obfs4

Folks interested in the state of the art of this kind of DPI evasion might want to check out obs4, which is a "look-like nothing obfuscation protocol", and the default pluggable transport for connecting to tor bridges from places where tor is blocked. obs4: https://github.com/Yawning/obfs4 obs4 in tor: https://support.torproject.org/glossary/obfs4/

While the authors of this definitely didn't handle this well, I'd argue it's a pretty severe weakness and the tool shouldn't have been released in this state. Active probing has been observed in the wild [1] and pretty much all tooling in the space handles it in their threat model [2], so its naive to not consider it. I get why the signal team wanted something to use HTTPS, even networks with completely insane firewalls accept it and they get to reuse existing domain fronting code, but existing tools continues to viable in Iran and would have made much more sense in the circumstances. [1] https://blog.torproject.org/learning-more-about-gfws-active-... [2] https://github.com/Yawning/obfs4/blob/master/doc/obfs4-spec....

Checkout ScrambleSuit and OBFS4 https://github.com/Yawning/obfs4 https://www.cs.kau.se/philwint/scramblesuit/

That same person developed ScrambleSuit[1], which is used as a pluggable transport to obfuscate traffic and prevent detection/active probing. Work is continuing to keep the GFW from being able to catch up [2][3]. [1] http://www.cs.kau.se/philwint/scramblesuit/ [2] https://github.com/Yawning/obfs4 [3] https://git.schwanenlied.me/yawning/basket2

First, I would like to separate the little-t tor from big-T Tor for a second. I had the privilege of attending the most recent dev meeting and found the Tor Project to be an incredible group of people who are dedicated to a single mission[1]. Besides working on `tor`, members of the Tor project are also working on better censorship resistance[2], reproducible builds[3], and improving Firefox[4], among other efforts. To me, a motivated corps of technologists that have the resources to work on projects to protect user privacy can do anything under the right leadership. > oversold as solving problems it can never hope to If onion routing can't solve the problem of masking your location on the internet (thus providing greater anonymity) then what can? Right now I see it as the only practical solution for doing so. I also don't see any of the