3 ms·
Plain Tor says "Hi there! I'm connecting to a Tor node" because all relay IPs are public. You can't hide that fact with ECH or by not sending the SNI. Every sec
by bauruine 3y ago
Plain Tor says "Hi there! I'm connecting to a Tor node" because all relay IPs are public. You can't hide that fact with ECH or by not sending the SNI. Every second invested in that is just wasted.
- 1vuio0pswjnm7 3y agoAnd of course I never suggested anyone could. Despite that I provided links to a couple of past discussions that show people are well-aware using "plain Tor" is not something anyone can hide, you keep trying to reframe the question I asked into something else, a debate whether using Tor is detectable or not. Who cares. Tell us something we do not already know. Why is Tor sending SNI. What is the purpose. It's a simple question. That is all I am asking. For example, CDNs use SNI to host many HTTPS-enabled sites on a limited number of IP addresses. Why is Tor using SNI.
- bauruine 3y agoI've looked it up for you. "IIRC it just should look like normal TLS traffic." and "because basically everything does it" was correct. "/* Browsers use the TLS hostname extension, so we should too. */"
- 1vuio0pswjnm7 3y agoThanks. That's not much of a reason. These domain names are not fooling anyone. Just looking at them one can see they are faked up, not normal at all. Plus there is no corresponding DNS lookup. And not all traffic is browsers. Will have to edit this out and recompile tor daemon.