all right well welcome everyone um my
name is Venus
Fortuna this is Jun is one of the great
engineers at offline we have engineer
over
there um so we'll be talking about the
technology
riew this is part of uh jsaw jsaw is a
group at Google that works on TR to open
societies we work on projects like uh
disinformation toxicity online
radicalization and I'm the engineering
Le for the internet Freedom team at
J and our effort goes beyond
outline um our strategy is to prevent
and mitigate and expose
censorship on the prevention side we
we've worked on internet standards uh
for example we we chaired the working
group at the ietf the internet St body
uh
to um Advance the encrypted DNS standard
and we put strap to the industry by
adding support uh to this standard of
the standard to the Google public DNS we
add to Android we added to Chrome and we
also released an app called intra that
was ined in as client so that really put
straps the industry and and uh in Dan
later right now
uh if is an important piece of the prox
strategy that jul is going to talk about
later it's also like a pre requisite for
ined Cent that some of you may know that
Heights the meaning is intive
communication and then on the exposed
side is like about measuring and
exposing censorship and also theing so
we can by that censorship so we've done
work uh to
make Google traffic data public you know
way that is accessible and usable so you
have like libraries to use it and and
organizations use it to track internet
shutdowns in different
countries um and we also worked with
organizations in the field like sensor
planet and moodi to also make their data
more accessible and useful including
like doing a dashboard of sensor plan
which is a group univers Michigan
and writing
paper so
that's area and then there's the mediate
which is like I don't know
um tools like we have the bling
happening
now and we bu convention tools like in
and outline another fact and more
recently we are working with this Al SDK
which is really making the technology
from outline has Improvement and used by
me of people usable because being an app
you open source doesn't mean it's
reusable make it reusable easy to add
sensorship so I'm going to stop there
the main speaker today so
[Applause]
cool I will show the jel icon here
cover as jel and you can access our
website through
google.com let's get in started so first
uh I'd like to talk about the problem we
are going to solve which is
censorship online censorship is a global
issue so when you access something and
you see the for full cage that means
probably you're getting sensored and the
internet sensorship is still over the
world so you can see surprisingly like
most of the countries are doing the
censorship now and that's why we provide
our solution which is out VPN we just
talked before it is a vpm product but
it's a decentralized VPN product so you
can create your own VPN server and use
the client what looks to access that
server and you can share access keys
with
your with your friends or want uh
colleagues to use your bpn server so
here we have two products one is outline
manager and theine clients and you can
share the access key between them so uh
by creating your own VPN servers you
have a fully ownership of your server so
you trust what you've done to your
server you don't need to worry about
privacy you don't need to worry about
Ser to some is monitoring your traffic
because it's all own by yourself and you
can share the access ke to any number of
outline
clients uh let's jump into the first
demo of this talk I will show you the UI
of OurTime manager here why not so you
can see here is the manager UI I have
already created a server for the Hope
event
clear and
uh you can see you can create multiple
Keys uh I have created demo key and main
key and when you click the share button
here you will be able to share the
key so here is the share dialog you will
see this is the outline access key
here and you can also send the
invitations so when you click copy
access key this access key is copied to
a clipboard and you can send that over
secure the message or secure the email
to others and I will show you is the
outline client so outline client is AC
crossplatform
client tool is course all major
platforms including or desktop and or
mobile platforms you can install it from
Play store or from App Store uh here is
I will show you the Linux version so you
can download it from our website get
offline. or and I will show you with
that later in the talk and uh once you
download it it will see see it from the
download window and feel free to double
click it to launch out PL UI and this is
D when first download and
see uh we will show you some information
page and you can see got it and uh we
will also monitor the clipboard so we if
we found the outline key there we
automatically prompt the ad server Thing
Once you addit the server you can see
your server is added to this client you
can type to left to confirm actually we
will be doing something so we will try
to get the IP
address of this environment and this
seems and not doing it
correctly and one thing to tr shoot is
we can restart the machine in order to
reset the
network uh we have we won't wa it for
now because it took some time uh we can
show it later uh let's directly into the
SL the gr will show the current IP
address and once you click connect in
aine client the IP address will be
changed to your
own uh VPN server you added it so now uh
outline client and outline manager are
very easy to use for any users but for
developers they are not easy to use the
features or reviews the features we're
building uh like we're building a lot of
upline Server Connection we based on
Shadow SS if developer would like to use
that we created outline SDK and outline
SDK is a reusable composable and AC
crossplatform to to empower your app
against censorship so you can easily use
all these censorships convention tools
and integrate them into your own lab or
you can even create your all VPN product
using this SDK and it's fully
crossplatform I mean you can use it on
any platforms from desktop to autel
platforms as
well so outline SDK consists of the
following components the first is
libraries we provided a lot of libraries
for you to use to add Network resilience
to your own apps for example we provide
transports which support Shadow sock TS
and web socket we also provide proxy
protocols like htvp so SP we also
provide some proxy list strategies we
will show them later what are proxy
strategies for example encrypted DNS
package
manipulations and we also provided vpm
apis for now we provide alternative SS
vpm API based on lightweight IP which is
the c r to set up a user space Network
stack so you don't need to rely on any
specific of operating system kernels in
order to read write interor and forward
IP packets or conver them into TCP orp
packets we also provide a mobile proxy
so mobile proxy will let you easily
integrate these features into mobile
apps because developing mobile VPN is
tricky there are lot of restrictions you
might need to use some VPN APS the mob
proxy allows you to do that easily
Al also provides some command learning
tools to experiment measure and
prototype your own uh censorship C
convention strategies we provide F
resolve and htdp to transport so we will
show these strline tools now today we
will focus on these two areas the proxy
protocols and the proxy strategies and
the three command line
tools let's start with the command line
tools
first I'd like to introduce the resolve
which is a dig or resolve DNS name if
you're using Windows uh it's similar to
dat for example when you type resol
youtube.com it will give you all IP
addresses of
youtube.com and we allow you to pass or
additional some additional arguments as
well for example you can specify the
resolver to 8.8.8.8 and you can force
TCP here and if you don't just want to
get a c name you can do that as well and
the output will be the as of youtube.com
so this is across platform resolve and
since we implemented it in go so you can
run it directly through this go command
just need to go you don't need to we
haven't built any pre-build binaries
because you can easily run that through
the go command and uh it will be built
our platform to be to to be run natively
similarly we have fetch which is a curve
or JavaScript fetch those
function uh when you type f similarly
with the iping photo IO you will get
that uh iping
photo the output will be the
region for example if we are here in New
York the region will be new yor but we
allow you to specify to accept and
outline z a key and we just have I just
have shown you through online manager
where you copy the key you can paste the
key here in the transport and when you
get the IP info again it will show you
the location of my VPN server which is
located in Singapore and this is also
what supposed to get when uh when we run
the C command last
time so the third is HTTP to
transport it's a local web proxy using
HTTP
connect so for example you can start
listening on a local Port listening your
Local Host 380 and we also accept an
outline server key so this command will
start a local web proxy listen name on
this IP address and port number and the
remote server is the outline key which
just pasted
here and now if you run Cod without
specifying the proxy of course it will
show your own local byra region and if
you specify the proxy using DX and- p
means it will use HTP connect so it will
show the IP address of your own server
there uh and that is what it's supposed
to do and you can also configure your
own browser proxy to point to this local
proxy to or your traffic within the
browser will be routed to this outline
Shadow uh it doesn't have to be an
offline server we actually we are
compatible to any shadowof servers so if
you create a shadow stock server you can
also generate this outline access key
and to visit your Shadow server as
well so these are the three major
command line tools uh we will cover
today and we also provide a lot of other
tools you can uh see our code but we're
fully open sourced on GitHub and I will
show it the link later in talk any
questions
cool I think we can dig more into the
strategies so you have seen the outside
key we've shown before start with SS
column SL that is what we call a
strategy
uh so we will start with an empty
strategy so when you run an uh a SDK
command line without specifying that
transport that means an empty strategy
so empty strategies means a directly
connection to the Target Ser uh I will
use a fetch example to show uh what is
what it is doing so you would like to
fetch the YouTube website you will first
start establishing a TCP connection to
to
youtube.com and once YouTube access that
a TCB connection will be established and
you can read or write from that
connection uh that's the default empty
strategy so if you don't specify
anything you're actually connecting
directly to the Target
destination we also have proxy
strategies the shadow sock key I
mentioned before is a proxy strategy and
we also support other protocal like
socks 5 here I will review socks 5 as an
example so we have a strategy here and
of course you need some proxy because
this our proxy strategy so you need a
sof by proxy and uh F will still try to
establish a TCP connection so all these
strategies are transparent to the users
and we use our sdp libraries they are
all transparent as well so you just do
uh traditional establishing TCP
connection with the strategy and our s
five strategy will try to establish a
sofp hand shap with the remote sofp
proxy here and when sofp see that
handshake if we try to establish the
actual discreation with the destination
and once all these things are
established YouTube will create a TP
connection with the sofp proxy and the
sofp proxy will return that TCP
connection to the strategy and as the
strategy will also return a TCP
connection so from fat perspective it
has no difference with the MP strategy
it's the same you establish a TCB
connection and you can read right from
that connection but under the hood our
strategy will do a bunch of these things
try to uh do all these
things for for for the fetch but it's
all transparent to fetch fet will think
okay we're just fetching something from
YouTube and we got the
result so that's proxy
strategies and we've also had transport
strategies so transport strategies will
Marshall or UNM Marshal traffic
over so transport strategies it will
Marshal and unmarshal traffic over a
specific Network transport for examp for
TOS or web socet I we use the web socket
as an example here so for the Fetch and
if we are going to establish some
connection to reite some data to that
web sof server Echo web.org for f we
still trying to
establish a TCP connection that it's
completely to fet so fet was still
trying to establish a TCP but our
strategy will encapsulate into a web sof
upgrade protocol with that Target
destination and of course later the
fetch can send the T data or R data from
the strategy and our strategy will also
put that data into the web the frame uh
to thep Target uh server and it will
also read web softare flams and try to
unmarshal the TCP data and send it back
to vetch so From fet perspective it's do
a TTP connection but and the boot and
though what we our strategy is doing is
actually encapsulate it into a web soft
protocol uh transparently to
fetch yeah
sure what could be about water sockets
is that um it allows you to run a proxy
entry point on a
CDN um so like toare and kind of thing
um typically 12 CDN will not allow you
to do HP connect which is the h2p based
kind proy protocol but they allow you to
do web suckets so that gives you an make
Point uh to your proxy um which means
that you are using the CDM wall which
make sh pool so in order to
block begin where you proed by address
they help to block them
again
than okay our next strategy is called
DNS protection strategies so we provide
a lot of DNS uh request prodal like DNS
over hgps do which is pretty secure
because it's fully encrypted and also
provide other DNS over TCP or TOS
options as well so let's take an example
of the DNS over https so still prar a
fetch the fetch trying to establish a
TCP connection with the destination
youtube.com and our strategy sees fetch
is requesting something from a domain
name so it will send a domain name
request to be Nest go and because we
specifying the do as ds. Google and it
will try to send a https based DMS
request to uh ds. Google and DNS do
Google will return the IP address
accordingly using https as well uh in
this case strategy now we know the
actual destination is 142 250 72 and 1 1
0 and then it will try to establish that
TCP connection with this specific server
and it is one of the youtube.com servers
and youtube.com will successfully return
atcp
connection and our strategy will forward
that connection back to fetch again so
From fetch's perspective it's du
establishing atcp connection and read
right from that connection but strategy
is doing some more complicated things
it's trying to solve in the TNS using
https so there are no leaks because
censorships uh because the Ty the
traditional UDP based DNS requests are
clear text and the sensors will be able
to see all your domain names and they
can easily block your domain name but
once you use
https it's all good because it's all
fully
encrypted and the next is Packet
manipulation strategies so it will
modify the network packets in order to
bypass some deep packet inspection
censorship such as s based blocking so
Sni is a concept in TOS when it is doing
a TOS handshake so sometimes uh the TOs
client will put the server name in
indication into the client handshake
which is clear clear text because when
when we're doing the TS handshakes we
don't have any Keys established yet so
it's not improved at all and in that
case the sensor might see that dominum
in clear text and they can block you as
well for for example we establishing a
TOS connection with YouTube uh sometimes
the client will put youtube.com into the
TS handshake as well I will show an
example here so here F will try to I
will skip the TCP con so before the TLs
handshake you need to establish the TCP
connection and I will skip that for now
but for TLS handshake uh fetch will try
to send TSS handshake record in clear
text and by the definition of the
protocal you can actually split that
record into two smaller records so for
example here we show TS we will put the
first 60 vites in the first record and
put the next 200 bytes in the second
record and these two
records are still in clear text but it
will confuse sensors because sensors
will think okay typically you only send
one TSN shap in it will try to find some
sensitive domain names in that a but
what we are standing in Rec one is only
60 might not even reached Sni F so the
sensors will think cool it's a good
handshake or maybe it's a Malou foring
handshake because the sensors doesn't
know we actually splitting that and the
sensors will let all these connections
go to save the resource of course
sensors can memorize all your records
and try to reconstruct everything in
their own machine but that will increase
the cost of the sensor service because
uh the traffic might choose different
service or might even choose different
routes and sensors need to synchronize
all these memories with all the servers
and that's a huge effort and it will use
a lot of a lot of resources including
secure power and memory power so the
goal here is not to completely has
censorship but to increase the cost of
censorship and most of the sensors in
the world doesn't Implement that and we
we will show you Dem later to show how
we can use this uh TS handshake uh
fragmentation to bypass
censorship and once the TS connection is
establish uh the strategy will pass that
connection back to fet so fet can reite
from
[Music]
connection cool so these are all the
strategies we already supported in CK
and will also support some other uh
strategies as well but they are uh for
they will fall in one of the categories
I mentioned before and a more important
concept of that is all these strategies
are composable so composable means you
can combine different strategies and to
construct a more complicated and a
more uh censorship resian strategies so
you can use for example you can use a
pipe here to combine the DNS over hcps
and TS recommentation together and if
you had three different Ali servers can
even create connect the three servers
into something similar to the rounding
and you can also if you want to have
five over to you can combine that too as
well so you can combine multiple
strategies and use your imagination to
create new strategy based on this
existing buing
strategy I will use the first y I'm MHO
so here we have F and we have the
definition which is youtube.com and we
have two strategies linked together uh
please note the sequence it actually
revers from what we type in to the
command line so in command line we type
in CPS first and
then under the under the mood we
implement it reversely so f talk to P
fragmentation first and then to uh DMS
PVS so in this way the first one will be
the gr that facing directly to the
internet and the last one will do be the
one facing your user code uh in the
example
fact so fact with new start I that
establish tttp
connection and the TS recommendation
doesn't RTP so it put forward that t
connection to the next strategy which is
the D
ggn and this strategy cares about the
domain name so it will try to send you
us. to connect. Google try to get the
using p and then to establish the
connection with that typ address with
youtube.com next one that TTP connection
is Dage B will try to Dage the to well
by standing the magic this time the
takey
care will try to blid that into two
records but the
dn't care but it only
care forward the to YouTube and we will
the second one as well to YouTube so
that Cent it's and YouTube will
return connection with our strategy and
we will return that all the way back to
bench don't C
Ben for with the remote by
PN
the so that's for the
compos question
can do question Cool
professor and next I'd like to talk
about remote so we we talked about
strategies and we talk about all the
mline tools but we as a developers we
are going to investigate what we can use
in the specific region of the standard
area to bypass censorship typically when
manual Center sh to require three step
first you need to a remote
access in order to test youry or test
what is blocked and why it is blocked
you canuse out as
well region
that you can also use do R you can
create local create fo five property
locally and connected to the Target
server un and you be F five transport of
strategy
in well so all the package and all the
will be routed through
the and a third option is some third
party providers we we we're buing Sals
which is pretty unique because course M
region the world
uh it but but it's not free you need to
pay about $100 per month uh in order to
do the of it but uh they're easy to
use and in the demo next we wave that to
show you
how and once you set up the remote H you
need to detect the ship you need to know
what it entered what you can access and
what you can have for example you might
detect a unit blocking to.com or you
might detect the the find Al the
indication blocking as well as I
mentioned before and once you detected
the censorship in aad censorship you
will need to figure out a way to byad
all the using either a building strategy
or you can create your own strategy or
you can compose different strategies
combine them together to construct
more powerful strategy
to like here you can use DNS or GPS to
byass DNS you can use the tation to live
hand and ey blocking and you can combine
them P
together
cool we'd like to show a demo here we
have
time
so so I will launch the ter here and try
to run at a c command again and it seems
it's working now we're in New York City
and as I said we can connect to our
outline server we just f it here once
you click connect it will show a better
connected and when you run the code
again it should show the IP address of
the server which is Singapore and we
host the server in digital ocean so we
can the all this information here and of
course we can def that
from from the AP server and once it's
disconnected and you run it again it
going back to our local address it's a
typical behavior of VPN server as people
expect it and what i' also like to show
is you can't actually
share uh more than one Keys share a lot
of kids you can create a lot of kyss of
your own server and you can even change
the port number so when you click the
settings uh it allows you to configure
the host name and even port for example
we don't like this we want to create a
port at 880 or 80 whatever you like when
you click save and you go back to your
server management you can add a new key
with that word you can name your key
another key here
and you can also share that key with
your customer and in the key you can see
the port has be changed to 8080 so you
can set up uh the port to be any number
changing the port is used for some time
because most of the sensors might block
unknown PS but they will last for three
or 80 pass because they uh HTP and HP
Port so Chang Port sometimes useful and
you can also add your name like my
service here and you can copy that key
and share that with your friends and
your friend will be able to add multiple
keys to the client as well so once they
add that server it will show your own
service name with the correct port
number which is 880 and of course your
friend can connect uh to that server as
well and to show we actually colnect it
and we quer
this IP address it will show the
Singapore
thing sometimes maybe
the yeah the so slow but can't show that
here it's from single code and you can
disconnect from the key and the old key
is also working you can connect uh using
the old key as well but you can also
remoke the exess for the keepy in your
outline manager in order to for example
remove people there and you can also set
other dat data limits and other things
so upine manager is pretty useful here
uh when you try to create your own
server and key and we support a lot of
service creation method as well for
example we expand that and try to add a
server with support digital ocean Google
cloud and Amazon and you just s with the
single click and now plan will be that
that I will not click that because that
charg lot not a lot about $ a mon but
yeah just show but it's low cool so
that's suppos to be the first demo to
the second which is measuring YouTube in
HRA uh in for a second demo I would not
use outline on manager who out
switch to a new desktop
here
point
so yeah
you
andbe there
[Music]
so the first line show is live can you
see that
clearly uh so command line a f to show
we can draw it directly from command
line using go but
need and then you can f that H info from
Big SC and
I format it as the Jon using J me and uh
the go will if you ride first time go
will try to download everything here and
try to build it and then it will run the
binary and you can see we F the correct
the same Unity here so that's for the F
man any man can be learn in this way we
don't need to instore anything from any
platform so I'm using my perod it from
more thatt uh environments and not
mobile but if you that sh
M next I'd like to show how to set up
remote connection
here so for example we are using
the and uh this is the trans cord TOS I
first that because we need to add that
to the
previous command
so this uh yeah so this is the F map
here and you can add the
transport command line
here you can see with safy the time out
10 seconds because it's pretty far over
and you can support here and we we we we
hide that credentials some regs and you
can SP by a specific
country here I see
that Mo all these things you can paste
your own is or
country where is there so for example
here I will paste in the correct
irong so the part is IR thing we
have and and the country we use the two
character country name ir and also we
specify the is andn WR C so let's learn
that and will take even longer time
because we're actually going all the way
to and but
luckily successfully returned in us
which was buy one for one and you can
see the is
is
and
is and of course the country they so we
successfully support remote here and the
the export is pretty l so in that case I
want to save
some typing by exporting any wrong
transport and we will try
to F YouTube from ground
talks uh and we expect it to fell
because uh most of of time YouTu flocked
Iran and we're using the same f Way Iran
transort
F youtube.com and yes it should fail
that should be accepted because we
haven't add anything to it and it will
be 10 and request F so out because it's
locked uh what we suspect is maybe Iran
is doing
a DNS blocking in that case uh let's go
back to previous command and the last
five P the DNS request the DNS GPS using
CL Cloud flare as aest and trying to
build should also fail as
expected uh
and that F not expected because I two
pipes there you only need to type
one uh let me REM that and write again
but still you might see ARS in this case
you might see time out you might see
handshake F uh it will happens during my
test uh but today we we're see time out
uh so what I'm going to do is we with
think there might be
TS and blocking happening there so I
will try go back to the Discover with
the same command but we will add the D
fragmentation before the UN TPS this is
important and you can think of why why
this is important and what the
difference between putting before the
and what differ between putting after
the
but this time when you try to learn that
uh it will be pretty slow uh because we
are quering the we are doing
tations we try to things to time out
can let's say hopefully it will be
working this time but if not not I will
try to see WEA
or
example. try to try to re insure the so
session is good I will try to F
C the so session
so
Bas yeah so the T time out so or we need
to refresh the T somehow
and sure and but yeah for that and
people feel free to ask any
questions yeah uh some final sides
here uh for
the and
the condition we have app cord and it's
pretty you can use that five apps
without needing of
prop uh and C so we talked about Al CK
we talked about abs some apps and there
are a lot of third party apps there and
you can add your own apps here for and
here are some open source resor you can
use we we publish over our code on
gi.com so all
public thanks and any questions
[Applause]
yeah yeah for the
funding it's part of Google's like
social responsibility
efforts Google wants to give back to the
community so it's being Comm the this
area d
we FOC but who would like to the
society yeah and I I hear that and
and with being man into this commun for
like years and the way we we those is by
making them called fully
Autosource you can go and fact and we
also have sec audits by recommendations
the G community and like you running own
service
service you can
server we don't see that can traffic
like gole
Services you
okay
cool
yeah on time but if you have any
questions to try more things feel free
to join us at work at we began today and
you can
seeed I
guess thank you thank you