So lately its all over the news that China and Russia are soon going to be rolling out a concrete policy that effectively bans the use of VPN's, not only for their respective citizens but also for foreigners visiting the countries. The U.K. and Australia are also mulling over similar legislation that seeks to curtail or discourage or inhibit the ubiquitous use of VPN's within their borders. The U.A.E and Saudi Arabia and other countries in the middle east also have declared VPN use as illegal. My question is, does the NSA know something that China and Russia have yet to figure out in terms of some breakthrough in fully uncloaking all VPN users based on traffic analysis or traffic correlation? We have all read the threads which speak about the NSA being able to break "trillions of VPN connections". Source: https://arstechnica.com/information-technology/2015/10/how-the-nsa-can-break-trillions-of-encrypted-web-and-vpn-connections/

So is the traffic analysis and real IP unmasking done by Russia and China ineffective compared to the United States NSA? Or, is the sheer popularity of VPN solutions being adopted by concerned netizens all over the world generating exponentially so much highly encrypted volume of traffic, that the 3-letter agencies in Russia or China are simply unable to keep up with deciphering it all? Which also makes me curious about the NSA just from a technical standpoint. We have come a long way since the Snowden revelations in 2013. A LOT more people are aware of the dangers of using insecure tunneling protocols like PPTP, and more and more VPN desktop clients are pushing the OpenVPN protocols, with users able to choose SHA256 as their payload encryption with RSA 4096bit handshake and also SHA256 authentication (to protect against collision attacks) with the simple click of a button.

Is the NSA STILL able to really break trillions of encrypted connections with the deployment of TLS1.2 everywhere and VPN's all pushing strong AES encrypted OpenVPN connections today as effectively they did in 2013? Or, is the "going dark problem" a real thing?

  • This question seems to lead to a lot of speculation with little to no evidence. – Tom K. Aug 9 '17 at 12:20
  • Hi Tom, a bit or speculation is encouraged in this reply, because truly the NSA is not going to come out and give a press conference detailing all of its exploit capabilities. Security experts like Bruce Schneier whom i have a lot of respect for, acknowledges that and still maintains for example that there is a high probability that AES128 is still relatively secure. Source:schneier.com/blog/archives/2012/03/can_the_nsa_bre.html So all i am asking is, given the vacuum in our understanding, speculation is all we can hope to do, and i am content with that. – Gigiisbae Aug 9 '17 at 12:26
  • 1
    Alternative theory: imposing such restrictions in a putatively "free" society like the US is harder than it is under stricter regimes such as China, Russia, and the UK. The difference may not have to do with wily NSA advantages, but with the difficulty of legislating such restrictions here. – gowenfawr Aug 9 '17 at 12:32
  • @ gowenfawr hmm yes i would think so. History tells me that in the 90's the US govt. tried to restrict the export of strong encryption "because terrorism", but that policy was untenable. Similarly the push in the circles of power for backdoors into encryption was tried in vain, because apple and google and others have fought back with a public stance that such a "golden key" if created will only make the hundreds of millions of users insecure. So its almost certain that if the US govt tries to adopt a policy banning VPN's they will get a similar pushback from corporate america and the people. – Gigiisbae Aug 9 '17 at 13:04
  • 1
    Blocking VPN costs magnitudes of effort less than traffic analysis. – user13695 Aug 9 '17 at 13:15

The aim of these restrictions is probably not traffic analysis but traffic restriction. With a VPN it is impossible to know and to restrict which web sites somebody visits. Without VPN this is possible, even if the transferred content is protected by HTTPS. Also, without VPN it is possible to deny access to specific web sites even if HTTPS is used. With VPN you can only block the full VPN but not parts of the sites visited using the VPN.

China and Russia are both censoring some sites for a variety of reasons. Since VPN work around this censorship it makes sense to forbid the use of a VPN. The USA and most western countries currently don't censor web sites and thus there is no need to restrict usage of VPN currently. But, given the current discussions about the advantages of encryption for privacy and disadvantages when tracking of "bad people" (terrorists, ...) is needed, things might change even in these parts of the world.

| improve this answer | |
  • Ah yes "traffic restriction" probably has a lot to do with it. The latest i read was that Russia is saying its not that we want to ban VPN's completely, its that we want to give a list of banned websites to the VPN providers in our jurisdiction, and they have to comply. Which is interesting, because the VPN has to simply see if the client IP origins from Russia because these restrictions dont apply to others outside the Russian jurisdiction. So, if a Russian customer connects to Sweden first, and then tries to go on a banned site by Russia, the VPN somehow has to manage that. – Gigiisbae Aug 9 '17 at 13:12

Traffic correlation loses precision the more people use a given VPN exit. It might be possible when only very few people use a VPN at the same time, but if everyone and their grandma constantly use these services, it becomes extremely difficult. That's why internet monitoring agencies have an incentive to discourage "civilians" from clogging up these services. When only "people of interest" use these services, it's much easier to find out what each of them is up to.

The cryptography used by VPN services can generally be considered secure enough to not be breakable even with the capabilities of state actors - but only as long as the VPN services themselves are trustworthy. A VPN service in the same country as a state actor can be very easily coerced. A VPN in an allied country might be harder to get leverage on, but it's not impossible either if the agencies in that country are willing to cooperate. Different states have different abilities to obtain that cooperation. Now this is pure speculation, but I would assume that the US-American NSA has quite a lot more international political clout than, say, the Russian FSB, so they might have more countries they can get to cooperate with them.

| improve this answer | |
  • Interesting point about the crypto deployment Philip. With security and paranoia being high up in the minds of new customers wanting to sign up for a VPN service, we see the VPN providers responding to this need by really ramping up the encryption they provide in their desktop applications. Not only that, the VPN providers have detailed tutorials on how to ensure that their DNS doesnt leak, their WEBRTC is plugged, they warn or the dangers of flash and how to disable it, and also suggest various ways to harden your browser whether its firefox or chrome. – Gigiisbae Aug 9 '17 at 12:46
  • Its quite fascinating to see just how companies have responded by swearing to be a no-log service etc etc.Not that i would take them at their word, but its good to know what a lot of the most popular paid VPN service providers have as their public position on peoples ability to surf privately. – Gigiisbae Aug 9 '17 at 12:46

Not the answer you're looking for? Browse other questions tagged or ask your own question.