have
heavily restricted internet
access pardon of me could you repeat the
question have you uh in your statistics
do you have countries where the amount
of users in that country surprised you
because that country is not usually
considered to heavily restrict internet
access yeah absolutely um plenty of
Western countries have pretty
significant um cphon user bases maybe
tens maybe hundreds of thousands of
users but even here in Germany um or in
the UK it's not to say that like
countries that are known to be free
internet open internet countries it's
not to say that every Network in that
country is free and open um plenty of
institutions workplaces is uh
universities uh maintain a pretty
aggressive Blacklist of some types of
content uh or some applications so
that's um that's something that I see as
a a key driver of circumvention usage uh
in those
countries thank you microphone for
please let's suppose I'm a sensor and
who likes to use traffic
fingerprinting to sensor and I wonder
how efficient is it uh if I want to keep
the number of uh Force positives
low uh are there any studies on the
effectiveness of traffic
fingerprinting uh I want to filter the
bad traffic but to keep the good traffic
safe thanks for your question uh traffic
fingerprinting is is known to be fairly
imprecise uh there's a there's a um I
mean I I don't have any studies I can
reference but anecdotally within the
kind of Internet Freedom
Community what uh people are saying is
that it's it's becoming better um but
yeah collateral damage is a calculation
that uh every sensor needs to make
and in some cases they don't mind in
some cases they don't know what other
traffic is being filtered as a result of
the measures that they're
implementing and uh it is it remains in
many ways a kind kind of a whack-a-mole
approach there was a there was a study
last year that was on um specifically
like machine learning enabled uh
censorship um which was extremely
imprecise it had a lot of false
positives it was
like um something like 80% successful
they claimed the the researchers claimed
uh which obviously that's not enough to
deploy it at uh internet
scale okay and we have one question at
microphone
one hi hello H hello hello so uh
sometimes I wear your hat and sometimes
I put on another hat where I'm your
enemy um I won't go into the reasons why
I sometimes uh find that throttling can
be more effective than blocking because
you know user might get bored
downloading waiting for a YouTube video
to load and go away and do something
else which leaves the bandwidth
available for other people so I'm
wondering if you've ever seen um that
tactic being used where rather than you
would actually block a website and give
up a a message saying you know 404 or
it's a connection reset or something
where you just actually make it unusably
slow you're assisted
men are you assisted men of
course um thanks for your
question yes that's definitely a tactic
uh I think also trying to diffuse the
accountability for censorship is is
another reason that they do that
because
um there's sort of no guarantee that
it's not a problem with the content
provider site or something um there
there have been lots of examples I mean
I can share with you
afterwards of uh internet throttling
used on specific domains uh to sort of
uh like China for example famously kind
of not exactly blocking your connection
but just throttling you to uh a
completely unusable
degree I would say when that's deployed
on specific domains circumvention tools
still uh still work effectively when
it's deployed on a network scale then
there's not too much uh that we can do
or like an internet shutdown that's one
case where how doesn't matter how robust
and resilient the circumvention software
that you're using is is if no one has an
internet connection with one exception
um notably in in siphon history where
some we kept networks online in a case
of an Internet shutdown uh yeah does
that answer your question thanks thank
you and we have one more question from
the signal
Angel have you had governments or other
organizations try to fight you legally
for enabling their users uh to
circumvent the content filters
no that is a nice short answer so we
have one more question here or three
more in the audience I take microphone
too
please hello you mentioned uh domain
fronting as a as an effective way for
for high value uh domains um when Google
and Amazon stopped tolerating uh domain
Fring have you as an organization been
in touch with
them
we were part of some discussions on the
issue since um we notably do use that as
a
technique siphon has never done domain
fronting through Google or Amazon
um I mean to go back to the example of
like a circumvention method that works
for tens or hundreds of users but may
not work for tens of millions of users
this is this is a a perfect case in
point I think for that is like sure it's
a cool trick maybe it's doesn't require
a lot of technical sophistication to put
google.com in the header of all the
traffic that I send but if I have tens
of millions of users then that's
potentially going to like sabotage the
person's domain that I'm using so any
any domain fronting that's done on a
scale that um like the siphon Network
uses it's done under uh close
collaboration and and and a formal
agreement not
uh not in the informal way that it was
that it was being done by so many
different app developers uh which I
think is the reason that it was
eventually cracked down upon it does
violate the terms of service of uh of
those domains so yeah does that answer
your
question so the person on microphone 4
is now disappeared
um not coming back okay so thanks a lot
Keith for your um presentation and for
answering all those questions and you're
still here for a few offline questions
uh that's really
nice so thanks you all that you were
here than thanks
[Music]
Kei
[Music]
oh