Hacker News new | ask | show | jobs
by myspeed 734 days ago
I built libp2p tunnel based VPN(Kadugu VPN) and open sourced it. Its a custom solution, it can't be finger printed. Generated traffic uses QUIC based transport to reach other end. Just like any browser based web traffic. In future, custom VPN solution will be flooded in market that can be easily setup. Finger printing will be difficult in these solutions.
2 comments
person4268 734 days ago
Not if the network blocks QUIC in its entirety to force clients to fallback to HTTP1. I'm pretty sure the network I'm currently on does this.

But, it looks like the type of fingerprinting in the article utilizes the fact that VPN connected devices are only connected to and sending data mostly to only one host, which using QUIC won't help with - you'd need to add some sort of "noisemaking" functionality involving sending bogus packets outside the tunnel, or possibly route VPN traffic across multiple nodes before forwarding to the actual vpn server ala Tor (as they propose in the conclusion).

link
j4hdufd8 734 days ago
> which using QUIC won't help with curious why not?
link
person4268 734 days ago
You're still sending packets to the same IP address. QUIC can't obfuscate that itself, all packets have to get routed over IP in the end. The paper relies on very little but that fact.

If one wanted to block VPN connections, they easily could do so by running such detection and then blocking all UDP (QUIC is built on UDP) traffic from the host to the suspected VPN server, too.

What QUIC helps with, in the context of dealing with DPI firewalls, is really just the obfuscation/encryption of as much connection info as possible, such as the SNI/Host in the context of an HTTP server, which normally is sent in plain text even with SSL/TLS (though ESNI efforts are starting to fix this)

link
generalizations 734 days ago
So maybe the solution is to double-send all the encrypted packets - once to the VPN endpoint, and once to the original target (but encrypted so it doesn't reach). Or maybe instead of the intended target, to some randomized selection of targets. You wouldn't get responses, but maybe that doesn't matter.
link
hawshemi 734 days ago
https://v2.hysteria.network/
link