6

I have an app that uses a SSL connection to interact with the servers placed in Europe/USA. The app uses a custom protocol built on top of TCP/IP. The app uses a self-signed certificates to check the server during the SSL handshake (the client app have the root certificate to the check server, no third-parties are needed to check the certificates).

Does the GFC block such connections or not?

UPD

  • Servers placed in Europe/USA
  • Clients placed in China
  • Custom binary protocol build on top of TCP-IP that encrypted with TLS1.2. Not HTTPS or any other known protocol.
  • Self-signed certificate used to authenticate servers. I.e. clients have root certificate (several KB) that used to check certificate of the server. If check passed - TLS1.2 connection established.
  • used server ports are in the range: 10000-20000. I.e. not well-known ports like 443 etc. (Does the answer change if ports in the range 1-1000 will be used?)
  • I have no target region in China. Generally app should be able to connect to the server from any region of China
Improve this question
6
  • 2
    You may be happy to hear that with a properly implemented TLS 1.2 connection, the Firewall servers will not be able to decrypt the traffic without inserting their own self-signed certificate in the middle. If your client sees the same certificate fingerprint as what was installed on the server, then the Firewall severs will only be able to tell the source/destination port numbers and hostnames/addresses, protocol version; but not any of the data within the properly implemented TLS connection.
    – 700 Software
    Commented Aug 12, 2016 at 12:53
  • 1
    Thanks, those edits really help clarify the question. Hopefully someone here will be able to answer. :-)
    – 700 Software
    Commented Aug 12, 2016 at 12:55
  • @GeorgeBailey Yes, I know that Man-i-the-middle attack is not possible. But I do not know rules of their firewall. Maybe they just block ANY encrypted connection...
    – Victor Mezrin
    Commented Aug 12, 2016 at 12:57
  • 4
    Depending on how long you need to keep the connection open and what you transmit in it. GFW throttles any obfuscated connection (including non-standard protocols) that matches certain traffic pattern, e.g.: blog.zorinaq.com/my-experience-with-the-great-firewall-of-china
    – billc.cn
    Commented Aug 12, 2016 at 13:30
  • @billc.cn Thank you. It's very valuable article for me. Pattern of network activity of my app definitely do not match pattern of VPN, but each connection needs hours to work. I will test it. Maybe you have another articles that reveal the internals of GFC?
    – Victor Mezrin
    Commented Aug 12, 2016 at 20:37

1 Answer 1

Reset to default
3

I'm not sure you can have any real assurances here because the issue isn't just the firewall. The real problem is that your dealing with an environment which is heavily controlled at all layers and the firewall is just one component. It is quite likely the firewall may simply block connections which it cannot inspect or has any concern over, but it is probably even more likely that they could insist clients download and install a government certificate which they could use in a 'Comodo Style' MItM scenario.

My guess would be that it will depend on whether your connections are actually noticed and considered to be of any real concern. When you consider the size of population your dealing with and the amount of data/connections the government would need to monitor, it is likely that unless something brings what you are doing tot he attention of the right people, your scheme would be reasonably secure. However if and when your connections are noticed and there is a desire to look more closely, then all bets are off.

In an environment where one authority has control over all layers of the network and can likely insist on clients installing or performing some action before they are even allowed network access, I think you have little hope of being able to secure the connection. If the government wants to see it, they will be able to find a way.

The real question will be down to what the expected level of interest is. Even the Chinese government has limited resources. At some level a decision has to be made on what will get the most results for the resources they have. If you were talking about some service which was going to be used by a large sector of the population and it was felt that use was going to be detrimental to the ruling power and that power controls all the infrastructure, you can be pretty certain they will find a way to access the data. On the other hand, if this is something only used by a small number of people or if the use is deemed to be of low threat, then it is likely they would do nothing.

It all really comes down to a risk/benefit analysis from both sides. The real problem is that one side controls all the client side infrastructure. if they want in, they will find a way.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .