Facebook, Google Plus, Uncensored Search etc without a VPN

GreatFire.org's mission is to bring transparency to online censorship in China and to that end we are continuously making our own improvements to how we monitor blocked searches and key words. This past week we launched a new version of our web site where we now provide real-time searches so concerned netizens can keep up to date with information which is being censored via the Great Firewall of China.

We are also fortunate in that we have a core of super users who are constantly and consistently testing our technology to keep abreast of censorship in China. After we launched the new version of the site, we received this feedback from one of our super users via Twitter:

@percyalpha:

Congrats on ur update. But it seems connection reset for https is not detected by ur server. e.g https://en.greatfire.org/https/www.youtube.com

After receiving this message we logged on to Facebook, checked out Google Plus and did some searches on Google, specifically for freedom and 六四. What's so special about that? These websites and searches are blocked in China but we were able to access them without using a VPN or proxy, the tools people commonly use to get around this censorship.

How did we do it?

We launched a new version of the website last week, and among other things it detects types of blocking including the infamous Connection Reset. For some reason, however, it did not report Connection Reset for a test of YouTube on March 17 - nor any other type of censorship. All the data suggested that the encrypted version of YouTube was not blocked in China on that day. Could that be right?

Notice that I said the encrypted version. That means https://www.youtube.com, and not http://www.youtube.com. One single letter makes all the difference when it comes to Internet communication. When browsing a URL that starts with https://, all the traffic between you and the server is encrypted and therefore out of reach of any content-based filtering such as what's practiced by the Great Firewall of China (GFW). It means that the GFW cannot interfere with the connection based on it's content, such as the URL, any data sent in forms, or the response data. It can, however, interfere in other ways:

1. DNS Poisoning

In short, this means that the IP address returned for the requested domain is incorrect. This happened when our system tested YouTube again today (but not yesterday - which is why it seemed to be accessible). More on DNS Poisoning in our FAQ.

2. IP Blocking

This means that the actual IP address of the server where the website is hosted is blocked. All communication with this server is subsequently made impossible. However, this type of filtering is not very effective nowadays, because IP addresses tend to change frequently. Major websites use load-balancing and globally distributed hosting meaning that they have a range of IP addresses at their disposal. For example, if you go to google.com, and then again half an hour later, it may well direct you to different servers. The content looks the same, so you don't notice. You also don't care, because it's technical mumbo jumbo - unless, that is, you live in China or some other authoritarian country with major Internet censorship.

So what's the "So what?"

Let's put together what we have so far:

  1. If the connection is encrypted (ie, the URL starts with https://), the Great Firewall cannot know what the content is and cannot block the request based on it's content.
  2. It can however use other types of censorship, such as DNS Poisoning and IP Blocking.
  3. If we can get around these other types of censorship, we can get around the Great Firewall!

DNS Poisoning is probably the least sophisticated type of Internet censorship tool that the Chinese and other strong-armed governments have at their disposal. To get around this type of censorship, all you need to do is to use an alternative DNS solution. Here's the juicy stuff:

Solution 1: Use IP addresses directly

Instead of using a DNS service, which can be and is manipulated by Chinese ISPs, you can enter the IP address directly. For example, instead of browsing to https://encrypted.google.com (which is blocked) you can browse to https://74.125.235.100 (which is, at the time this is written, not blocked). This is the encrypted version of Google, which means that you can search for anything, including the two examples mentioned at the beginning of this post, or any of the other 200+ searches that are otherwise blocked in China.

Another example is https://199.59.150.7 - at the time this is written, we're able to access Twitter on this URL.

  • Pros
    • You can access any blocked website if it has an encrypted version (a URL that starts with https://) and it's IP is not blocked.
  • Cons
    • You have to know the current IP address of the website (or one of them, there is often a range). IP addresses of major websites change frequently. 
    • You have to enter IP addresses instead of domains every time you want to visit a blocked website.
    • Your browser will compain about the SSL cerficicate being invalid, because you're not accessing the website on it's real URL. You have to manually confirm an exception to access the website.
    • Some websites, such as Facebook, will redirect you to the domain if you try to acccess them directly through their IP.

Solution 2: Manually add IP addresses to your hosts file

What if you could tell your computer to remember that certain domains should resolve to certain IP addresses so that in the future you do not need to remember different IP addresses? Guess what - you can. Every operating system (that I know of) maintains something called a hosts file which is the local cache for DNS entries. Whenever you lookup a domain, such as www.facebook.com, your computer will first check this file and if there's an entry, it will use it. Normally it isn't used for anything, but it can be. All you need to do is to edit your hosts file (here's a tutorial on how to do it) and add entries for the websites you want to unblock. For example, to access Facebook, I added the following:

69.171.224.11 facebook.com www.facebook.com
184.31.178.110  s-static.ak.facebook.com
 
Then save the file, and go to https://www.facebook.com in your browser (remember the https://).
  • Pros
    • You can access any blocked website if it has an encrypted version (a URL that starts with https://) and it's IP is not blocked.
  • Cons
    • You have to know the current IP address of the website (or one of them, there is often a range). IP addresses of major websites change frequently.

(Non) Solution 3: Use a third-party DNS service

What if there was some alternative DNS service that you could use instead of trusting your ISP? Google provides just such a service called Public DNS. Moreover, it's not blocked in China. However, there is a major weakness to this approach. The DNS request to the third-party provider is not encrypted and so it can easily be blocked or tampered with by censors along the way, such as the GFW. We tried accessing some major websites that are blocked using Google's Public DNS and were unable to do so.

Solution 4: Use an encrypted DNS service

This is where it becomes really exciting. There's an application called DNSCrypt which provides a third-party DNS service (OpenDNS) over an encrypted protocol. In essence, this is a keyturn, free solution for getting around major parts of the online censorship in China. All you need to do is to 1) download and install the software (the download site is not blocked, so far) and 2) Make sure to use encrypted versions of blocked websites (eg https://twitter.com instead of http://twitter.com). Unfortunately, DNSCrypt only works with Mac OS so far.

  • Pros
    • You can access any blocked website if it has an encrypted version (a URL that starts with https://) and it's IP is not blocked.
  • Cons
    • It's for Mac only (so far).
    • You have to trust OpenDNS.

What about speed?

When you use a VPN or proxy to access blocked websites, all traffic is rerouted through your third-party servers. One drawback of this is speed. For example, if you are in China, your VPN server is in the US and the website you are browsing is in Singapore, every request you make is routed first to the US, then to Singapore, then back to the US and finally back to China. All this means that it's bound to be slower than if you could access it directly. Using the techniques described in this post, you can do just that: access blocked websites directly from China. It should be faster.

Overview

Let's put it all together to compare, and add in a general VPN solution for reference.

 IP Address DirectlyHosts FileGoogle Public DNSDNSCryptVPN
Access blocked websitesYYYYY
Free of chargeYYYYN
Direct access to blocked website, avoiding third-party reroutingYYYYN
Works for unencrypted websitesNNNNY
Works if IP is blockedNNNNY
Does not require you to know IP addressesNNYYY
Does not require you to enter IP addresses instead of domainsNYYYY
Does not cause invalid SSL CertificatesNYYYY
Access websites that redirect you to their domainNYYYY
Prevents DNS PoisoningYYNYY
Available for all operating systemsYYYNY

Other notes

More and more websites are offering encrypted versions, and several are switching to HTTPS by default, including Google as well as our own GreatFire.org. This is changing the game for governments around the world that are trying to censor the Internet.

YouTube offers an encrypted version of its website but unfortunately the actual streaming of videos is not encrypted. This means that by using the techniques described in this post you can access YouTube (and it's fast!) but the actual viewing of videos won't work.

There's a Firefox and Chrome extension called HTTPS Everywhere which automatically redirects you to HTTPS versions of major sites.

What do you think?

  • Are you able to use these techniques to get around online censorship?
  • Do you know of other encrypted DNS services that work on other operating systems?
  • Are there other ways to use these tools?
  • How do you think this will affect future development of the Internet, attempts to censor it, and ways around the censorship?

Comment is free.

评论

更多博客文章

订阅 email
显示 博客 | Google+ | Twitter | 全部 的消息. 使用 RSS 订阅我们的博客。

星期四, 11月 30, 2017

关于在中国苹果商店被审查的那674个软件

苹果对中国区的审查行为敞开了大门 - 但这似乎只是冰山一角。

星期二, 5月 23, 2017

Is China establishing cyber sovereignty in the United States?

Last week Twitter came under attack from a DDoS attack orchestrated by the Chinese authorities. While such attacks are not uncommon for websites like Twitter, this one proved unusual. While the Chinese authorities use the Great Firewall to block harmful content from reaching its citizens, it now uses DDoS attacks to take down content that appears on websites beyond its borders. For the Chinese authorities, it is not simply good enough to “protect” the interests of Chinese citizens at home - in their view of cyber sovereignty, any content that might harm China’s interests must be removed, regardless of where the website is located.

And so last week the Chinese authorities determined that Twitter was the target. In particular, the authorities targeted the Twitter account for Guo Wengui (https://twitter.com/KwokMiles), the rebel billionaire who is slowly leaking information about corrupt Chinese government officials via his Twitter account and through his YouTube videos. Guo appeared to ramp up his whistle-blowing efforts last week and the Chinese authorities, in turn, ramped up theirs.

via https://twitter.com/KwokMiles/status/863689935798374401

星期一, 12月 12, 2016

China is the obstacle to Google’s plan to end internet censorship

It’s been three years since Eric Schmidt proclaimed that Google would chart a course to ending online censorship within ten years. Now is a great time to check on Google’s progress, reassess the landscape, benchmark Google’s efforts against others who share the same goal, postulate on the China strategy and offer suggestions on how they might effectively move forward.

flowers on google china plaque

Flowers left outside Google China’s headquarters after its announcement it might leave the country in 2010. Photo: Wikicommons.

What has Google accomplished since November 2013?

The first thing they have accomplished is an entire rebranding of both Google (now Alphabet) and Google Ideas (now Jigsaw). Throughout this blog post, reference is made to both new and old company names.

Google has started to develop two main tools which they believe can help in the fight against censorship. Jigsaw’s DDoS protection service, Project Shield, is effectively preventing censorship-inspired DDoS attacks and recently helped to repel an attack on Brian Krebs’ blog. The service is similar to other anti-DDoS services developed by internet freedom champions and for-profit services like Cloudflare.

星期四, 11月 24, 2016

Facebook: Please, not like this

Facebook is considering launching a censorship tool that would enable the world’s biggest social network to “enter” the China market. Sadly, nobody will be surprised by anything that Mark Zuckerberg decides to do in order to enter the China market. With such low expectations, Facebook is poised to usurp Apple as China’s favorite foreign intelligence gathering partner. If the company launches in China using this strategy they will also successfully erase any bargaining power that other media organizations may hold with the Chinese authorities.

星期二, 7月 05, 2016

GreatFire.org 现在开始测试VPN在中国的速度和稳定性

在中国有一个普遍观念,如果你有一个可以使用的VPN,那么你应该保持沉默。就信息自由而言,这种观念的问题在于获取知识竟成了一种秘密。今天,我们推出一个项目,希望能够摧毁这种模型。

我们最新的网站,翻墙中心,目的在于实时提供那些能够在中国使用的翻墙方案的信息和数据。在2011年以来我们就已经开始收集在中国被屏蔽的网站,现在我们也将增加那些可用的VPN和其他翻墙工具。

我们发布翻墙中心主要有四个目的。

我们的首要目标是助长使用翻墙工具的国人的数量。通过分享我们这些工具的信息和数据,我们希望对更广泛的受众展示那些工具时可以使用的。

我们的第二个目标是通过带来工具性能的透明化来提升中国用户的翻墙体验。我们将会测试工具的速度(流行网站的加载速度)和稳定性(流行网站加载成功的程度)。

我们开发速度测试的目的是要真实反映用户的体验。当用户在网站测速时,浏览器在后台会从10个世界上最流行的网站上下载一些资源文件。根据Alexa排名,这些网站分别是Google, Facebook, YouTube, Baidu, Amazon, Yahoo, Wikipedia, QQ, Twitter and Microsoft Live。速度的结果是简单的计算下载文件文件的大小和下载所需的时间。我们同样也会验证下载的文件是否完整。如果文件的内容是错误的或者在40秒内无法完成下载,我们会标记为失败。这个数据被我们用来生成另一个重要指标-稳定性。

其他的速度测试工具仅仅是通过发送数据到它们自己的服务器来测量上传和下载的速度。这种数据无法反应用户的体验,因为正常的浏览器通常会频繁的发送一系列的请求(而不是上传或下载一个大文件)到许多的服务器,而不止是一个。

我们的第二个指标 - 稳定性 - 是其他的服务通常不会测试的。一个健康的互联网连接应该达到100%的稳定性,除非有人在测试中把网线拔了。但是在中国使用翻墙工具却不是这样。任何时候连接都有可能变得不稳定或十分缓慢。根据请求的大小,最终的地点和代理的方式,一些请求有可能会失败。比较服务的稳定性要比比较速度更加重要。

你可以测试任意的翻墙工具,列表之外的也可以。中国的VPN用户也可以测试他们的工具,测试结果也会添加到数据库中。这些数据都将会对所有人开放。实时的在中国测试是非常重要的,因为VPN随时都可能被封锁或解封。我们欢迎任何的关于测试过程的反馈。有技术能力的用户也可以通过审查我们的javascript代码来获悉我们的测试是如何工作的。

我们郑重的邀请翻墙工具的开发者们向我们提供测试过程的反馈。我们的第三个目标是帮助这些开发人员改进他们的产品,让更多的选择适用于中国的顾客。此外,越多的工具可以工作,就意味着中国当局对翻墙的打击就会越难。

中国的用户都知道,在过去的18个月中当局加紧了对翻墙工具的攻击。而翻墙中心将会吹响反击的号角。反其道而行之,让这不再成为秘密。我们要鼓励人们分享翻墙工具可以工作的信息。

我们的第四个目标就是要为GreatFire.org创造收益。目前GreatFire仍然依靠世界各地的热心人士和组织的捐款。我们希望减少对这些机构的依赖,并探寻GreatFire.org自给自足的道路。用户只需到翻墙中心就能购买任意一款我们目前在测试的付费工具。GreatFire将作为这些工具在中国的经销商,因此VPN供应商会给予我们每个零售的一部分。用户也不必在中国购买这些翻墙服务。

使用 RSS 订阅我们的博客。

评论

Good news regarding DNSCrypt - it is also available for Linux, and works well. I used the guide at http://www.ab9il.net/crypto/dnscrypt.html and was getting through the GFW for many more websites than before. Still need a VPN for Facebook, though.

That is really attention-grabbing, You are an overly professional blogger.
I have joined your rss feed and stay up for in search of more of your
magnificent post. Additionally, I've shared your site in my social networks

my page: http://www.franchiseprovider.com

It's great in desserts as long as it is 100% barley and doesn't have anything else such as corn syrup added to it.

The complete Green - Pan Stainless Steel Ultimate Gourmet Cookware Set is
easy to maintain and is dishwasher safe and includes a manufacturer's lifetime warranty.
Fold the cutlet around the stuffing as if you were making a burrito
or egg roll.

Here is my webpage the green pan at target (Amelie)

frеe live sex seem too dominate the oոline adult enteгttainment
ѡorld. Manny men and women use them for indiνiɗual recreatiօn so why might a guү or gal use live sex.
While in thhe era off the world wide web adult lustful connections are
getting tоo bbe tougher both ladies aոd mеn
hаve got made use oof free live sex sߋ that you
can release intimate aggravation. Yet itt іs no surprise to discokver
that you have even moгe guуs desiring free live sex compared to you will discover galks free live sex.
Eaϲh enjoy haѵing nwked bodieеs on cam either customarily wߋmen of all ages aгe much more particular
as compared to men. In terms of free live sex males are ovten aesthеtic humans ɑnd are
generallу easily sexual arouse Ьy simply live sex.
Women frequentlƴ desire psychological in addition to opticl arousal whilе νiewing live sex.
It iss easy to comprehend why males enjoy visiting uոԁressed fеmales ߋn livve
sex. Pying attention toօ bloondes on cam іs a major turn on for
them. Watching live sex camѕ aids de tensіon their νery own daily
life. It also helps diѕtrazct frοmm еѵery dayy pressurе.
After a loոg workinjg day doing work it helps. It's rеally a іԀentified indisputable fact that jerking off freeѕ anxiety and produces chemical substanceѕ in the body that calm.
There will be a lot of judgment linked to viewіng live ssex cams on
the աeb. Generally there mustn't be. It is ɑ wholesome Ԁepictiߋn reցarding libido.

livesexfor.me

This is very interesting, You are an overly skilled blogger.
I have joined your feed and look forward to looking for extra of your excellent
post. Also, I have shared your website in my social networks

Here is my blog :: pizza kabaty

inspired a lot from this post am following this blog regularly and found very good for bookmarking thanks admin
happy new year 2015 sms
indian festivals 2015
public holidays 2015
new year 2015 quotes
happy new year 2015
new year 2015 quotes
new year 2015 greeting cards

this post is awesome, great msg for us, plz update ur blog for daily basis, i am regular visitor of this site, so keep posting for us,

click the below links to create backlink
best free backlink website
click here for msg movie

Hi! This is my first visit to your blog! We are a team of volunteers
and starting a new project in a community in the
same niche. Your blog provided us useful information to work
on. You have done a extraordinary job!

is really simple. We just need to go to the Mobdro download web page Mobdro for Chromecast online, after that Mobdro app is an excellent app to have.

It is an open resource system, there are extra designers adding PlayStoreGuide which is offered with iTunes. Applications downloaded and install via Google Play

It will certainly alert the business of prospective concerns different website McDonald's is among the biggest chain of junk food dining establishment worldwide.

添加新评论

Filtered HTML

  • 自动将网址与电子邮件地址转变为链接。
  • 允许的HTML标签:<a> <em> <strong> <cite> <blockquote> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • 自动断行和分段。

Plain text

  • 不允许HTML标记。
  • 自动将网址与电子邮件地址转变为链接。
  • 自动断行和分段。
By submitting this form, you accept the Mollom privacy policy.