Posts on Psiphon | Blog

Cybernews Interview, Psiphon: “the world is becoming more and more privacy-conscious”

Tue, 21 Jun 2022 12:05:00 +0000

Most of us are aware of the necessity of having strong VPN protection in place. But what are the inherent issues with standard VPN applications, and how can they be solved?

While choosing the best VPN often comes down to its features, the problem with many of the modern VPN applications concerns easily recognizable traffic in certain Internet environments despite the implemented end-to-end encryption. But what can be done about it?

To discuss this matter, we’ve reached out to Alexis Gantous, a member of the Business Development and Operations team at Psiphon Inc, a company that works on providing uncensored Internet access for Windows and mobile devices.

How did the idea of creating Psiphon originate?

Psiphon was founded out of a research project at the University of Toronto’s Citizen Lab, founder and CEO Michael Hull saw the opportunity to take the original peer-to-peer system and further develop it to fill the needs of millions around the world who face restrictions to their access to information online.

Can you introduce us to your circumvention system?

One of the big issues with standard VPN applications is that the traffic, while it’s encrypted, can be very easily recognizable and disrupted in the Internet environments that perform DPI and aggressive filtering of Internet traffic. Psiphon’s state-of-the-art protocols offer multiple creative pathways to obfuscate and connect our users to the content they are seeking online. This, combined with our diverse network of servers placed in over 20 countries around the world, means Psiphon has a robust circumvention network that can much more reliably stand up to interference, as evidenced by tens of millions of citizens around the world turning to Psiphon when facing severe blocking events.

Tell us more about Psiphon’s vision.

Any potential user should be able to review our code and ensure that we are providing the service that we claim to. At Psiphon, we are committed to ensuring our user’s privacy and security are maintained to the best of our ability. We do not require users to create accounts or submit any personally identifiable information to use our service. All of our code is open source and over the years we have posted several 3rd party audits of our code, including penetration tests on our blog.

Do you think the recent global events altered the way the public perceives cybersecurity?

I do, there is a lot of confusing information out there for people new to the topic of cybersecurity. But with the number of data breaches and hacks that have occurred over the last few years, reports of organized hacking groups on the rise, etc., the public and private sectors are starting to increase the focus on cybersecurity risks and exposure.

What would you consider to be the worst Internet habits detrimental to one’s digital privacy and security?

Password security or lack thereof is number one, important accounts especially with access to personal or banking information should always be protected with strong passwords and multi-factor authentication where possible.

Protecting one’s Internet connection on public wifi connections is always a big topic as well and the use of Psiphon or a VPN that encrypts your connection can be very helpful. Finally, be wary of unfamiliar or unexpected emails/messages that ask you to click a link or enter passwords/information. These types of scams are on the rise and can be less obvious than you might expect.

What best practices or tools should Internet users adopt instead?

Password managers can be a great tool to save you from having to remember many complicated strong passwords, many are free for personal use and ensure that you don’t use the same passwords for everything. Typically they also ensure multi-factor authentication with apps like Authy or Google Authenticator which can be another great step in protecting yourself online.

With remote work becoming the new normal, what security measures should companies invest in to secure their network?

As mentioned already, passwords and MFA are important for personal use but should be even more important for businesses, many phishing scams target employees and payroll staff of small companies.

Make sure that employees have access to a reputable VPN service that publishes and adheres to open source development principles and methods. This will ensure employees have access to important services for work and will help to protect company information and data.

Do you have any predictions for the future of the Internet? What improvements do you hope to see in the next few years?

It seems much of the world is becoming more and more privacy-conscious. I predict that we will see more legislation following the lead of GDPR and European regulations around privacy and consent-oriented handling of user data.

What does the future hold for Psiphon?

At Psiphon, we are continually improving and refining our technology, we have some exciting projects in the work including a newly released service called MalAware which, when connecting to our network through a Psiphon app will automatically monitor for any connections coming from malware/adware on your device and notify you if your device has been compromised.

7ASecurity’s Recent Security Audit of Psiphon’s Code Finds “No Significant Security Flaws”

Tue, 02 Nov 2021 11:30:00 +0000

As part of our ongoing commitment to achieving the highest standards of transparency and security, Psiphon commissioned 7ASecurity to conduct a security review of its code base related to four new Psiphon enhancements. The resulting report is public and can be found at: https://7asecurity.com/reports/pentest-report_psiphon-e.pdf.

Using a “white box” approach, meaning the complete source code was available, the security team set out to determine Psiphon’s adherence to secure coding best practices, and to provide safeguard recommendations, where appropriate, based on their findings. The security team used a variety of tools and methods against all Psiphon source code and third party libraries. Network traffic was also analyzed to identify potential attack vectors, fingerprinting and Psiphon’s behaviour under attack.

The team’s conclusions were that:

“The Psiphon platform was found to be resilient to a broad range of attack vectors and provided an overall solid impression.

This reflects well on the team behind the solution. 7ASecurity detected only 1 security vulnerability of low severity. Hence, no significant security flaws could be identified during this assignment. The remaining 4 findings were classified as miscellaneous weaknesses and thus, not considered as vulnerabilities.”

Psiphon’s code base is open source, and can be accessed on GitHub. Previous security audits of Psiphon’s code can be found via our website and on the Psiphon blog.

We thank the 7ASecurity team’s efforts and are pleased that Psiphon’s software engineers and source code continue to be so well regarded.

Facebook Disappears from the Internet; Globally, People Assume Censorship

Wed, 06 Oct 2021 15:15:00 +0000

Figure 1: People around the world naturally turned to Psiphon in response to the Facebook outage.

Summary:

Psiphon’s global usage surged by 1.75 Million daily unique users during the Facebook outage on October 4th, 2021.
The rise was particularly acute in regions where Facebook platforms - including Instagram, WhatsApp, and Facebook itself - experience regular disruptions due to intermittent, but active censorship.
The regions that saw the most significant increases in usage include several countries where major censorship events have occurred within the past few years: Azerbaijan, Cuba, Ethiopia, Indonesia, Iraq, Libya, Mexico, Sudan, and Syria.
Cuba showed a 4.6x increase from baseline usage, from 70,000 to over 300,000 daily unique users, reinforcing Psiphon’s important role in the region. In July 2021, the Psiphon network supported a surge of 1.4M users from Cuba during targeted blocking of social media and messaging platforms, a still-immanent threat from censors.
This demonstrates that Psiphon is a key and trusted global connectivity solution.

On October 4th, Facebook experienced a significant global outage affecting all of its platforms, including Facebook, Instagram and WhatsApp. The outage, which lasted for at least 6 hours, was widely reported and had a dramatic impact on users of the platform.

In the days that followed, analysis by network monitors like Cloudflare and Kentik revealed how Facebook had, functionally, disappeared from the Internet. But for users, the inaccessibility of Facebook platforms evidently resonated with major censorship events that previously targeted these apps and websites. As before, enabling Psiphon followed as a natural response to the failure to access Facebook and its other products.

Psiphon’s global usage surged by over 1.75 Million users during the day of the outage. The growth was particularly acute in regions such as Cuba that have experienced significant, intermittent censorship events, but even in regions experiencing less direct censorship, such as Indonesia, significant growth was also observed.

The population scale uptake is a clear indication of the trust that Psiphon has accrued through its in supporting user connectivity globally. Since online censorship is likewise often opaque and difficult to attribute, the Facebook outage though of a technical in nature was in many ways not readily distinguishable from a blocking event. Often the last platform standing during censorship events, Psiphon adoption during the outage appears a natural and immediate reaction to presumed filtering.

The visualizations below show the surge in Psiphon daily active users in response to the outage.

Azerbaijan: 35,000 users (8x)
Cuba: 300,000 users (4.6x)
Ethiopia: 45,000 users (1.9x)
Indonesia: 250,000 users (1.9x)
Iraq: 210,000 users (11x)
Libya: 22,000 users (1.8x)
Mexico: 38,000 users (1.5x)
Sudan: 100,000 users (2.4x)
Syria: 225,000 users (1.5x)

Please note that the data shown can be accessed through Psiphon’s public data access portal, https://psix.ca. The Psiphon data portal is part of our full and ongoing commitment to open source software and open data.

Shutdown in Myanmar: A Fresh Story with Old Challenges

Mon, 26 Jul 2021 15:48:00 +0000

Supporting 5 million users in Myanmar is no small feat

When the Internet goes dark, so does communication with the rest of the world. We know that many regimes use Internet censorship as a method to suppress public awareness, civil protest, and mobilization, and a shutdown event is often a signal of bad things to come. This means more bad news is lurking around. When the lights of the routers went off in Myanmar, the whole world changed for millions of Burmese...

Read more about Psiphon in Myanmar

The battle for Myanmar plays out on Twitter, TikTok and Telegram

More Governments Disrupt Internet for Political Control

“Shocked and sheer disbelief” was how a young Burmese described the situation after the coup in February. “I lost my sense of direction,” and also “my job”. He was not the only person who experienced this level of dislocation: close to 2 million Burmese flocked to the Psiphon network in the span of only a few days. The number subsequently increased to 5 million in the next couple of months.

The graph below shows the number of Psiphon users between late January 2021 and late July, 2021. Note the dramatic jumps in user count on Feb 3rd (coinciding with the coup) and on May 2nd, coinciding with the restart of mobile services.

Both Psiphon and Psiphon pro were the top downloaded apps in Myanmar on May 17th, totalling over 1.7 million downloads (SensorTower.com).

The Cost of Restoring access to the International Internet

A network of servers that can absorb such a huge increase in usage needs to have a solid infrastructure and a lot of reserved capacity for when people need access to the international Internet. But, how do these things work when censors block the Internet?

Imagine the Internet as roads, and people surfing on the Internet as driving on these lanes. Some roads are local to a city while others can connect you to other parts of the country. Censorship is similar to disallowing traffic on national or local highways. It can be done in various ways from enforcing slow speeds to removing road signs on how to leave the city.

That is when anti-censorship tools like Psiphon come into play and unblock the roads. Psiphon uses different tactics to connect people to the international Internet.

The Psiphon Network operates nine distinct protocols that connect people and deliver the censored content. These protocols, when run in the Psiphon Network proper, help distribute network load and ease congestion when people access the International Internet, which means a faster connection and a more reliable experience.

The flexibility that these custom Internet Freedom protocols give services like Psiphon, makes answering people’s calls in Myanmar, Belarus or Azerbaijan possible when Internet access is limited, but it comes at a real cost; every byte that traverses the Psiphon Network is crossing a series of commercial networks, and each charge their own price for the servers and network infrastructure.

Balancing need and costs

Making sure the network is ready to support millions of users, whenever it’s needed, remains one of the biggest challenges for the Internet Freedom community in their fight against censorship all over the world.

As would be the case for any other freely accessible service provider, Psiphon cannot sustain the types of population scale surges seen in Myanmar indefinitely, nor support a number of these surges occurring simultaneously. This is truly unfortunate, since it could mean the loss of many people’s last hopes to access the open Internet, just when they need it most.

After all, while Internet freedom is a fundamental human right, it is definitely not free.

Get Involved

Internet freedom is a right for all, but only a few of us have the means to support people in regions practicing censorship to access the open internet. Be one of them.

What can you do? Raise awareness by talking about the internet situation in Myanmar, and invite others to talk about it on social media with your friends and people who care about freedom of information. You can also directly support tools like Psiphon that help people in need. Subscribe to Psiphon if you are not in Myanmar. Showing your support for everyone who has been denied their right to access information on the internet will mean a lot to them, and it means a lot to the people who do their best to bring light into the darkness of censorship.

Amid major network disruptions, 1.76M Psiphon users in Belarus

Thu, 20 Aug 2020 15:00:00 +0000

The Psiphon network supported a peak 1.76 million daily active users during significant network interference that started August 9th, a figure that represents nearly 1 in every 3 internet users.

A large-scale disruption to international internet access was observed in Belarus, beginning during the contested presidential election on August 9th. Widespread filtering was reported across all Belarusian networks, affecting popular messaging apps including Telegram, Viber, and WhatsApp; social media platforms Facebook, Twitter, Instagram, and Youtube; major app markets including Google Play and the App Store; email providers Gmail, Mail.ru, and Yandex; maps, banking, online media, and many other services. Rolling blackouts of the mobile networks also occurred nightly between 6PM and 6AM. The majority of VPNs were reportedly blocked as a result of generalized SSL/TLS filtering. Tor direct connections were disrupted by the increased network change, while Tor bridge users reached a peak 8,000 per day during the shutdown period. Network outages were tracked by RIPE Labs, Oracle Internet Intelligence, IODA, and other network monitors.

Traceroute completions on main mobile operator MTS Belarus (AS25106) showed clear outages through 60280 and 6697 (source: Oracle)

As a backdrop to the network disruptions, Belarus had entered its largest mass demonstrations in history.

Journalists reported difficulty freely accessing and reporting information from the country, and recommended Psiphon. Internet users noted Psiphon was one of the few tools able to bypass . Even with the attempted blocking of the app stores and Psiphon sites, users acquired the software via alternate distribution channels, such as email responder and proxy. Additionally, Belarusian users distributed Psiphon binaries via Telegram channels, hosted URLs, and even on USB. Use of the Psiphon network surged to a peak 1.76 million daily active users; given a population of 9.5 million and internet penetration rate of 60%, a figure that represents 30% of internet users in Belarus. Total bandwidth transferred from Belarus via Psiphon between Aug 9-17 exceeded 2 Petabytes. Circumvention tools proved a vital infrastructure to freely access information, as well as basic communications and services.

Internet users, researchers, and international observers were able to utilize the Psiphon Data Engine metrics portal (available at psix.ca) to monitor blocking, network performance, and corresponding circumvention usage. Some sources noted during the shutdown period, the volume of Psiphon use in Belarus had surpassed even that of Iran.

From the Psiphon Data Engine (PDE) public dashboard (https://psix.ca/)

Network observers such as the Internet Protection Society and others detected that deep packet inspection (DPI) technology was being used to block SSL causing significant traffic issues. NetBlocks also noted keyword filtering appeared to target at least 10,000 URLs. Prague-based Qrator Labs saw the concurrent outage of 80% of IPv6 prefixes within Belarus, and inferred that filtering of downstream autonomous systems (AS) was taking place at the level of two upstream ASes that dominate international transit, AS6697 and AS60280. Official releases by the National Center for Response to Computer Incidents, the National Traffic Exchange Center, and Beltelecom all stated the disruptions were the result of external cyberattacks and equipment failures.

Psiphon network performance and session quality remained at or above the regional average over the days of the shutdown. While the generalized disruption of SSL at the transport layer disrupted the core functionality of many VPNs, the traffic obfuscation and multiprotocol structure used by Psiphon provides greater resilience to protocol-based blocking, with network traffic able to adapt dynamically to the very restrictive new filtering scheme.

Bytes per hour, Belarus. A peak 55 Terabytes / h were transferred via the Psiphon network.

A key observation by Qrator Labs is the high level of centralization of control over Belarusian networks. DPI equipment installed at the point of international gateways allows the upstream operators to disconnect or pass filtering rules to downstream ISPs. Researchers documented a similar network topology in Iranian ASes last year. In November 2019, Iran executed an extensive disconnection of international internet connectivity that lasted for 10 days.

Indeed, the current generation of DPI filtering technologies can be leveraged at various forms of encrypted internet traffic, increasingly deployed at national scale and at capacities approaching 1TBit/s. In these circumstances access to resilient circumvention infrastructures such as Psiphon remains crucial to the free exchange of information.

بلاگ فارسی

Thu, 13 Dec 2018 17:15:00 +0000

شبکه‌های اجتماعی سایفون به زبان فارسی هم راه‌اندازی می‌شود. ما به تلاش برای فراهم کردن ارتباط مطمئن و موثر در ایران افتخار می‌کنیم و به دنبال بهبود ظرفیت کمک و بهتر‌کردن تجربه‌ کاربران در ایران هستیم. شبکه‌های اجتماعی فارسی زبان سایفون مسیر‌های ارتباطی جدیدی را برای دریافت نظرات کاربران ایرانی باز می‌کند.

برای ارتباط با ما حساب فارسی سایفون در توییتر، صفحه فیس‌بوک و اینستاگرام سایفون را دنبال کنید.

Join us in Persian

Thu, 13 Dec 2018 17:03:00 +0000

Psiphon is pleased to announce the launch of its Persian language social media! We are proud to provide reliable and efficient connectivity in Iran, and have expanded our capacity to help improve user experience. These channels will open new avenues of communication and streamline the feedback process for Persian users around the world.

We invite you to connect with us to receive updates about Psiphon, or to get in touch with our Persian language team! Find us on Twitter, Facebook and Instagram.

شبکه‌های اجتماعی سایفون به زبان فارسی هم راه‌اندازی می‌شود. ما به تلاش برای فراهم کردن ارتباط مطمئن و موثر در ایران افتخار می‌کنیم و به دنبال بهبود ظرفیت کمک و بهتر‌کردن تجربه‌ کاربران در ایران هستیم. شبکه‌های اجتماعی

.فارسی زبان سایفون مسیر‌های ارتباطی جدیدی را برای دریافت نظرات کاربران ایرانی باز می‌کند

.برای ارتباط با ما حساب فارسی سایفون در توییتر، صفحه فیس‌بوک و اینستاگرام سایفون را دنبال کنید

Wickr Secure Open Access

Fri, 07 Sep 2018 14:51:00 +0000

Psiphon is proud to announce an exciting new partnership. Over the last few months we have been working with Wickr to create a new feature for their secure messaging platforms:

Wickr: Secure Open Access.

With this feature Wickr and Psiphon have made it possible for teams and enterprises in any part of the world — US, Europe, Asia or Latin America — to have reliable end-to-end encrypted messaging, calling, file and screen sharing with no interruptions in service. No other secure communications platform enables unfettered connection anywhere in the world this way.

Wickr, already well established in the secure messaging environment with their versatile platform, recognized that as organizations are increasingly global, there can be both security as well as accessibility concerns when trying to ensure secure communication for people all around the globe.

Wickr believes their end users shouldn’t have to worry about being able to connect to their colleagues, friend or family - no matter where they are, and Psiphon agrees.

By integrating Psiphon's sophisticated network protocols into their new feature, Wickr will allow their end users to seamlessly protect their traffic and send it over the Psiphon network, ensuring they always stay connected no matter where they are.

You can read more about our new partnership here.

The New Normal for the Iranian People: Population-scale Response to State-Level Communication Disruption

Tue, 15 May 2018 17:22:00 +0000

In December 2017-January 2018, protests erupted throughout Iran, calling for change in the country. Unlike the protests of 2009, known as the Green Revolution, this civil unrest involved many Iranians that previously were unaffiliated with any political opposition movement. In response, the Iranian government enacted blocks on Telegram and Instagram in the country. To gain access to these applications and circumvent censorship, Iranian users flooded to tools like Psiphon. In order to shed light on these protests and the resulting surge in users, Psiphon has collected and analyzed network data from before, during and after the protests. This data has been combined with an understanding of the political, social and economic situation in Iran for a deeper look at how Internet connectivity and freedom impacts Iranian society as a whole. Ultimately, this blocking event has proven the importance of the Internet and access in Iran and highlighted the growing technical abilities and scope of the Iranian censorship regime.

Key Observations

On December 28, 2017, protests broke out in the northeastern city of Mashhad; smaller protests also occured in the nearby cities of Neyshabour and Kashmar. Initially calling for solutions to economic grievances, protests eventually covered social issues such as corruption, the presidency of Hassan Rouhani and Iran’s involvement in foreign conflicts. Some protestors even directly criticized Supreme Leader Ali Khamenei. Over the following days, the movement spread across Iran, with protests in nearly every single province. Protests occurred in many smaller cities and included many Iranians not officially or previously affiliated with any organized opposition group. Additionally, protests occurred daily in the capital of Tehran until January 9, 2018.

In response to the nationwide demonstrations, the Iranian government and the Islamic Revolutionary Guard Corps (IRGC) responded with force, both physically and virtually. However, due to the fact that this was a largely rural movement, it is possible that IRGC forces found it harder to physically limit the protests and the Iranian government turned to Internet and application blockages to quell the movement. Still, a number of protesters were arrested and, in some cities, tear gas, water cannons and other tactics were used to break up demonstrations.¹² Three days into the protests, on December 31, the Iranian government blocked access to both Telegram and Instagram, the country’s most popular messaging and social media platforms, respectively. Thanks to Psiphon and other censorship circumvention technologies, Iranians were able to connect and maintain information sharing across these sites.

Reasons behind the protests

Despite some of the optimism stemming from easing of economic sanctions, Iranians were overburdened by economic hardship in 2017. Though Iran’s oil and gas industry has grown considerably in the last year, with production rising 62%, economic relief has not as quickly expanded to other sectors of the economy, which has only seen a growth of about 3.3%.³ Unemployment rose from 12.4% to 12.6% from January to July 2017 and continues to hover around 12%.⁴

In a survey of Iranian activists conducted by the link-sharing platform Balatarin, individuals indicated that economic issues and corruption were the leading causes behind the protests. In addition, rising inflation and the cost of living proved to be the most significant priority for Iranian families, followed by citizens’ rights. These concerns were reflected in the calls of protesters: "If embezzlement decreases, then our problems will be solved!”, "Come out fellow countrymen, scream and shout for your rights!", and “The youth are unemployed [while] the mullahs sit behind a desk!”^5.

In early December, President Rouhani released his version of the budget, promising alleviation of economic pressures, including rising employment and inflation. This relatively conservative budget went to the Majlis for approval on December 14. During the month of December, a substantial increase in social media usage by Iranians was seen on the Psiphon network leading up to the protests. On December 19, usage tripled, from an average of 2 terabytes (TB) to 6TB. On December 30, usage tripled again, hitting 18TB. It is possible that this build up was indicative of the unrest to come, as more Iranians moved to social media to express their grievances, before ultimately taking to the streets.

The censorship regime in Iran

Censorship of online content inside Iran is institutionalized at the highest levels of government. In March 2012, Iran’s Supreme Leader, Ayatollah Ali Khamenei, authorized the creation of the Supreme Council of Cyberspace (SCC), which is comprised of 17 members from various government institutions plus an additional 10 members appointed by Khamenei himself. It has become the central agency for implementing and upholding policies pertaining to the censorship of online content inside Iran.⁷ At its inception, Khamenei asked then-President Ahmadinejad to chair the Council⁸, though 2015 reforms resulted in the transfer of authority to the Supreme Leader⁹ and the consolidation of decision-making authorities of the pre-existing High Council of Informatics, Supreme Council of Information, and Supreme National Security Council of Information Exchange (AFTA) under the sole jurisdiction of the SCC.¹⁰

All Iranian internet service providers (ISPs) function under the jurisdiction of the Communication Regulatory Authority of Iran (CRA), which is responsible for telecommunications licensing and enforces censorship policies outlined by the the Committee for Determining Offensive Contents under the powers of the executive. It oversees the implementation the technical censorship policies that support the initiatives of the SCC. Such actions include:

The limitation of private home user bandwidth to 128 kilobytes per second (kb/s).

The redirection of Domain Name Service (DNS) queries, causing certain DNS requests to respond with fake local IP addresses that act as black holes to drop traffic intended for blocked domains.

The inspection of internet packet headers and URLs for keywords that may lead to sites with content that may feasibly be deemed immoral or could cause political or economic turmoil, and the manipulation of such traffic.

Especially during periods of political and economic unrest, ISPs will limit speed (aka throttle), either to specific sites or internet communication protocols, or all traffic.¹¹

The government counterfeiting of web certificates to popular sites in order to conduct man-in-the-middle attacks.¹²

Traditional censorship practices have already been installed throughout the Iranian network. Website owners are required to register with the Ministry of Culture and Islamic Guidance or risk being blocked. Website owners and private citizens that post potentially inflammatory content receive official removal requests. The Iranian Revolutionary Guard Corps routinely arrests Telegram channel administrators to coerce them into removing content or delete channels entirely. News sites are sent warnings about how they should report on controversial topics, such as the Nuclear Deal. All of these practices lead to significant self-censorship in order to avoid arrest.¹³ And censorship capabilities have become more pervasive in recent year, as the CRA has implemented policies to diversify and expand telecommunications networks throughout Iran.

Censors’ response to the protests

On December 30, Iran’s Minister of Information and Communications Technology Mohammad-Javad Azari Jahromi tweeted a request for the removal of @amadnews, a Telegram channel, to Telegram founder Pavel Durov. Telegram complied, removing the channel for its use of violent language. It is important to note that Twitter is a blocked platform in Iran, though Jahromi has requested that Twitter be made available to all Iranians. It is not uncommon for Iranian officials to use this banned social media platform, however it is particularly interesting that, in this case, it was used to publicly communicate removal requests for content on a popular application that has been heavily monitored, though still permitted, by the government. Telegram refused to comply with further content removal requests, explaining that the channels were, in fact, merely using the platform for peaceful protest. Because of this, the Iranian government directed Iranian ISPs to block traffic to the Telegram app and web interface on December 31.¹⁴ On the same day, Instagram, a popular picture and video sharing application, was also blocked. The block on Instagram lasted until January 6, while the Telegram block lasted until January 13.

During this time, Iranians continued to protests and access these platforms and others through circumvention software. This is evidenced by both continued, and even increased, engagement on both platforms. Though a brief drop in usage occurred initially, data shows that the number of posts and views on Telegram in Iran quickly returned to the about the same levels as before the blocking event. On Instagram, users flocked to Persian language news and media accounts. BBC Persian continued to call for videos and photos of the protests through its Instagram account and Telegram channel, despite both platforms being blocked by the government. In fact, BBC Persian’s Instagram following grew by about 200,000 in less than two weeks; one week of which Instagram was blocked in Iran. It had previously taken the account about nine months to gain that same amount of followers. A similar phenomenon occurred on the Instagram accounts of Radio Farda and Voice of America-Persian News Network (VOA-PNN).

Iranian user behavior and analytics

Psiphon has worked to offer users multiple ways of using our software, whether for mobile or desktop use. There are three major platforms through which one can download Psiphon: Google Play store, the Apple App Store, and through email auto-responders. On January 1, downloads peaked with:

766,235 via Google Play
458,768 via the App Store
82,280 via auto-responders

Psiphon has dedicated email auto-responders for specific clients. On December 31, BBC Persian took to Instagram and posted a warning to all Persian speaking followers, instructing them on how to download Psiphon via their email auto-responder. On that day, BBC Persian, normally responsible for about 60 Psiphon downloads per day, was responsible for 60,695 Psiphon downloads. This is just one example of the many important relationships that are required to ensure internet access to people all over the world.

Google Play showed Psiphon as the most downloaded app in Iran during the protest, with competing tools rising and falling in the rankings as they proved ineffective for users. Applications for other circumvention tools, like VPNs and Lantern, a peer-to-peer software used for censorship bypass, rose and fell on the charts as users found that connections made through these apps were unreliable or slow, as expressed on Twitter. Psiphon remained the number one app in Iran on Google Play for over two weeks. Not only did Psiphon see a consistent increase in users, but this increase was at a much larger scale than other tools. Tor analytics showed a similar trend of increased use, with a spike during the protests. However, this increase peaked at just under 12,500 daily connections, while Psiphon’s network supported 287,925,106 connections on January 2 alone.¹⁵

Not only were new users downloading the app, but network analytics show that they were actively using it. Over the course of the protests, Psiphon added 22.2 million new users to the network. Data transfer during the protest period hit 61 megabytes (MB) per user per day at its lowest point. Emergency network scaling allowed for the Psiphon network to transfer and average of 124MB per user per day. As a point of reference, if an American paying $35 per month for a 2 gigabyte (GB) monthly plan through Verizon were to spread their data usage out equally throughout the month, they would be able to use a maximum of 66MB per day. Additionally, the global average mobile data plan is 4GB monthly, translating to 133 MB per day. During the entire protest period, our network transferred 19.54 petabytes (PB), equivalent to the amount of data processed by Google all over the world each day. Psiphon saw a peak data transfer on January 9 of of 1.445PB, which is equal to the same data as all of the 10 billion photos on Facebook.

All in all, a massive amount of data was transferred over the Psiphon network in response to the protests and blocking. The success and scalability of the Psiphon network during peak blocking periods can be credited to its heterogeneous infrastructure, varied partnerships, and significant focus on innovative research and development. By incorporating circumvention protocols such as Refraction Networking and MEEK, Psiphon’s network had become more redundant, resilient, and has increased its surge capacity.

Psiphon’s “new normal” in Iran

Psiphon has now adapted to a “new normal” in Iran. Part of this new normal is the significant increase in the amount of data being transferred over Psiphon’s network to social media platforms alone. This can be seen in the graph on the left, which shows that, on average, over 16TB of social media traffic is being transferred over the Psiphon network. This includes major platforms such as Facebook, Twitter, and Instagram.

The prevalence of the Iranian video sharing service Aparat on this graph, especially over Youtube, may be indicative of future threats to internet freedom in Iran. In order to post on Aparat, users need to connect their real identities with a registered account. This is part of the Iranian government’s larger initiative to produce a “halal net,” formally called the National Information Network (NIN).

This new normal also includes potential disruptions, both technical and political, that Iranian users face. In the first few days of February, Iranians took to the streets again in a number of strikes and protests against months of unpaid wages by their employers. These strikes spanned various industries, including bus drivers and railway workers. This activity was reflected on Psiphon’s network with a surge of users on February 5, from 3 million average daily unique users to 4 million. In times of political unrest, Psiphon has become the go-to censorship evasion tool for many Iranians.

This is also true for disruptions of a technical nature. On February 20, users in the Middle East and Europe became unable to access Telegram. On that day, the Psiphon network saw a significant surge in traffic from Iran, with over 3 million connections made. Suspecting a censorship event, Iranians users flooded to Psiphon to test the connection to Telegram. Through Psiphon, they were able to determine that there was a technical error in Telegram’s service, rather than a blocking event by the Iranian government. These incidents show that Psiphon is a trusted tool when internet accessibility is not guaranteed.

The continued Telegram battle

Telegram has continued to be a target for the Iranian regime and the government has moved to permanently block Telegram. On April 30, after the app’s use by government officials was prohibited, the Iranian judiciary issued a court order for all Iranian ISPs to begin blocking Telegram, effective immediately.¹⁶ Iranians have been encouraged to use domestic communication applications, which are generally avoided as they are widely-known to be subject to tight government control and surveillance. On May 7, six lawyers filed a petition to the Court for Government Employees in Iran to end the ban on Telegram in an unprecedented use of legal action against the Iranian government.

On April 26, Psiphon was contacted by the developers of TelegramDR with a request for assistance integrating and supplying network traffic for the Telegram Digital Resistance app. In anticipation of the long-threatened blocking of Telegram, Psiphon developers and outreach team members worked to successfully meet the April 30 deadline and offer Iranian citizens an effective tool for secure communication. On May 1, in direct response to the blocking event, TelegramDR was released on Google Play. Since the release, over 700,000 Iranians depend on TelegramDR, pushing over 5TB of traffic per day, indicating that the intensification of internet service blocking will surely be met with innovative circumvention techniques.

Conclusion

Since the Green Revolution of 2009, web and mobile online penetration of Iranian citizens has climbed dramatically. In fact, it has more than doubled. As of 2016, internet users make up over half of the Iranian population; in 2009, this was just under 14%.¹⁷ Access to the internet has become more widespread and quality has greatly improved. With this comes a greater reliance on internet-based platforms by Iranians, for everything from financial services to business operations. In addition, the influence of social media in the country has rapidly grown. Many businesses and news organizations rely on social media to connect with their customers. In addition, social media is slowly becoming the preferred method of communication among Iranians. This has been seen on the Psiphon network with more bytes transferred to social media sites than ever before. As stated previously, from the period before the protests and the blocking event to the end of the protests, Psiphon gained 22.2 million new users. This has led to an increase of one million average daily users; prior to the blocking Psiphon on average supported two million users per day in Iran and now supports about three million users per day.

Psiphon continues to operate at this new normal and must be prepared to increase capacity further in the event of another blocking event. However, there are considerable operating costs associated for any circumvention tool. In order to provide reliable connections to users in Iran, circumvention tools, like Psiphon, need consistent support. In addition, without access to these tools, Iranians may be compelled to migrate to government-supported and controlled domestic social media platforms. In order to maintain support for internet freedom, existing program models and support may require re-engineering. This would ideally include broader support from major social media platforms as their content is being delivered by much smaller, less funded organizations. In addition, more investments in technologies that can deliver content, expand the range of services, provide augmented capacity and adaptation will be necessary. As the Iranian government devotes resources to the development of its NIN, the internet freedom community will need to continually improve and build its capabilities.
--
By: Ariel Leuthard and Jacob Klein

1 “More Students Arrested in Iran as Protests Continue,” Radio Farda, January 2, 2018.

2 Associated Press, “At least 9 killed in Iran overnight as protesters, security forces clash,” retrieved from Politico, January 2, 2018.

3 “Iran’s Economic Outlook,” The World Bank, October 11, 2017.

4 “Iran’s Economic Outlook,” The World Bank, October 11, 2017.

5 Saidi, Mike, “Iranian Anti-Regime Protests and Security Flaws: A Dataset,” Critical Threats Project, American Enterprise Institute, January 12, 2018.

6 “Iran’s Rouhani submits conservative 2018 budget as US tensions overshadow economy,” Reuters, December 10, 2017.

7 “Country Profile: Iran,” Freedom on the Net 2017, Freedom House, 2017.

8 “Iran’s supreme leader calls for new internet oversight committee,” Los Angeles Times, March 7, 2012.

9 “Khamenei consolidates power over Internet policy in hardline council he controls,” Center for Human Rights in Iran, September 14, 2015.

https://www.iranhumanrights.org/2015/09/khamenei-internet-policy-iran/

10 “Country Profile: Iran,” Freedom on the Net 2017, Freedom House, 2017.

11 This has been reported for connections to Google services such as Gmail as well as traffic via specific protocols including HTTPS, SSH and VPN tunnels.

12 Simurgh Aryan, Homa Aryan, and J. Alex Halderman, “Internet Censorship in Iran: A First Look,”, Presented as part of the 3rd USENIX Workshop on Free and Open Communications on the Internet,” 2013.

13 “Country Profile: Iran,” Freedom on the Net 2017, Freedom House, 2017.

14 Durov, Pavel, Telegram post, December 31, 2017.

15 “Directly connecting users from Iran,” Tor Project, accessed February 2018.

16 Parisa Hafezi, “Iran’s judiciary bans use of Telegram messaging app: state TV,” Reuters, April 30, 2018.

17 World Bank, “World Development Indicators Dataset: Iran,” retrieved March 2018.

The State of Data Logging: An Evaluation of Threat Levels and Security Practices

Tue, 15 May 2018 13:12:00 +0000

Psiphon Inc. has for years been leading the charge to open the internet to those living under censoring regimes. Despite facing no content restrictions online, users from Western countries are turning to VPNs such as Psiphon, to protect their personal privacy online. Yet in March 2017, the Pew Research Center released a startling statistic that some 70% of American internet users are not sure what purpose a VPN serves.¹

If the ever-increasing number of Psiphon accounts is any indication of the growing number of VPN users worldwide, a substantial influx of independent users are entering a market in which they have no metric for critically evaluating the products. This group now bears the burden of understanding risks in the unfamiliar domain of cybersecurity. As such, they are therefore highly susceptible to misinformation. One such term that puts users on high alert is the pervasiveness of the term data logging throughout VPN websites and forums, and a misrepresentation of individual risks and methods to efficiently protect oneself.

According to Techopedia, “data logging is the process of collecting and storing data over a period of time in order to analyze specific trends or record the data-based events/actions of a system, network or IT environment. It enables the tracking of all interactions through which data, files or applications are stored, accessed or modified on a storage device or application.”² Many VPNs market a zero-logging policy as a seemingly unique product feature, thus insinuating that the internet traffic of average citizens is otherwise at constant risk of being logged and possibly exploited for commercial and legal purposes.

This has become a hot button issue following the April 2017 repeal of certain FCC protections that would have required American Internet Services Providers (ISPs) to obtain permission before sharing user data (had it ever taken effect as intended in December 2017). The thought of their government advocating for ISPs to make logs of our personal internet histories and then selling or disclosing them without consent is alarming to most internet users.

As a strong proponent of internet freedom, Psiphon strives daily to ensure that our users receive fair and open access to an uncensored internet without repercussions. The expanding legality of the unauthorized use of user data and browsing history creates a troubling narrative that demonstrates that profits often outweigh ethics. But Psiphon took a deeper dive into understanding the landscape of traffic and data logging practices.

A Brief Comparative Analysis of Data Logging Policies in the US, the EU, and Canada

In general, Western nations have defined protections and regulations through the scope of stored data security. These laws set provisions pertaining to the standards of security to which firms are held while collecting and storing user data. They also outline the issues of legality pertaining to information disclosure. However, all the laws referenced in this paper leave the decisions regarding the type of data and the situations in which it is collected, was well as the duration such data is retained, in the discretion of the collecting organization. While in many cases these organizations must justify the logic behind their policies to a central governing body, such legislation creates a double-edged sword, as it tacitly supports data retention in many cases.

For example, there are no over-arching regulations in the US pertaining to data logging at present. ISPs are free to collect and store user data, provided that the user is made aware that they are subject to such practices in the terms of service or user licensing agreement. However, companies are governed by the Stored Communications Act, which interdicts the disclosure of user data, including electronic communications, “to any person other than the addressee or intended recipient.”³ While the American government burdens all firms with protection of user data, they do not expressly limit logging practices or reasonable duration of data storage.

The bigger question of ISP logging is not a new one, and it also is not a stand-alone issue. In fact, the question of data logging is rooted in the same legal questions recently resurged net neutrality debate in the US.

The European Union passed a piece of bloc-wide legislation titled the General Data Protection Regulation (GDPR) in April 2016 that builds upon the original Data Protection Directive of 2012 and outlines data security guidelines, user rights, and legal classifications of subjects. However, individual member states are obliged to determine the appropriate duration of data retention and are not subjected to a bloc-wide mandated timeframe.

Data retention regulations in the EU are designed to ensure the security of user data and its availability to law enforcement agencies, and much of the language used in the original Data Protection Directive suggests that data retention is necessary for the ease and timeliness of legal investigations. It goes as far as to codify Article 6, which allows for specific legal classifications such as suspected criminals, convicted criminals, and victims to be legally distinguished from other persons during logging and data retention processes.

Independent firms are responsible for determining the appropriate duration of retention for data collected, while additional periods of retention may be set for “archiving in the public interest scientific, statistical or historical use.”⁴ However, under the provisions of the GDPR, a private citizen has the “right to be forgotten” and may request that their personal data be removed from a server.

Finally, Canada’s federalist structure has created a multi-tiered jurisdictional organization regarding its data logging regulations. It has enacted the Personal Information Protection and Electronic Documents Act (PIPEDA), which outlines nationwide directives and regulations regarding the collection of information for commercial activity, and setting a national standard definition for personally identifiable information, which includes:

• age, name, ID numbers, income, ethnic origin, and blood type;

• opinions, evaluations, comments, social status, or disciplinary actions, etc.

• employee files, credit records, loan records, medical records, existence of a dispute between a consumer and a merchant, intentions (for example, to acquire goods or services, or change jobs).⁵

Similar to the EU Directive, provisions are included to allow for the disclosure of information to the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) pertaining to individuals who are suspected of criminal acts such as financing terrorism. However, PIPEDA does not explicitly outline processes for securing information and limiting the legal duration of storage of information. While paragraph 4.5.3 states that “information that is no longer required to fulfill the identified purposes should be destroyed,” individual firms are at liberty to implement their own procedures.

Further down the chain, provinces that are capable of creating their own laws to ensure data protection may supersede the PIPEDA provisions.

So, are the alarmist VPNs right?

VPNs successfully alarm prospective customers for three fundamental flaws in current logging regimes:

1. Your personally identifiable data may not be adequately secure

2. ISPs and online companies may use your personal data for commercial gain

3. Databases of personal information being held by ISPs and online companies are at the disposal of law enforcement and government agencies

All three evaluated states have allowed for the legal collection and retention of personally identifiable user data. While ISPs and online companies are legally obliged to secure such information, at its core, this has created a weak trust-based system that lacks clear oversight in virtually every jurisdiction. It is easy to say that those who are not using the internet for compromising or illegal activities need not worry, but at Psiphon we believe that all internet users have a reasonable expectation of privacy, regardless of online behaviors.

As such, it can be assumed that ISPs have the right to log user data. This may be troubling to individual internet users who fear the unauthorized use of private information such as medical records or banking information, or the malicious intrusion into such databases. Additionally, if an ISP received a National Security Letter or warrant requesting user records, they would be bound by law to provide such information to law enforcement.

With the current laws in place, online companies are not at liberty to sell personally identifiable data for commercial purposes or to disclose such information. However, they are well within their rights to retain and use this data for a variety of internal processes such as customer statistics. With the potentially imminent erosion of net neutrality in the United States, stores of personally identifiable data may be exploited or released without consent. Yet, a leading cause for concern among VPN users is the risk of such data being maliciously exfiltrated, despite the best intentions of the service provider.

Internet users will always bear the burden of educating themselves on the practices of the companies with whom they engage. A primary concern is that some end users may be unable to understand the meaning or consequences of terms of use and may base their usage on vague and often misleading social and technical standards of whether the VPN is trustworthy and reliable. Not to mention the market research that must be done to ensure that VPNs are truly abiding by the privacy policies they put forth to potential users, especially if the VPN service requires the creation of user accounts that are built around personally identifiable information.

What’s more, once an educated decision is reached, users in specific geographic locations and on specific sites may find that they feel comfortable using an unencrypted or standard https connection. But where there is still confusion or concern, a no-log VPN such as Psiphon may be used to protect personally identifiable data from being collected online.

Can a VPN protect me from data logging?

Many internet users turn to VPNs to anonymize themselves online and avoid data logging practices of commercial services online. However, it must be stated that no VPN can offer complete anonymity online. But those that are committed to a freely accessible internet, such as Psiphon, incorporate strong security measures into their services that protect the privacy of their users. By using a VPN proxy, internet traffic cannot be attributed to specific users, but users are still connected to and participating in the use of internet services.

In an effort to gain user trust and increase individual privacy, commercially available VPNs often highlight no-logging policies. They claim to discard all records of use, thus making it impossible. However, many VPN service agreements do not provide detailed explanations of such policies. In order to create an account or open an encrypted session, a VPN might require some detailed user information. Once again, the burden falls on the individual user to carefully read through the terms of service and make a determination whether to trust the VPN.

The structure of the internet requires that certain information must be exchanged in order for online communication to occur. No data can be sent or received without a functioning IP address, which includes the legitimate IP address of the VPN user. However, because none of the legislation assessed in this paper mandates that VPNs store user data for a specified amount of time, the core values of Psiphon and other VPN services might cause them to erase such information from their networks upon termination of an encrypted session.

What makes Psiphon different from traditional VPN services? Quite simply, we are borne from and exist predominantly for internet freedom. By design, the Psiphon platform does not store any personally identifiable information regarding end users’ browsing session. Because using Psiphon does not require an account, the software is virtually incapable of creating or storing information pertaining to any individual user. There is therefore no record of use, reassuring those who evade surveillance or fear the disclosure of personally identifiable information to unauthorized parties that using the Psiphon network cannot be attributed to a unique user or geolocation.

To ensure that our network remains efficient and scales with changing level of demand, we engage in internal data assessment, which includes traffic volume and user location information aggregated at the country level.⁶ This is the most detailed information retained by the service. But if, for example, a nefarious outside actor was to breach this statistical information, no personally identifiable information would be at risk.

--
By: Jacob Klein

1 http://www.pewinternet.org/2017/03/22/what-the-public-knows-about-cybersecurity/
2 https://www.techopedia.com/definition/596/data-logging

3 S.Rep. No. 99-541, 97th Cong. 2nd Sess. 37, reprinted in 1986 U.S.C.C.A.N. 3555, 3591.

4 Ibid. Paragraph 26.

5 http://laws-lois.justice.gc.ca/eng/acts/P-8.6/FullText.html
6 However, city-level data will be automatically aggregate only after the usage within a country surpasses a threshold at which it would be statistically impossible for individual users to be identified via an evaluation of the number of active connections within the city.

Why You Don't Need Google's Domain Fronting

Tue, 24 Apr 2018 13:22:00 +0000

Google’s removal of domain fronting emphasizes the need for solutions like Psiphon.

Google has confirmed that they will block domain fronting across Google domains and App Engine. For many apps and publishers, this represents a step backwards in the fight for internet freedom. While Psiphon has never relied on this Google service, many app developers continued to depend on the practice as a convenient and straightforward means of circumventing state-level censorship, despite the long-running speculation that Google would close this loophole (eg. Will Scott’s blog post in 2017).

While the announcement has been met with criticism from internet activists and service providers alike, Google has defended their decision, saying “domain fronting has never been a supported feature”.

Domain fronting has been a popular means of censorship circumvention for several years, being embraced by popular apps like Signal, who publicly adopted the practice in 2016. While using Google domains to front traffic does not require advanced technical knowledge, it is a half measure that relies on Google, without consultation, to provide infrastructure for something it was not designed to do. In short, using the Google App Engine for domain fronting meant taking advantage of an unsupported loophole. For this reason, the practice would inevitably face restrictions as it gained popularity.

"Now that Google is disabling domain fronting it's a good time for tools to start thinking about new infrastructures for circumvention. Recent Telegram efforts in Russia proved how dangerous Google/Amazon reliance was for access to the entire Internet."
https://t.co/0ZblXVE8ED
— mahsa alimardani 🌒 (@maasalan) April 19, 2018

In 2015, Cloudflare also ended domain fronting across its domains when it began matching the SNI and host header of web traffic, after its infrastructure was implicated in censorship circumvention.

Most recently, in a frenzied attempt to block Telegram, which has made use of this loophole, Russian censorship authority Roskomnadzor blocked an estimated 17 million IP addresses. The interference disrupted access to Gmail, Google search, Google Play, YouTube, and other Google services.

Domain fronting is hardly the preeminent censorship circumvention solution. In cases where Google itself is blocked, as it is in Iran, any site or application that used Google for domain fronting would be unavailable as well. Psiphon’s network relies on a wide variety of protocols and obfuscation techniques to deliver Internet freedom. The complex and ever-changing nature of our network protects against over-reliance on one technology or approach.

The importance of a diversified circumvention toolbox cannot be overstated - for apps like Signal, reliance on Google domain fronting resulted in the need for an immediate and complete shift to another CDN. Tools like Psiphon seek to mitigate this risk by implementing numerous protocols, thereby eliminating reliance on any one method. Both Telegram and Tor’s use of multiple domain fronts minimized the disturbance caused to their services.

Psiphon Completes Another Third Party Security Review

Fri, 16 Feb 2018 15:37:00 +0000

In late June 2017, Psiphon continued to prove its commitment to open source development (you can access our code repository here), by commissioning Cure53 to perform a security audit of our services. The security review took 22 days and a total of 9 testers to complete what was described as a review with a “vast scope” and the Cure53 testers were very thorough. This is our 2nd security audit of this kind in 3 years (you can see the results of the 1st one, performed by iSec here).

The report’s description of what was included in the scope reads:

“In scope were multiple components of the Psiphon software compound, including the tunnel-core client and server, the library glue, the Psiphon iOS app and, last but not least, the Psiphon iOS browser. This very broad premise and scope explain the necessity for involving a rather large number of testers with properly matched expertise in different arenas. In sum, the tests included code audits, actual penetration tests, protocol and configuration reviews, and a cryptographic audit."

We are very happy with the results of the security audit and proud to relay that “no noteworthy security risks could be unveiled” (pg.19). In the spirit of transparency you can read the full detailed report in pdf form here. Of the two vulnerabilities found, one has already been fixed (and confirmed by Cure53) and steps have been taken to address the other in upcoming releases.

The testers also noted 7 other miscellaneous issues that you can find listed in the report, four of these have also already been addressed.

“The testers shared a conviction that the software compound greatly benefitted from a number of software security audits in the past. Needless to say, this is reflected in findings. Among the total nine issues discovered, only two were marked as security vulnerabilities and were further ascribed with the lowest “Informational” severity ranking.”

The Cure53 testers noted several times throughout the report how clean and quality driven the code is and came to the following conclusion:

“Despite investing considerable time and personnel resources into attempting a compromise, the Psiphon components in scope held up to scrutiny and presented themselves strong and robust in face of adversarial efforts. The bottom line is that no noteworthy security risks could be unveiled.”

We hope that you will find this report interesting, and that it will assure you of our commitment to providing first-class software that will always be open source and secure.

Internet Freedom Festival 2017

Mon, 20 Mar 2017 14:09:00 +0000

Another successful Internet Freedom Festival (IFF) was held 6-10 March, 2017. The week-long "global unconference" festival takes place every year in Valencia, Spain. It is a great opportunity for those in the Internet Freedom community to meet up, share experiences, learn from one another, and discuss issues affecting the Internet today. Once again, Psiphon team members were in attendance at this year's IFF.

This year’s sessions focused on eight different themes: Community; Training & Best Practices; Internet Freedom: Present and Future; Tools & Technology; Policy & Advocacy; Regions & Groups; Communications & Design; and Journalism & Media. The IFF encourages collaboration, diversity, and inclusivity. The days were filled with engaging sessions, each of which presented an opportunity to meet colleagues from around the world and undertake the shared common goal of Internet Freedom.

Learn more about what participants have to say about the IFF through the Twitter hashtag #InternetIFF.

1st Vietnam Cyber Dialogue

A day before IFF kicked off, the first ever Vietnam Cyber Dialogue (VCD) took place. Inspired by ASL 19’s Iran Cyber Dialogue, the event was a lively gathering of community leaders, activists, policy makers, and technologists working towards improving access to information and greater freedom of expression in Vietnam. The event was organized by Article 19, Việt Tân, Aspiration, and Reporters Without Borders.

Ahead of the event, Việt Tân shared “10 Things to know about Vietnam and the internet,” with attendees. Vietnam has the largest number of internet users in Southeast Asia and a vibrant cyber community. There is certainly lots to discuss when it comes to Vietnam’s media landscape and online environment. The VCD provided safe space for collaboration and dialogue between the Vietnamese community, its diaspora, and technologist allies.
Hear what Việt Tân’s Loa and The 88 Project had to say about the Vietnam Cyber Dialogue in this YouTube video.

Upcoming events

If you’re interested in Internet Freedom check out these upcoming events:

Iran Cyber Dialogue 27-28 March, 2017

RightsCon Brussels 2017 29 – 31 March, 2017

Want to collaborate with Psiphon in 2017?

Contact us at info@psiphon.ca

Follow our Twitter and Facebook for more updates!

Happy 2017 to Psiphon Users!

Mon, 02 Jan 2017 12:48:00 +0000

2016 was an eventful year, with plenty of world events to be informed about. While access to the Internet and thus information around the world grew, censorship of all kinds including the blocking of websites also rose.

Here at Psiphon we have also seen more users of our software than ever before, and while this comes hand in hand with increasing information controls on the internet, we are happy to be able to help people get round them.

Freedom House’s annual report on Internet Freedom noted a decline in said freedom for the sixth year running, and found that two-thirds of Internet users around the world live in countries where criticizing the government, military or monarchy results in censorship. Their other major observation was that governments are increasingly targeting messaging apps.

This chimes with some of the things we’ve seen on our network this year. For example in January VoIP services were blocked in Morocco, upsetting users of popular free calling services like Viber, Whatsapp, Skype and Facetime. For the month long duration of the ban, we saw our Moroccan traffic triple in the first week and then double each week after that. Then in May a Brazilian judge ordered the blocking of Whatsapp, not for the first time. Again we saw traffic from the country triple, this time in 24 hours.

National elections are another flashpoint for censorship, and we’ve seen people turn to Psiphon as their governments block social media or oppositions websites, for example in August in Gabon. Another trend we’ve seen this year is the shutting down altogether of the internet in some countries during turbulent events - something that even Psiphon can’t do anything about.

Our hope is that in 2017 we can help people around the world to communicate and stay informed without restrictions. Happy New Year to all our friends and we wish you a safe, happy and free 2017!

Psiphon Is 10 Years Old!

Tue, 13 Dec 2016 14:37:00 +0000

This month Psiphon turns 10 years old! We would like to thank you for your support, as we look forward keeping the Internet open for many more years!

Psiphon began at the University of Toronto’s Citizen Lab as a ‘network of trust’ amongst people who knew each other. The first version of the software allowed a person’s computer in a non-censored country to act as a server for a friend in a censored region, and helped to prove that there was a real need for the open Internet.

Psiphon 2 was developed soon after, no longer requiring people in censored regions to know people in an uncensored country. Psiphon runs servers, known as Psiphon nodes, which act as proxies for users in censored regions, and can be accessed via a simple URL.

In 2008, Psiphon won the Netxplorateur Grand Prix 2008. The panelists called Psiphon “the world’s most original, significant and exemplary Net and Digital Initiative.” The following year, Psiphon was recognized with The Economist Best New Media Award by Index on Censorship.

In 2011 a downloadable Psiphon app – known as Psiphon 3 – was launched for Windows, allowing any application that recognized system proxies to access the network through a Psiphon tunnel. At the end of 2012, Psiphon 3 became available for mobile devices. Psiphon 3 is dynamic and resilient. Our specialist team of top developers continuously work to improve the software and fight the ever more advanced censorship techniques faced on the internet. This means Psiphon often works when other simple VPNs do not. All of Psiphon’s software is open source, and has been independently security audited.

Psiphon popularity is due in a large part to promotion through our media sponsors and partners. We work closely with Toronto-based NGO ASL19, who help Internet users in the Middle East and North Africa region assert their digital rights online and access information. We also work with major broadcasters, including Deutsche Welle, BBC, and Voice of America, to help them reach their audiences, and to provide Psiphon users with access to news and to an open Internet.

We have also been able to work with many organizations to help bring awareness to their various projects through our content distribution network. Last year we promoted the BFI Flare Film Festival, which helped raise awareness of LGBT issues. We also promoted Action Against Hunger after the earthquake in Nepal to bring awareness and donations to the disaster-stricken region. This year, we have also worked with Google’s Jigsaw and VICE News to promote a series of documentaries about freedom of expression, as well as partnering with Global Citizen to encourage US voters to take part in this year’s Presidential election.

Aside from our diverse partnership opportunities, our team actively engages in local events and international conferences to gain understanding and share ideas about pressing issues that are affecting Internet freedom. Last week, we hosted a session at the Internet Governance Forum on the implications of VoIP crackdown on government, telecom, and civil society. We also recently attended the first Asia Pacific School of Internet Governance in Thailand to learn about the rising problems to Internet Governance in Asia Pacific. We have participated numerous times at the Internet Freedom Festival where we learn about censorship trends and connect with the wider Internet freedom community, and contributed to a PETS paper for the wider technical community.

It has been an eventful, innovative, and exciting ten years for Psiphon! We look forward to what the future brings. Look out for more innovations and product releases in 2017!

Visit psiphon.ca to see our 10-year anniversary web site, and be one of the first to play our game!

Want to collaborate with Psiphon in 2017? Contact us at info@psiphon.ca

Follow our Twitter and Facebook for more updates!

Gambia's Election Shutdown

Wed, 07 Dec 2016 17:06:00 +0000

Access Now recently reported that there have been over 50 Internet shutdowns around the world in 2016, compared to 15 known shutdowns the previous year. Many of these shutdowns have taken place in Africa - as seen in a recent Psiphon blog piece documenting a shutdown and social media blocking event in Gabon.

Last week, another shutdown happened in Gambia. Just after 9pm local time on November 30th 2016, we received a message from our friend Moses Karanja, a researcher at the research fellow at the Centre for Intellectual Property and Information Technology Law (CIPIT) in Kenya. Moses asked if we were able to verify reports he had seen on social media, saying that the Internet was unavailable in Gambia.

From our network monitoring, we could see that there had been a total drop-off in Psiphon traffic at just after 8pm local time. To verify this, we contacted Akamai’s State of the Internet team, to see if they had also seen a drop in traffic. Within a few minutes, they confirmed it for us, and tweeted to let the world know.

#Internet disruption in #Gambia has dropped @akamai traffic to the country to zero over the last hour. (h/t @PsiphonInc) pic.twitter.com/MUe4NWvFss
— StateOfTheInternet (@akamai_soti) November 30, 2016

We followed this up with our own tweet, showing a similar effect on our network.

Ongoing Internet outage identified in #Gambia. No network traffic from Gambia since 2010 GMT. pic.twitter.com/SiNFKO6rvU
— Psiphon Inc. (@PsiphonInc) November 30, 2016

This outage occurred on the eve of the country’s presidential election on December 1st. The incumbent, Yahya Jammeh, had warned against people taking part in any protests that would follow an election he expected to win.

Following Jammeh's defeat in the election to Adama Barrow, the candidate chosen to represent seven opposition parties, Internet and telecommunication services began to be restored. The outage was expected to last into Saturday December 3rd, but instead was reversed by 11.30 on Friday December 2nd.

The reporting of the shutdown and confirmation at the network level came about due to close collaboration between the research community and the private sector, and helped to highlight the growing number of Internet shutdowns that are occurring across the world. For more information, read this piece from Moses Karanja, as he continues to track and document Internet shutdowns in Africa.

Global Citizen ShowupVote and the United States Election

Thu, 01 Dec 2016 11:15:00 +0000

Ahead of the 2016 United States elections, Global Citizen launched its “Show Up and Vote” campaign to encourage young Americans to vote. In addition to an online campaign, represented by the hashtag #ShowupVote, Global Citizen hosted a series of events and concerts with high-profile artists.

Psiphon #ShowupVote Promotion During Elections

In the week ahead of the election, Psiphon promoted the #ShowupVote campaign to our US audience,
showing a selection of images and a brief paragraph explaining the importance of the project.

In the final two days ahead of the election, the promotion was changed to ensure maximum visibility of the #ShowupVote content.

As election day ended, Psiphon followed this up by taking users to Global Citizen’s live coverage, giving them a chance to follow the results as they came in.

Overall, Global Citizen’s content was seen 1.5 million times in the US.

Worldwide Interest in U.S. Elections

In highly censored regions, during national and international news events, it is common for the use of circumvention tools to increase as people attempt to acquire news from a variety of sources. The U.S. election was no exception.

There was an increase in use of Psiphon in many countries, including from Vietnam, Russia, Iran, Kazakhstan, Saudi Arabia, and the United Arab Emirates, during the lead-up to and on the day of the election. The increase was most notable from China, where live-streaming coverage of the U.S. election was banned and TV networks were told to avoid “excessive” coverage of the event.

Psiphon's First Time Supporting Toronto Reel Asian Film Festival

Mon, 28 Nov 2016 12:36:00 +0000

The 2016 Toronto Reel Asian International Film Festival has come to a close after a successful run from 8th to 19th November, 2016. As the largest Asian film festival in Canada, Reel Asian has been bridging the Pan-Asian contemporary cinema and Canadian community through creating a platform for emerging and award-winning directors, actors and the local community to share their work and opinions on films. This year, over half of the film titles were directed by North American filmmakers.

This year marked the 20th anniversary, and for the first time new elements were introduced for the film festival– including Reel Asian’s inaugural WEE ASIAN Kids Programme for parents and children, free entries to 10 films for senior and student audience, as well as a new 20/20 Interview Series. 20 candidates who either have worked or attended the film festival in the past 20 years were invited to talk about their memorable stories with Reel Asian, as well as the impact of the film festival on their lives.

Psiphon is very excited to collaborate with Reel Asian for the first time in celebration of their 20th anniversary. As much as the festival is a huge success itself with higher than before ticket sales, we helped expand their online exposure to our users in Canada and China, which received over 2.3 million views over the course of the festival. Through Psiphon’s content delivery, our users from China learned about media arts that were screening overseas. Psiphon users in Canada and China were also able to watch trailers of selected films on Psiphon Today.

Since our previous partnership with BFI Film Flare Film Festival, Psiphon continues to pursue opportunities to support art and cinematic initiatives. We are more than happy to connect our users to media arts that are relevant to them and provide an open platform for them to engage with the events.
Toronto Reel Asian International Film Festival will happen again in November 2017 with great films!

Check out this year’s Reel Asian Award winners and more festival highlights at www. reelasian.com

Want to collaborate with Psiphon Inc. for your next event? Email us at info@psiphon.ca

Social Media and Internet Ban in Turkey

Mon, 21 Nov 2016 20:05:00 +0000

Following the detainment of 12 pro-Kurdish lawmakers from the Peoples’ Democratic Party (HDP) in the early hours of November 4^th, Facebook, Twitter, Instagram, YouTube, WhatsApp and Skype were blocked in Turkey. There were reports that Turk Telekom internet provider completely disabled access to the internet or throttled the connection to the point that it was impossible to connect.

Despite lack of official decision about the restrictions, and BTK’s explanation that there was a technical problem throughout Turkey, Prime Minister Binali Yildirim made a statement later in the day and said “For security reasons, these kinds of measures can be taken time to time. These are temporary measures. Everything goes back to normal after the danger is eliminated.”

Social media and internet bans ended the following evening in most of the country, but there were still some short-term connection problems during the weekend in some regions, and it was reported that some Turk Telekom users did not have internet for longer periods.

On the same day, multiple local outlets reported that Turkey’s Information and Communication Technologies Authority (BTK) ordered internet providers in the country to block censorship circumvention tools, including Psiphon. Despite the rumor, Psiphon saw no indication that its services were affected negatively.

The BTK denied that circumvention tools were ordered blocked; however Ahment Arslan, the Minister of Transport, Maritime and Communication, said “We only restrict the use of VPNs because of terrorism reasons. Surely nobody would have an objection about this.”

Psiphon Attending the First APSIG

Mon, 24 Oct 2016 12:17:00 +0000

On September 11th to 15th 2016, Psiphon attended the first Asia Pacific School of Internet Governance (APSIG) hosted in Bangkok, Thailand.

The weeklong regional school took place at the Asian Institute of Technology (AIT), where more than 30 participants from various countries in Asia Pacific came together to share their experience and knowledge on the Regional Internet Governance issues. Organized by the Internet Education and Research Laboratory (inTERLab), the five-day workshop featured keynote speakers from various backgrounds such as international organizations, academic institutes, civil society, government and business sectors. These organizations include: Internet Corporation for Assigned Names and Numbers (ICANN), Electronic Frontier Foundation (EFF), Asia-Pacific Network Information Centre (APNIC), Korea Advanced Institute of Science and Technology (KAIST), OpenNet Korea and Com First India.

As a software company that develops a trusted tool that enables unrestricted Internet content access, Psiphon was very excited to share its feedback on Internet Governance issues, including the improvement of public awareness on Internet content freedom in the Asia Pacific Region. We were extremely happy to connect with established users, within the school, to collect and understand feedback provided in regards to our software. Furthermore, Psiphon built relationships with new users from South and Southeast Asian countries, such as Thailand, Pakistan and Philippines. During the role-play workshops, Psiphon contributed to the final report on the facilitation of new Internet users in the next decade. This report is now available on the APSIG official website at apsig.asia.

APSIG is a pilot program envisioned by Dr. Kilnam Chon and the next APSIG will also be hosted in Bangkok, Thailand.
Want to invite Psiphon Inc. to your next event? Email us at info@psiphon.ca

Psiphon’s First Time Sponsoring the Toronto Chinatown Festival

Wed, 28 Sep 2016 13:50:00 +0000

On August 20th and 21st, Psiphon joined the 16th annual Toronto Chinatown Festival for the first time as one of the event sponsors.

In this 2 day event, Psiphon raised public awareness on Internet content access by reaching out to over 200,000 participants and educating more than 200 visitors on Psiphon’s software. Psiphon has also given out 10 visitors a free month of Psiphon Pro and custom made festival giveaways to booth visitors during the event.

As an important neighborhood in the downtown core, Chinatown BIA hosts the Toronto Chinatown Festival every year aiming to bring upon pan-Asian community in the city to celebrate its rich cultural heritage.

Want to invite Psiphon to your next event? Email us at info@psiphon.ca

¡Hola Cuba!

Wed, 28 Sep 2016 13:03:00 +0000

Did you know that Cuba is one of the countries with the most restricted internet access in the world? Home internet access is forbidden, and even though the government is introducing more and more public WiFi spots, they cost 2$ an hour, which in Cuba is one tenth of the monthly wage. Even then users cannot surf the web freely - they are subject to government surveillance and anti-government websites are blocked. Internet speeds are extremely slow.

Psiphon was in Miami this month at the Cuba Internet Freedom Forum , a conference to discuss and exchange ideas, look at the current state of the internet in Cuba and look for ways to support its growth.

Tell all your Cuban friends that Psiphon will help them access the open free internet!

Amid Second Ban, Psiphon Keeps WhatsApp On in Brazil

Sun, 08 May 2016 13:39:00 +0000

In December, Psiphon blogged about a previous blocking event in Brazil, available here.

Psiphon use surged again in Brazil in response to another nationwide suspension of WhatsApp messaging service. On May 2nd, Brazilian state judge Marcel Maia Montalvão issued an order to block WhatsApp for 72 hours. The judge is seeking user data from WhatsApp as part of a criminal investigation. The five main mobile operators were ordered to block the messaging service, beginning at Monday at 2 p.m. local time.

In response to the recent suspension of WhatsApp services, company CEO Jan Koum posted a message to Facebook stating, “Yet again millions of innocent Brazilians are being punished because a court wants WhatsApp to turn over information we repeatedly said we don’t have. Not only do we encrypt messages end-to-end on WhatsApp to keep people’s information safe and secure, we also don’t keep your chat history on our servers. When you send an end-to-end encrypted message, no one else can read it – not even us.”

The suspension was overturned by another judge on Tuesday following an appeal from WhatsApp’s lawyers, allowing WhatsApp to resume services in Brazil.

In March, Judge Montalvão ordered the arrest of Facebook executive Diego Dzodan on charges of obstructing justice after WhatsApp failed to deliver messages subpoenaed in the criminal investigation. A day later, an appeals judge overturned that order and Dzodan was released. Although WhatsApp is owned by Facebook Inc, the two companies operate separately.

During a press conference that followed, Dzodan stated that WhatsApp is unable to turn over the data because it doesn’t store users’ messages after they’ve been delivered. In addition, the messaging service uses end-to-end encryption and messages cannot be intercepted.

Using Psiphon, Brazil’s WhatsApp users were able to retain or restore access to the application. The Psiphon user base in Brazil tripled within the first 24h of the ban. Brazil’s Globo news network recommended Psiphon to circumvent the blocking.

Psiphon in Brazil: bytes per hour, 29 April – 4 May 2016:

This case demonstrates that in response to censorship, blocking, and other restrictions, internet users will turn to known tools that connect them to content and to each other.

Psiphon Usage Surges as Brazil Blocks WhatsApp

Thu, 17 Dec 2015 13:15:00 +0000

At 9PM ET on December 16th WhatsApp was blocked in Brazil. The ban came after a judge ordered that the messenger app be blocked for 48 hours when the company refused to hand over private user information related to a criminal case. For months, Brazilian telecommunications companies have been attempting to shut down WhatsApp because it provides free messaging and voice services. WhatsApp is the most popular messenger service in Brazil and telecoms blame it for luring millions away from paid cell phone use.

Internet users in Brazil reacted strongly to the ban, criticizing the decision to block WhatsApp widely on social media. Millions turned to alternate messenger services and shared circumvention techniques over social media. Psiphon was praised by people in Brazil for being free, open source, and able to keep them connected throughout the blocking event. Psiphon’s surge capacity was able to cope with the increased demand, with peak data use of more than 8x that of a normal day. Psiphon’s unique users in Brazil went from 54,000 on December 16 to 946,000 on December 17.

Less than a day after the block was put in place, a second judge overturned the lower court’s decision and WhatsApp was unblocked. He stated that “it does not seem reasonable that millions of users be affected” because WhatsApp refused to disclose user information. While the surge use of Psiphon settled quickly, more than twice the expected amount of data was being served hours after the block was lifted.

Update: In May 2016 Brazil blocked WhatsApp again, and again users turned to Psiphon.

Android Browser Same Origin Policy Bypass Security Vulnerability (CVE-2014-6041)

Thu, 17 Sep 2015 22:33:00 +0000

A severe security vulnerability in the Android AOSP browser has been disclosed: http://www.rafayhackingarticles.net/2014/08/android-browser-same-origin-policy.html

The Psiphon team has determined that the built-in browser ("browser-only mode") in our Psiphon app is affected, on Android versions 3.0 to 4.3, through its use of Android AOSP browser via the WebView component. There is no known mitigation for this security vulnerability other than to disable JavaScript in our built-in browser WebView components.

We are releasing Psiphon for Android version 62 which will disable JavaScript in the built-in browser on these versions of Android. We plan to leave this restriction in place until a less disruptive, effective mitigation becomes available; or the Android AOSP browser becomes widely patched.

Psiphon Gives Global Boost to BFI Flare Film Festival 2015

Sun, 26 Apr 2015 00:18:00 +0000

From March 25 - 31, Psiphon partnered with British Council to deploy the BFI Flare #FiveFilms4Freedom campaign, a global digital human rights initiative and history’s first global, digital LGBT cinematic event. A leader in contemporary LGBT cinema for 29 years, BFI Flare 2015 sought to encourage the world to watch a film together, and show that love is a basic human right.

Psiphon helped maximize the global impact of the campaign, connecting the festival’s LGBT filmmakers and their stories to audiences in 135 countries around the world, in some of the most heavily censored societies — places where freedom of expression is not a given, in particular for members of the LGBT community. According to #FiveFilms4Freedom Director Alan Gemmell, the initiative “was a truly ground-breaking way to support freedom and equality all over the world and showcase some of our finest short filmmakers… we’re incredibly proud that our campaign reached tens of millions of people and that we were able to show solidarity with people around the world who risk their lives everyday just to live and love.”

Through the Psiphon platform, more than 5 million viewers were made aware of the festival, and viewed the landing page 13 million times.

The partnership was a litmus test of Psiphon’s capabilities as a publishing platform, and demonstrated its power to connect diverse international audiences to culturally-relevant content, to each other, and to a global conversation on a massive scale.

Psiphon CEO Karl Kathuria was pleased with the outcome. “We are really excited to have helped raise awareness of this film festival,” he said. “Many people using our software are in countries where it can be difficult to access LGBT content, so this is a unique opportunity to connect them with #FiveFilms4Freedom and help them to join in with the conversation over social media.”

Kathuria confirmed that Psiphon will continue to pursue future initiatives in art, cinema, and other cultural activities. “As a content delivery tool, our technology holds substantial and untapped potential to engage a global audience, regardless of information controls that might be imposed on them. Psiphon will be pursuing several more opportunities to promote and distribute content for cinematic events over the remainder of 2015.”

#FiveFilms4Freedom will return in 2016 with an expanded international programme. Psiphon’s free and open source software continues to be available for Windows desktops and Android mobile devices, helping people all over the world connect with each other over the open internet.

To learn more about the #FiveFilms4Freedom project, visit: http://film.britishcouncil.org/our-projects/2015/fivefilms4freedom

To learn more about BFI Flare, visit: http://www.bfi.org.uk/flare

To learn more about the British Council, visit: http://www.britishcouncil.org/

You can also stay in touch with Psiphon via Twitter and Facebook.

A Technical Description of Psiphon

Wed, 03 Dec 2014 11:10:00 +0000

Here's an update to address two recent questions: in simple terms, what is Psiphon and how does it differ from a VPN service; and, what has changed since the technical design document was last updated.

Psiphon 3 is a centrally managed, geographically diverse network of 1000s of proxy servers. Most of our infrastructure is hosted with cloud providers. Psiphon 3 is a "one hop" architecture with secure link encryption between clients and servers. We offer clients for the most popular platforms: Windows, Android, and iOS (in alpha).

Psiphon is open source. Our service offers a strong privacy policy; there are no user accounts and user network addresses are not logged.

Psiphon differs from standard VPN services in a couple of key ways:

We deploy strategies to distribute subsets of servers to users aiming to provide each user with a handful of servers they can reach while not revealing the entire network to one user. To achieve this goal, the size of our network -- and in particular the diversity of our network addresses -- isn't simply a function of our traffic load.
We use protocol obfuscation to bypass DPI blocking.

Psiphon's technical design document is out-of-date and what follows is a very brief summary of major technical changes we've implemented since the project launched in 2011.

We added the obfuscated SSH protocol to mitigate DPI fingerprinting. This fully random-looking protocol is deployed with a unique obfuscation key per Psiphon server.
We added an optional HTTP prefix to our protocol to mitigate DPI-based whitelisting of HTTP traffic. This simple prefix is sufficient for regex-based DPI (nDPI and l7-filter) to classify Psiphon traffic as HTTP; and was sufficient to defeat an actual adversary at the time we deployed it.
We added remote server lists to augment the embedded and discovery servers concepts. While discovery happens only when connected to an existing server, remote server lists can be downloaded even when all servers are blocked. Remote server lists are distributed on S3 and accessed via https://s3.amazonaws.com without a distinguishing bucket name in the URL. In this way, it is difficult for an adversary to block our remote server lists without blocking all of S3 or implementing HTTPS traffic analysis.
Email is now a major client propagation mechanism. We have an auto-responder that returns links and attachments to custom sponsor/channel Psiphon clients depending on the email address users send to.
We released an Android client in 2012. The first version included an embedded browser based on Android's WebView. In 2012/2013 we added support for whole device tunneling, which tunnels all Android apps through Psiphon. We have an iptables whole device mode (for rooted Android 2.2+ devices); and a whole device mode that uses Android's VpnService with tun2socks (for any Android 4+ device). Additional features added include egress region selection and proxy chaining.
We have an iOS client now in alpha testing. This app has an embedded browser.
Our in-app feedback mechanism sends us messages and optional diagnostics from users. This system has helped us debug many platform issues and blocking issues.
Changes to discovery algorithms: our discovery algorithms evolve as part of an ongoing process of optimizing our network. Major changes include sharing discovery servers across propagation channels; and adding time-of-day as a dimension.
Optimizations to connection algorithms: our clients now launch connections to many servers at once when connecting, and keep the "best" connection. This assists in load balancing as well as reducing user wait time as individual blocked servers do not stall the connection sequence.
Client auto-upgrade was enhanced to use incremental download and to use out-of-band download sites (authenticated with digital signatures). These changes made it more likely that a new client can be distributed at a time of blocking.

Independent Security Assessment of Psiphon 3

Tue, 14 Oct 2014 22:45:00 +0000

At Psiphon, we’re committed to open source development. We talked about this in a previous blog post, and you can access our source code here.

We were recently offered the chance to take this openness a step further with a formal security audit of our Windows and Android products, to be carried out by iSEC Partners. As part of our effort to be transparent in the way we operate, we are pleased to publish this report in full, which you can access here.

Overall, we are very happy with the results of the security audit, and for it to be recognized that we are “actively invested in ensuring the security of [our] users”. We have already addressed the one High Severity item uncovered by iSEC Partners, and will continue to address the other recommendations over time.

The main findings of the report are:

Psiphon follows most industry best-practices and takes measures to mitigate against attacks where it cannot.
Most findings were suggestions to further improve the system, particularly in relation to the growth in the number of people using the software.
No inherent architecture flaws were discovered.
One High Severity issue was found, related to automated server patching. We have now deployed automated server patching using Ansible.
Longer-term recommendations are being considered, and where appropriate built in to our development plans.

One particular finding of interest is the recognition by iSEC Partners that there is a potential for security issues related to the browser that we use for browser-only mode. We wrote about that recently when a new security flaw in the browser was discovered, and have already taken steps to mitigate against it.

We were very pleased to be given the opportunity to engage with this security review. We hope that you will find this report interesting, and that it will reassure you of our commitment to providing first-class software that will always be open source and secure.

Heartbleed and Psiphon

Sat, 04 Oct 2014 12:51:00 +0000

Summary of Heartbleed impact on Psiphon:

Some Psiphon servers were using affected versions of OpenSSL, leaving the Python web server vulnerable to the Heartbleed attack. Data at risk, within the web server component process, included Psiphon network topology information and network usage statistics in addition to web server key material.
The SSH/SSH+ Psiphon tunnels were not at risk. User traffic flowing through the Psiphon servers was not at risk. VPN Psiphon tunnels were potentially at risk for man-in-the-middle attacks as the per-session authentication secret is in Python web server memory.
On April 8, 2014, OpenSSL patches were applied to all affected Psiphon servers. In addition, all affected servers had their non-SSH/SSH+ capabilities revoked (out-of-band updates to all clients), ensuring clients will not attempt to use potentially compromised web server key material outside of the secure tunnel.
The Windows client does not use OpenSSL and is not affected by the Heartbleed attack.
The Android client does not use OpenSSL for its tunnel, but does use Android Java SSL for its web requests to Psiphon web servers and Amazon S3. As Android version 4.1.1 is affected by Heartbleed, our app on this particular version of Android remains vulnerable to Amazon, Psiphon servers, or a man-in-the-middle peeking at app memory.
The email auto-responder server had the affected version of OpenSSL. The attack against it would be to get it to make a SSL connection to a remote mail server (by sending an email request from an address that uses that server), which could then peek into the memory of the mail server. This could potentially expose email content, including addresses. The OpenSSL patches were applied April 8, 2014.
The feedback processing server had the affected version of OpenSSL. It may have used that library (via Python + Boto to make SSL connections to Amazon AWS services and Google Gmail server. This means that Amazon or Google could have accessed user feedback data. However, it should be noted that this data is already hosted in Amazon EC2 and a subset of this data is emailed to us via Gmail. The OpenSSL patches were applied April 8, 2014.
Psiphon was not using an affected version of OpenSSL.

Psiphon and the 2013 Iranian Election

Sun, 27 Oct 2013 10:58:00 +0000

Psiphon has over a million active users every week. People use our software to get news, information and social media content that they would otherwise not be able to see. We offer apps for Windows and Android devices, mostly distributed through partnerships with news broadcasters and human rights organisations.

This year, we’ve made a particularly big impact in Iran, coinciding with their Presidential election. Iran has always been a big challenge for us, and it’s also where we see the most people using our software. In a normal week, we see as many as 1.5 million unique users connect to our network from inside Iran. There are somewhere around 45 million people connected to the network in Iran, which accounts for 60% of the population.

We knew that the election period was going to cause some problems, but had no idea exactly what we would face. First, as early as March there were reports that VPN software was being blocked inside the country, as reported on Wired magazine’s site. Psiphon stayed available throughout this period, and in fact the user base doubled in just four weeks. We brought many more servers online to cope with the additional load on our network.

Then, at the beginning of May, the disruption to the Internet in Iran was brought to a whole new level. We saw a sudden spike in connections, suggesting that the software was rapidly disconnecting and reconnecting. With help from Collin Anderson and ASL19, we learned that SSL connections were being cut after 60 seconds, and all connections to sites outside of Iran were being severely throttled.

People using Psiphon were still able to connect and see some content, but had a heavily degraded experience. Psiphon’s built-in feedback mechanism allowed people to provide diagnostic information that helped us further -- we were receiving feedback at the rate of thousands of messages per day, all containing vital clues that could help us get back to normal.

Our development team rapidly released an update to Psiphon that provided the first workaround. Six further releases followed in the weeks leading up to the election. Psiphon’s software automatically updates, and these releases were pushed directly to the end users. At least half of our user base had the upgrade within a day of it being released, and by the time of the election, 90% of Psiphon users were connecting with known working versions.

Psiphon’s goal for the period of the election was to try and keep our network alive, so that anyone with an Internet connection was still able to get to the content they wanted to see. As many as 500 active servers were used to achieve this, on diverse networks, with close monitoring by the technical teams to ensure the system was available throughout that time.

Reports from Iran suggest that the throttling of SSL, and blocking of all non-HTTP traffic, was increased for the election period, and most specifically on June 14, the day of the election itself. Psiphon’s software remained available throughout this period. Although there was a reduction in traffic caused by the extreme throttling, there were still over 400,000 connections made by 125,000 unique users.

Psiphon also distributed content for projects set up to support Iranians specifically over the election period. These include The Global Dialogue and We Choose, projects offering a platform through which the Iranian Internet audience could discuss matters related to the election, and vote on candidates in a secure, open and fair process.

You can read a lot more technical detail about the election period in a report from our colleagues at ASL19.

What of the future in Iran? We’ve seen some encouraging signs from Hassan Rouhani, such as his openness to social media, but our user base is still growing, and so are the reports we’re getting of sites being blocked. Last week, Deutsche Welle’s new Director General, Peter Limbourg, called on Rouhani to stop blocking his organization’s Persian site. He also praised the work that we are doing at Psiphon to distribute DW content into Iran.

This month, we’re also starting two new partnerships with Manoto 1 and Radio Zamaneh. Both of these broadcasters have a large audience of Farsi speakers, and are trying to get their content seen and heard in Iran. We’re very pleased to be working with these broadcasters, and know that this will help to bring news, information and social media content to even more Iranians.