And of course, they control the hardware and software. I wouldnt risk it as a foreign national who has occasionally done work in the defense industry, but everyone has a different risk tolerance.

Deep level packet inspection, they detect patterns or whatever in encrypted traffic (and the lack of thereof) and ban the destination ip china-wide.

How they do I have no idea, but they do, on my direct first hand experience. Its not based on domain names, directly straight and total ip ban. All ports, all domains on that ip get banned forever just because you started using a VPN (OpenVPN in my case, it was a few years ago).

To someone watching network traffic, a VPN connection looks like two machines exchanging encrypted packets. You can’t see the actual data inside the packet, but you can see all the metadata (who it’s addressed to, how big it is, whether its TCP or UDP, when it’s sent). From the metadata, you can make guesses about the content and VPN would be pretty easy to guess.

When sending a packet over the Internet, there’s two parts of the address: the IP address and the port. The IP address is a specific Internet location, blocks of IP addresses are owned by groups (who owns what is public info) and there are many services that do geo-ip mappings. So if you’re connecting to an IP address that belongs to a known VPN provider, that’s easy.

The second part of the address is the port-number. Servers choose port-numbers to listen to and the common convention is to use well-known ports. So, for example, HTTPS traffic is on port 443. If you see a computer making a lot of requests to port 443, even though the traffic is encrypted we can guess that they’re browsing the web. Wikipedia has a list (which is incomplete because new software can be written at any time and make up a new port that it prefers) and you can see lots of VPN software on there. If you’re connecting to a port that’s known to be used by VPN software, we can guess that you’re using VPN software.

Once you’re running VPN software on an unknown machine and have configured it to use a non-standard port, it’s a bit harder to tell what’s happening, but it’s still possible to make a pretty confident guess. Some VPN setups use “split-tunnel” where some traffic goes over VPN and some over the public Internet. (This is most common in corporate use where private company traffic goes in the tunnel, but browsing Lemmy would go over public.) Sometimes, DNS doesn’t go through the VPN which is a big give-away: you looked up “foo.com” and sent traffic to 172.67.137.159. Then you looked up “bar.org” and sent traffic to the same 172.67.137.159. Odds are that thing is a VPN (or other proxy).

Finally, you can just look at more complex patterns in the traffic. If you’re interested, you could install Wireshark or just run tcpdump and watch your own network traffic. Basic web-browsing is very visible: you send a small request (“HTTP GET /index.html”) and you get a much bigger response back. Then you send a flurry of smaller requests for all the page elements and get a bunch of bigger responses. Then there’s a huuuuge pause. Different protocols will have different shapes (a MOBA game would probably show more even traffic back-and-forth).

You wouldn’t be able to be absolutely confident with this, but over enough time and people you can get very close. Or you can just be a bit aggressive and incorrectly mark things as VPNs.

You do visit them. Its a tea chat

It’s getting a little better now because they can just scan in what they wrote and OCR it

VPNs as a technology might not be illegal but circumventing the firewall certainly is.

Unless you are very vocal and high profile person no one will black bag you in a country of billion people, lol.

This is a bit of a misunderstanding about how things work in an authoritarian system. Sure, you might fly under the radar for awhile, but if you call attention to yourself (say, by getting caught trying to bypass the government firewall) and you are not high-profile, then it is very low-effort to make you disappear. Few will notice, and those that do will stay silent out of fear.

If you are more high-profile you still get black-bagged, you just get released after, with your behavior suitably modified.

<img alt="" src="https://infosec.pub/api/v3/image_proxy?url=https%3A%2F%2Fsubstackcdn.com%2Fimage%2Ffetch%2Fw_1272%2Cc_limit%2Cf_webp%2Cq_auto%3Agood%2Cfl_progressive%3Asteep%2Fhttps%253A%252F%252Fsubstack-post-media.s3.amazonaws.com%252Fpublic%252Fimages%252Fa793d54d-66ea-44be-bc93-dd9de58ace03_1100x445.webp">

Naomi Wu no longer uploads to YouTube.

They have. I don’t know what people are talking about in this post. It’s bypassable easily, and the CCP won’t kill you for it. There are so many Chinese using aVPN themselves to bypass GFW

Last time I was there, express does not work, and I heard proton also does not work. However, my mobile carrier by default routes all roaming traffic through UK, so that did work.

These are the true points, however the 4th reason to use a VPN is if you are using a fingerprint-resistant browser and lots of other people are too, it’s harder to track who is going where, since the exit IP is shared.

If tor isn’t working for whatever reason

If all your connections come from the same IP, and you’re the only one using that IP, then everyone knows all of your traffic is associated with you.

If the advisory is the State, then the ISP will still he able to see all your traffic.

Look into Snowflakes. The snowflake proxies are hosted by people in low censorship countries with the browser extension installed. The IP addresses are all over the place so they are hard to block.