Hi, (Moving the discussion to tor-talk@, as this is not directly related to the code of Tor software or infrastructure.) Lag Inimaineb: > [â] why not setup bridges in places where other *legitimate* SSL > connections are also made? What I mean is, maybe we should try and get > big sites that cannot be legitimately (in the eyes of the oppressor, > of course) blocked (social media, comic sites, whatever), to run a TOR > bridge *on the same port* as their regular HTTPS traffic (443), in a > way that someone recording the traffic cannot distinguish (in advance, > that is) whether a certain SSL connection to that site is a legitimate > web browsing session, or a TOR session. That way, even if an address > on the internet "speaks" the TOR protocol, it cannot be automatically > blocked. > [â] > First off - there's the technical issue of binding to port 443 locally on > the web servers without disrupting the currently running local client. > [â] This technical difficulty could be solved by using something like sslhÂ[1]: âsslh accepts connections on specified ports, and forwards them further based on tests performed on the first data packet sent by the remote client. Probes for HTTP, SSL, SSH, OpenVPN, tinc, XMPP are implemented, and any other protocol that can be tested using a regular expression, can be recognised.â The problem is that if sslh can distinguish protocols that way, so could DPI boxes. So it would need something a little more convoluted. [1]Âhttp://www.rutschle.net/tech/sslh.shtml > Also, long running connections with heavy data usage to a web server > address are probably suspicious, but even if these were to be blocked, it > would be on a per-client basis, and would also just mean a QoS issue for > users but not DoS. More or less. I remember reading about Iran throttling any encrypted connection that lasted for more than 60 seconds. To a point that made Tor actually unusable, IIRC. > Anyway, I'd like to hear what you think. Maybe this isn't an issue anymore, > or maybe you've found a different solution, or mine doesn't work, or you've > already implemented it, etc. :) Another related idea is called TelexÂ[2]. To sum it up, this is about diverting seamlessly innocuous traffic at the network level. A censor could then thus not differentiate from "normal responsesi". One difference with your idea is that it does not require direct cooperation from the Internet sites, but with network providers along the path. I don't know if Telex has ever been deployed in practice. [2]Âhttps://www.usenix.org/event/sec11/tech/full_papers/Wustrow.pdf -- Lunar <lunar@xxxxxxxxxxxxxx>
Attachment:
signature.asc
Description: Digital signature
-- tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk