4 ms·

Is it even feasible to block Tor connections?

• gizmo686 14y ago
  Kind of. Tor operates over a standard port, so detecting it is relativly easy. However, people in a non blocked region can create a non-standard entry node that is indistiguishable from normal encrypted connections.
  • falcolas 14y ago
    That "standard port" is 443, by the way. The same port as SSL traffic. So actually detecting it requires analysis of the traffic patterns. Blocking known exit nodes, on the other hand, is pretty easy - just block a subset of IPs.
• Ueland 14y ago
  Kind of, China does this by blocking all relays they get hold of. No relay-DB is ever complete, so they cant get them all, but enough to make it troublesome to use.
• ef4 14y ago
  It is feasible to prevent Tor users from accessing your service. This is by design. (see https://www.torproject.org/docs/faq-abuse.html.en#Bans https://www.torproject.org/docs/faq-abuse.html.en#Bans) It is much harder to stop your users from accessing Tor. You can make it less convenient, but there are countermeasures. (see https://www.torproject.org/docs/bridges.html.en https://www.torproject.org/docs/bridges.html.en)
• cdjk 14y ago
  There are some clever tricks adversaries can do with DPI. One thing was that Tor originally used SSL certificates with very short expiration times and rotated them frequently. That's very distinct compared to "real" https traffic, since no one waits until a certificate is a couple hours from expiration to replace it. My understanding is that now they still rotate certificates, but they set the expiration date much farther out in the future.