Massbrowser: Unblocking the Web for the Masses, by the Masses
Total Page:16
File Type:pdf, Size:1020Kb
MassBrowser: Unblocking the Web for the Masses, By the Masses Milad Nasr∗, Anonymous,∗ and Amir Houmansadr University of Massachusetts Amherst fmilad,[email protected] Project Website: https://massbrowser.cs.umass.edu/ Abstract 1 Introduction The Internet plays a crucial role in today's social Existing censorship circumvention systems fail to of- and political movements by facilitating the free cir- fer reliable circumvention without sacrificing their culation of speech, information, and ideas; democ- users' QoS, or undertaking high costs of opera- racy and human rights throughout the world crit- tion. We design a new circumvention system, called ically depend on preserving and bolstering the In- MassBrowser, with the objective of addressing such ternet's openness. Consequently, repressive regimes, practical weaknesses of existing designs. Our sys- totalitarian governments, and corrupt corporations tem is based on a new design principle, called \the regulate, monitor, and restrict the access to the In- separation of properties," that states that circum- ternet, which is broadly known as Internet censor- vention systems should be tailored for circumven- ship. The techniques commonly used to enforce cen- tion as opposed to offering additional properties like sorship include IP address blocking, DNS hijacking, anonymity. We combine various state-of-the-art cir- and TCP content filtering [14, 35, 37, 56] to block cumvention techniques to make MassBrowser signif- access to certain destinations or to prevent certain icantly resistant to blocking, while keeping its cost forms of content from being transmitted. To en- of operation small ($0.001 per censored client per sure compliance and to detect undercover politi- month). cal/social activists, repressive regimes additionally We have built and deployed MassBrowser as a fully utilize advanced networking tools, including deep operational system with end-user software for regu- packet inspection (DPI), to prevent the use of the lar Internet users. A key part of MassBrowser's de- censorship circumvention technologies by their citi- sign is using non-censored Internet users to run vol- zens [32, 33, 54, 66]. unteer proxies to help censored users. We perform To restore the openness of the Internet, researchers the first user study on the willingness of typical In- have designed and deployed an arsenal of tools [12, ternet users in helping circumvention operators. We 14, 15, 28, 29, 38, 43, 47, 57, 61, 63, 67] that help users have used the findings of our user study in the de- bypass censorship. Such tools, known as circumven- sign of MassBrowser to encourage wide adoption by tion systems, deploy a variety of techniques ranging volunteers; particularly, our GUI software offers high from IP indirection to onion routing to traffic obfus- transparency, control, and safety to the volunteers. cation [35, 56]. Key shortcomings of existing systems. Unfor- tunately, existing circumvention systems suffer from ∗The first two authors made equal contribution. one or all of the following weaknesses: (1) Eas- 1 ily blocked: A majority of circumvention systems fore, we argue that a circumvention system needs work by setting up proxy servers outside the cen- to be designed in a way to optimize blocking resis- sorship regions, which relay the Internet traffic of tance; bundling additional properties like anonymity the censored users. This includes systems like Tor, is the main reason for the majority of weaknesses VPNs, Psiphon, etc. Unfortunately, such circum- mentioned above. For censored users who need ad- vention systems are easily blocked by the censors ditional properties like anonymity, they can achieve by enumerating their limited set of proxy server IP those by cascading the circumvention system with addresses [54, 55, 64, 66]. (2) Costly to operate: To other privacy-enhancing technologies like anonymity resist proxy blocking by the censors, recent circum- systems (and, consequently trading off QoS and cost vention systems have started to deploy the prox- to get those additional properties). In this paper, ies on shared-IP platforms such as CDNs [41], App we demonstrate that designing a circumvention sys- Engines [23], and Cloud Storage [11], a technique tem based on this principle enables us to offer strong broadly referred to as domain fronting [18]. This blocking resistance in addition to practical QoS and mechanism, however, is prohibitively expensive [42] low cost of operation. For instance, the separation to operate for large scales of users. (3) Poor QoS: of properties principle allows us to run single-proxy Proxy-based circumvention systems like Tor and it's circumvention connections, improving the QoS-cost variants [29, 40, 59] suffer from low quality of service tradeoff. It also enables us to limit the use of our (e.g., high latencies and low bandwidths). This is due circumvention system only for accessing circumven- to various factors such as the small number of proxies tion content. This not only reduces congestion on the to clients, and the large volume of client traffic used proxies (therefore improving the QoS-cost tradeoff), to access voluminous content (like pirated movies). but also increases the potential number of volunteer (4) Hard to deploy: Several circumvention systems proxies by minimizing the legal risks of running cir- proposed in the literature are impractical to be used cumvention proxies (as witnessed for general purpose at large scale due to various reasons. For instance, de- circumvention systems like Tor [51][9]). coy routing systems [28,34,67] require wide adoption by Internet ISPs, and tunneling systems [29,31,40,59] Contributions. We design a new circumvention can be disabled by third-party service providers they system, called MassBrowser, that aims at addressing use for tunneling. the weaknesses of prior designs, as discussed above. That is, MassBrowser aims at offering reliable block- Our approach. The goal of this paper is to de- ing resistance while providing practical QoS and low sign a new circumvention system that offers practical operational costs. The core idea of MassBrowser is circumvention by tackling the aforementioned short- to use normal Internet users with access to the free comings of circumvention systems. We base our de- Internet, which we call Buddies, as relays to proxy sign on a new design principle not considered by prior censored web traffic for censored users, which we call circumvention designs. Our principle, which we call Clients. This will address the challenges of circum- the separation of properties principle, states that the vention systems discussed above in different ways. key property expected from an effective circumvention First, the diversity, abundance, and dynamicity of system is blocking resistance, and it does not need to the IPs used by the Buddies will make any attempt provide other properties such as browsing privacy or of IP enumeration by the censors prone to signifi- anonymity. Our real-world observation [13, 24] sug- cant collateral damage (i.e., due to falsely blocking gests that the majority of censored users are solely significant non-circumvention traffic). Particularly, interested in blocking resistance, but not other prop- normal Internet users connect from behind NATs, erties like anonymity. For instance, typical censored therefore blocking NATed Buddies has similar col- users trust any open proxy or VPN provider just to lateral damage impact on the censors as in the (im- get access to censored websites despite the trivial ab- practically expensive) domain fronting systems [18] sence of anonymity and browsing privacy [24]. There- (i.e., to block a NATed Buddy, the censors will need 2 to block the Buddy's subnet). Second, MassBrowser similar blocking resistance properties (both meek and combines various state-of-the-art circumvention tech- MassBrowser aim at increasing the censors' collateral niques including CacheBrowsing [26] and Domain damage by making use of shared IP addresses). Fronting [18] to optimize the QoS of circumvention In summary, we make the following main contribu- connections while minimizing the operational costs tions: of circumvention. As shown in Section 8.2, we esti- 1. We have designed a new circumvention system, mate the total cost of deploying MassBrowser to be MassBrowser, with the objective of addressing no more than $0.001 per active client per month. practical weaknesses of existing designs, partic- We have built a fully operational implementation ularly, blocking resistance, QoS, and operational of MassBrowser, with end-user graphical user inter- costs. faces for MassBrowser Client and Buddy users with minimal technical background. We have been testing 2. We have performed the first user study on the MassBrowser's software for several months using vol- willingness of normal Internet users in helping unteer clients from inside censored countries. Mass- circumvention systems. Browser will make a real-world impact only with wide adoption by volunteers who run MassBrowser Bud- 3. We have implemented and deployed Mass- dies. Therefore, a major challenge to MassBrowser's Browser as a fully operational system. We have success is to facilitate and encourage wide-scale adop- used the findings of our user study to build a tion by volunteer relays. Towards this, we perform usable GUI software for clients and volunteers. the first user study on the willingness of Internet Our software is pending an IRB approval for users in voluntarily helping circumvention technolo- public release. gies. The results of our user study suggest that a significant fraction of Internet users are willing to 2 Background on Circumven- run software that helps censored users|if they get guarantees on their safety and security. Advised by tion Systems this, we build MassBrowser to provide high levels of safety and security to the volunteer Buddies. Par- Internet censorship continues to remain as the biggest ticularly, we design a user-friendly GUI software for global threat to freedom of speech, ideas, and infor- Buddies that provides them with transparency and mation [20]. The censors deploy various technique full control on how their computers are used to help to implement censorship [14, 35, 37, 56].