[yorwba]

Trying to get off the hook on a technicality isn't going to work. Lots of people use VPNs completely in the open without getting jailed, because they're not otherwise of interest, but if you are being targeted, nobody is going to care about your "sshing to aws" excuse. And ssh tunneling web traffic looks quite different from normal ssh usage anyways.

[6LLvveMx2koXfwn]

> And ssh tunneling web traffic looks quite different from normal ssh usage anyways.

Could you explain this further, this seems counter to my understanding of encrypted traffic!

[praash]

I assume the timing patterns and amounts of data would likely be distinct between SSH and web. "Normal" SSH usage would mostly consist of much lighter packets, such as user keystrokes and terminal screenfuls of text. Typing tiny commands and getting a few kilobytes of output. SSH file transfers happen occasionally, sometimes with a large bulk of data.

Active web browsing requires downloading a crapton of files with wildly different sizes and sporadic timings between them. Add normal user interaction, API requests, ad cycles, long video streams that won't max out all bandwidth, all happening at once across multiple tabs. The client also sends much more data with each TLS handshake and all those HTTP headers.

This could probably be masked by deliberately filling idle periods with garbage data just to appear as a stable data stream both ways.

[mcpackieh]

Forget using a real web browser over an SSH proxy. What using elinks on a remote host with ssh? I bet somebody using elinks across ssh is virtually indistinguishable from somebody using a text editor.

Not much good for images or video, but you could easily read https://text.npr.org/

[yorwba]

SSH encryption only hides the content, not how much is being sent and when. When your browser fires off a bunch of requests to load a webpage, the timing is different from running typical commands on a server and receiving the output.

[justsomehnguy]

Open network tools in your browser and go to Reddit, count total traffic. Now compare it with a typical SSH session, even with 'tail -f' some logs.