From telex.cc: How does the client tag connections? When establishing a normal HTTPS connection, the client sends a random number (called the ClientHello nonc

From telex.cc: How does the client tag connections? When establishing a normal HTTPS connection, the client sends a random number (called the ClientHello nonce). To create a Telex connection, the client replaces this number with what we call a tag — essentially, an encrypted value that looks random until it's decrypted. Decrypting Telex tags requires a private key contained in Telex stations. Since the censor doesn't have this key, it can't tell the difference between tags and the random numbers used in normal connections. In addition to marking connections that are requests for anticensorship service, Telex tags convey information that allows Telex stations to decrypt the secure HTTPS connection that the client establishes with the non-blacklisted destination website. This lets the Telex station replace the contents of the connection with data from a blacklisted site.