Can users be found out even by using an invisible proxy?

[snake24]

Let's say china for example doesn't allow it's users to access certain sites. I think google might be included.

The use of proxies come into play here.


Yet think about this. Before you can send info to the proxy it has to go through the isp. Since the isp in china should be under government control won't they be able to see what the poster is receiving and sending to and from the proxy server? Wouldn't the user who's using an invisible proxy still be caught?



I'm a green horn here. Who knows there's probably a whole ton of info going to and fro from a huge country like china that it's impossible to even check by this way.



Let's say your in china maybe for work. You want to access a forbidden site, how do u ensure that you cannot be found out?

Is data sent to the isp encrypted?

 

[Rick]

You're right: information that travels through a proxy is still done so in clear text -- They can see exactly what you're doing through a proxy. Data sent to and from your ISP is *not* encrypted.

To get around this, you do need encryption.

The two most important things to keep the contents of your data from prying eyes are:

1.) A trusted, remote computer (Must be outside of China, for Internet purposes)
2.) An encrypted connection or tunnel established to that remote computer from the computer you are using to browse the web

For example, if you access a banking site from anywhere, no one outside of the bank can see what you are doing. Banking websites use HTTPS, which is encrypted. The encryption 'scrambles' everything done between 1.) Your computer and 2.) The banking website. In essence, it is a secure connection established between your Internet browser and the website. The Chinese government wouldn't be able to see your data without breaking the encryption (for all intents and purposes, impossible). The only other way is if they either compromise your computer or the banking website itself.

If you visit Google (HTTP) and do a search though, it is not encrypted and the Chinese government can see what you type in plain text without any problem.

Of course, HTTPS depends on websites that support it (mostly banks, merchants and such). Other methods of encryption exist and there are ways to use them to protect your web traffic, such as SSH tunneling, VPN etc... Much like the banking website, a secure channel is created between two computers: Yours and a trusted, remote computer. Everything that happens in between those two computers is secure. But everything that happens between the remote computer and the Internet is not secure. This means if you're using the remote computer as a gateway to access the outside world's Internet, the remote computer must also have a trusted connection. In this case, it is probably important to have a *trusted* computer with a *trusted* connection to the Internet... like a computer or ISP outside of China.

There are also softwares and networks that can be used such as TOR + Vidalia/Privoxy, for example, which decentralizes and encrypts your web traffic. This might be a good solution. Eventually, all encrypted data needs to become visible and decrypted once it reaches its destination though, so the trick is keeping it encrypted for the entire route through China's Internet... Once your data gets outside of China's network, you're able to do anything you'd like.

Also, keep in mind that generating substantial amounts data that is encrypted is in itself a 'red flag'. If they are actually inspecting the *type* of data traversing their network, encrypted traffic might serve as a warning signal. While they'll never be able to see what's inside the encrypted channel, access to the trusted, remote computer could be shutdown as a defensive measure.

 

[bobcat]

Anonymity on the Internet

As correctly stated above, if the data is not encrypted, it is visible to someone monitoring it.

But there is another aspect to the case, namely visibility of the site you visit and the info you get from it. This in not just applicable in China, but everywhere, and it is how piracy infringements are found out and brought to court. Your ISP is obliged by law to keep a record of all sites you visited in, say, the last 6 months. Thus, if the authorities see that an IP has up- or downloaded copyrighted material, by court order they can find out from the ISP the identity of the user behind that IP.

As I am not sure if advice on this matter is legit on this board because of possible abuse, I shall only give general guidelines. Using either an anonymising proxy or an onion (multi-node) router can hide your connection path.

But not all proxies are anonymising, some are transparent, even used as bait and monitored. At the same time, an onion router directs your traffic thru several intermediate nodes and can be transparent if the nodes are monitored. Furthermore, if someone using suitable equipment is analyzing your traffic, he can still find out where you connect to, whatever method you use to hide it.

In conclusion, anonymity cannot be guaranteed, but you can drastically reduce the probability of being followed.

 

[snake24]

You're right: information that travels through a proxy is still done so in clear text -- They can see exactly what you're doing through a proxy. Data sent to and from your ISP is *not* encrypted.

To get around this, you do need encryption.

The two most important things to keep the contents of your data from prying eyes are:

1.) A trusted, remote computer (Must be outside of China, for Internet purposes)
2.) An encrypted connection or tunnel established to that remote computer from the computer you are using to browse the web

For example, if you access a banking site from anywhere, no one outside of the bank can see what you are doing. Banking websites use HTTPS, which is encrypted. The encryption 'scrambles' everything done between 1.) Your computer and 2.) The banking website. In essence, it is a secure connection established between your Internet browser and the website. The Chinese government wouldn't be able to see your data without breaking the encryption (for all intents and purposes, impossible). The only other way is if they either compromise your computer or the banking website itself.

If you visit Google (HTTP) and do a search though, it is not encrypted and the Chinese government can see what you type in plain text without any problem.

Of course, HTTPS depends on websites that support it (mostly banks, merchants and such). Other methods of encryption exist and there are ways to use them to protect your web traffic, such as SSH tunneling, VPN etc... Much like the banking website, a secure channel is created between two computers: Yours and a trusted, remote computer. Everything that happens in between those two computers is secure. But everything that happens between the remote computer and the Internet is not secure. This means if you're using the remote computer as a gateway to access the outside world's Internet, the remote computer must also have a trusted connection. In this case, it is probably important to have a *trusted* computer with a *trusted* connection to the Internet... like a computer or ISP outside of China.

There are also softwares and networks that can be used such as TOR + Vidalia/Privoxy, for example, which decentralizes and encrypts your web traffic. This might be a good solution. Eventually, all encrypted data needs to become visible and decrypted once it reaches its destination though, so the trick is keeping it encrypted for the entire route through China's Internet... Once your data gets outside of China's network, you're able to do anything you'd like.

Also, keep in mind that generating substantial amounts data that is encrypted is in itself a 'red flag'. If they are actually inspecting the *type* of data traversing their network, encrypted traffic might serve as a warning signal. While they'll never be able to see what's inside the encrypted channel, access to the trusted, remote computer could be shutdown as a defensive measure.

HI there's still something i do not understand. Your isp is the one providing you with the connection. You need it to connect to anywhere in the net.

Take the https example u gave me. You need your isp to connect to the https website for eg. That means you have to pass the info which gets encrypted at the website am i right about this?


Someone told me about metropipe but it's not free.


Another person mentioned using open dns which i am using so the isp's own proxy doesn't cache my own data right?

 

[Rick]

Take the https example u gave me. You need your isp to connect to the https website for eg. That means you have to pass the info which gets encrypted at the website am i right about this?

HTTPS is a secure stream of data between you and the destination. The ISP cannot see the contents of your data.

Get ready for a bad analogy:

There are three people in a room. The first and last person are friends and understand Chinese and English. The person in the middle (ISP) only understands Chinese.

You want to send a message to the person at the other end, so you hand a note to the person in the middle to pass along. You wrote it in Chinese, so he reads it and understands it, then passes it to the person at the end. This is an example of unencrypted data... Everybody can read it.

An example of HTTPS encryption would be if you wrote the note in English. When you hand the note to the guy in the middle, he can't understand it because he *only* knows Chinese. He passes your note to the guy at the end anyway, who can understand English perfectly... You've both devised a safe way to communicate.

You and your English speaking friend on the other side of the room have created a secure channel, for as long as no one else in the room can speak English. With the case of encryption, no one can understand the protected data except the host and the intended recipient(s)... It's like a foreign language in a sense.

This example falls apart though, when you can't trust your friend... Maybe he's got a deal with the guy in the middle to subvert your data or he's part of the Chinese network... So whoever you create a secure channel with (via HTTPS, SSH, VPN or whatever) needs to be trust worthy. If you use your trustworthy friend as a gateway to other friends beyond just the three of you, your note will continue to be safe.

Another person mentioned using open dns which i am using so the isp's own proxy doesn't cache my own data right?

Because the data still flows through your ISP unencrypted, this won't be effective. Even DNS queries sent directly to OpenDNS must travel through your ISP at some point. Using OpenDNS presents and additional hurdle for eavesdroppers, but if an ISP is truly interested in your data, it would be very possible to look inside the data you have been sending/receiving from OpenDNS and determine what sites you have been visiting. The rest of the data, such as images and website content, are delivered by your ISP and not OpenDNS. If your ISP wants to record that information, they can do so without any additional effort.

 

[snake24]

HTTPS is a secure stream of data between you and the destination. The ISP cannot see the contents of your data.

Get ready for a bad analogy:

There are three people in a room. The first and last person are friends and understand Chinese and English. The person in the middle (ISP) only understands Chinese.

You want to send a message to the person at the other end, so you hand a note to the person in the middle to pass along. You wrote it in Chinese, so he reads it and understands it, then passes it to the person at the end. This is an example of unencrypted data... Everybody can read it.

An example of HTTPS encryption would be if you wrote the note in English. When you hand the note to the guy in the middle, he can't understand it because he *only* knows Chinese. He passes your note to the guy at the end anyway, who can understand English perfectly... You've both devised a safe way to communicate.

You and your English speaking friend on the other side of the room have created a secure channel, for as long as no one else in the room can speak English. With the case of encryption, no one can understand the protected data except the host and the intended recipient(s)... It's like a foreign language in a sense.

This example falls apart though, when you can't trust your friend... Maybe he's got a deal with the guy in the middle to subvert your data or he's part of the Chinese network... So whoever you create a secure channel with (via HTTPS, SSH, VPN or whatever) needs to be trust worthy. If you use your trustworthy friend as a gateway to other friends beyond just the three of you, your note will continue to be safe.


Because the data still flows through your ISP unencrypted, this won't be effective. Even DNS queries sent directly to OpenDNS must travel through your ISP at some point. Using OpenDNS presents and additional hurdle for eavesdroppers, but if an ISP is truly interested in your data, it would be very possible to look inside the data you have been sending/receiving from OpenDNS and determine what sites you have been visiting. The rest of the data, such as images and website content, are delivered by your ISP and not OpenDNS. If your ISP wants to record that information, they can do so without any additional effort.

Yes i now understand.

The thing is you have to pay for some encrypted connection right?


Cos even if say i manage to encrypt my own info the site at the other end has to understand what i'm writing out doesn't it?

You see i do not feel like paying for any sort of encrypted tunnel service, i'm hoping that it's free.


By the way someone mentioned the usage of "predator" software which could scan my connection to a proxy in an instant. I do not understand what that means.



Currently i am able to chain 2 proxies. A socks proxy and a http proxy. Both are free. I wonder if that's pretty safe.

 

[Rick]

The thing is you have to pay for some encrypted connection right?

Traditionally, I'd say yes. But with P2P solutions like TOR + Vidalia / Privoxy and Piratebay's iPREDATOR, you might be able to do it for free. Given the demise of Piratebay, I doubt the last option will be available. TOR should be a good solution though, although it is often slow.

Cos even if say i manage to encrypt my own info the site at the other end has to understand what i'm writing out doesn't it?

In a sense. Since most websites can't speak to your computer using encryption, that means you'll almost always need a computer that is in the middle -- outside of China -- to decrypt the data that goes out to public Internet and to encrypt the data that is sent back to you.

By the way someone mentioned the usage of "predator" software which could scan my connection to a proxy in an instant. I do not understand what that means.

That would iPREDATOR. It's Piratebay's free, encrypted VPN. It may not be around soon though, since Piratebay is closing up shop.

Currently i am able to chain 2 proxies. A socks proxy and a http proxy. Both are free. I wonder if that's pretty safe.

I'm sure it is better than nothing just purely through partial obscurity, but I wouldn't count on it for sensitive information.

 

[snake24]

Traditionally, I'd say yes. But with P2P solutions like TOR + Vidalia / Privoxy and Piratebay's iPREDATOR, you might be able to do it for free. Given the demise of Piratebay, I doubt the last option will be available. TOR should be a good solution though, although it is often slow.

In a sense. Since most websites can't speak to your computer using encryption, that means you'll almost always need a computer that is in the middle -- outside of China -- to decrypt the data that goes out to public Internet and to encrypt the data that is sent back to you.


That would iPREDATOR. It's Piratebay's free, encrypted VPN. It may not be around soon though, since Piratebay is closing up shop.

I'm sure it is better than nothing just purely through partial obscurity, but I wouldn't count on it for sensitive information.

I tried Tor it is pretty slow sometimes.

SO it's a p2p network encryption thing which means each person on the network helps to increase the bandwidth?

U know i tested it on those ip info websites and even my system's time and OS was changed showing that i came from a different location. I tested it a few times and once it showed up as a russian ip and another time as a swedish one. I wonder if this will make people suspicious.


Since my data is encrypted when i use tor i guess it's pretty good. Yet the inability to have java enabled and the occasional slow speed can be quite annoying sometimes.


It might just be me being paranoid. I'm mostly trying to post on certain forums. The forums use vbulletin format does vbulletin record down the time and date and the OS used or just simply the ip adress of the user?

Oh yes something else i remembered. There are some people who post the ip thing in their sigs and it shows the OS ur using and your browser along with the ip address. That should be the only info that vbulletin records down right?