FOCI '18 Workshop Program

A lot has changed in the OONI-verse since we first presented a paper at FOCI in 2012.

OONI has gone from being a network measurement project primarily oriented at technical users with a unix only CLI tool, to being a global community that measures and responds to internet censorship events worldwide. Today, hundreds of thousands of OONI Probe users in more than 200 countries measure internet censorship from thousands of local vantage points every month.

This has led to many new and interesting opportunities, such as working with a growing community of human rights advocates and supporting their work with network measurement data. But this has also presented challenges, such as scaling our platform to meet demand and adapting to the ever-changing network landscapes.

As part of this session, we will discuss some solutions to problems that are common to network measurement instruments. Join us to learn all about what OONI has been up to over the last 6 years and what we’re building next!

In the modern age, digital communication tools play a central role in the conduct of protests and assemblies during periods of social unrest. The foremost illustration of this was during the Arab spring, where digital platforms were leveraged to promote and sustain public protests. In response, countries attempted to dispel gatherings and limit public protest by ‘shutting down’ the Internet or blocking online access to social forums. Since then, dozens of states have begun to employ cyber-shutdowns. During a one year period, a study tracked 81 different instances of Internet shutdowns in 19 countries. This trend is only escalating. While significant resources have been invested in tracking the technical contest between governments and activists, no research has succeeded in acquiring individual level data regarding the political and social effects of Internet deprivation. This research paper reflects on two novel experimental designs that quantitatively measure how citizens respond to cyber blackouts. The first experiment consists of a controlled experiment that tests the ability of participants to complete tasks related to political participation under simulated treatments of Internet access or deprivation. The empirical findings support our hypotheses that the absence of Internet access significantly restricts the ability to engage in political activity. A second experiment extends this research beyond a laboratory setting by tracking the activity of Internet users in multiple countries during period of government-initiated Internet shutdowns. This allows us to determine whether modern forms of digital political participation have supplanted traditional offline avenues of political activity, and whether citizens are able to circumvent cyber blackouts.

This paper examines different reasons for web inaccessibility. Prior work on accessibility mostly focuses on censorship by nation states. We look at three forms of server-side blocking: blocking visitors from the EU to avoid GDPR compliance, blocking based upon the visitor’s country, and blocking due to security concerns. We argue that these and other forms of blocking warrant more research.

End-to-end (E2E) encrypted communication tools can help users keep their communications secure from government or corporate surveillance. In this work, we conduct a quantitative survey (n=125) to assess general mental models and understandings of a hypothetical E2E encrypted communication tool. We find that the vast majority of respondents had adopted E2E encrypted tools in the real world, but lacked confidence and accuracy in their mental models of E2E encryption. Two key misconceptions include (1) three-quarters of respondents believing that their E2E encrypted communications could be accessed by unauthorized entities, and (2) one-half of respondents feeling that SMS and landline phone calls were more secure than, or as secure as, E2E encrypted communications. These findings raise concerns that respondents may not feel threatened by proposals of "backdoors" since they already feel that different entities can access their communications. More broadly, our findings suggest that the primary user-related challenge for E2E encrypted tools may no longer be adoption, but helping users who already have these tools avoid sending sensitive information over less secure channels.

HTTP Strict Transport Security (HSTS) was introduced to force clients to use HTTPS connections on sites that support it, thus preventing Man in the Middle and other attacks. HSTS has always been understood to potentially allow sites to track visiting clients, but this security threat has been considered outweighed by the security benefits it provides. With specific examples, verified on a website constructed to test them, we show that tracking is far more significant than previously recognized. We also demonstrate how to use our approach to censor individuals or classes of visiting clients. Further, we describe and demonstrate how third parties, such as site analytics services, can track clients across multiple domains. We discuss possible changes to allow users to control HSTS settings and better manage their security, and we compare and complement HSTS with HTTPS Everywhere, a popular browser extension with similar goals.

HTTP transparent proxies are widely deployed in mobile networks and can lead to potential security and privacy issues. HTTP traffic is increasingly subject to in-path manipulation, especially in cellular networks. Although the traffic manipulation behavior has been studied for long, little has been understood about the manipulation and privacy concerns that arise on networks in China, due to the limitations in measurement vantage points. In this work, we aim to fill this research gap by collecting large-scale HTTP sessions originating from China-wide mobile networks, and investigating potential privacy threats caused by HTTP transparent proxy devices. Our findings are multi-faceted. First, contents of web pages can be modified by proxy devices, which are replaced by or injected with advertisements. Second, HTTP headers with user-related and device-related data are injected into HTTP requests, which raises privacy concerns. In particular, we also find HTTP headers that embed exploit codes. Our study sheds light on the HTTP traffic manipulation behavior in China-wide mobile networks, and discusses related privacy threats.

This paper offers a political history of Telegram, a platform that combines aspects of social networking with secure messaging, and whose vocal commitment to user privacy and freedom of expression has brought it into open conflict with a number of governments, most recently in Iran and Russia. A detailed project history traces Telegram’s roots to Pavel Durov’s ouster from Vkontakte, the social networking site he had founded, at the behest of the Kremlin. The paper then analyzes Telegram’s ideology and politics by focusing, in turn, on Telegram’s emergence in the context of Vladimir Putin’s crackdown on technologically-enabled civil society; on Pavel Durov’s cyber-libertarianism; and on Telegram’s peculiar business model. The analysis shows that while Telegram’s rhetoric emphasizes user security, privacy, and freedom of expression, the company fails to demonstrate that it actually lives up to these commitments. Rather than earning user trust through transparency and accountability, Telegram’s value proposition hinges on blind trust on Pavel Durov’s good intentions and his team’s stated credentials.

Most approaches to circumventing Internet censorship and monitoring use conventional proxies which are accessed directly by their IP addresses and so are easily blocked. Decoy routing is an alternative approach that deploys a proxy in association with a router, called a decoy router, that is only accessible indirectly when traffic traverses the router. In this work, we design MultiFlow, a new decoy routing protocol that re-uses the TLS protocol's session resumption mechanism to enable the decoy router itself to resume a client's session. As a consequence, MultiFlow is able to (1) authenticate a client without blocking traffic inline on the decoy router, and (2) use information provided by the client to bootstrap the establishment of additional secure connections for covert communication. The client and decoy router then use a message board-like tunnel to communicate across multiple connections in a way that mitigates probing and traffic analysis attacks.