4 ms·

Could Tor traffic be encapsulated in HTTPS to stop ISPs from identifying it, or would they still be able to either identify the traffic as Tor or identify the r

Could Tor traffic be encapsulated in HTTPS to stop ISPs from identifying it, or would they still be able to either identify the traffic as Tor or identify the relay nodes and block access to them? I'm curious if the Japanese proposal is even possible, or if it's another political policy that isn't supported by technology like Australia's proposed internet censorship system (which was eventually abandoned)

cdjk 14y ago
That's a complicated question. This talk from CCC in 2011 addresses some of the points (and is very interesting in it's own right): http://www.youtube.com/watch?v=GwMr8Xl7JMQ http://www.youtube.com/watch?v=GwMr8Xl7JMQ Tor already uses SSL, so I'm not sure how valuable encapsulating it in HTTPS would be. In fact (and this is from memory, so I may be wrong), some governments were able to block Tor by looking at certificate expiry date - Tor uses short lived certificates, but no real https site is going to use an ssl cert that expires in a couple hours. There were some other ways to fingerprint Tor traffic, but I'd have to watch the video again to remember. The Tor developers also apparently have a list of potential ways to identify Tor traffic, but haven't fixed all of them because they're waiting for evidence that they're being used to block Tor traffic first. As for relays - the bridge system addresses that. It's difficult or impossible to compile a complete list of bridge nodes, so that method should be pretty effective. It's also possible to run a "private" bridge and share it out of band with other. That method certainly should make relay identification extremely difficult.
Pitarou 14y ago
I don't think they're proposing to block the PROTOCOL. (Is it even possible to reliably distinguish Tor traffic from other encrypted traffic?) Rather, I think they're proposing to block all packets being sent to known Tor end-nodes. Of course, miscreants can get around this by bouncing their packets off a relay outside Japan. This will actually HELP Japanese criminals who go to the trouble of using a relay. When they cause trouble, the first response of the authorities will be, "This is the work of foreign criminals." (A common scapegoat, alas.) "It can't possibly be coming from Japan, because we've blocked Tor." (and we're certainly not going to admit that our firewall leaks)

cdjk 14y ago

That's a complicated question. This talk from CCC in 2011 addresses some of the points (and is very interesting in it's own right): http://www.youtube.com/watch?v=GwMr8Xl7JMQ http://www.youtube.com/watch?v=GwMr8Xl7JMQ Tor already uses SSL, so I'm not sure how valuable encapsulating it in HTTPS would be. In fact (and this is from memory, so I may be wrong), some governments were able to block Tor by looking at certificate expiry date - Tor uses short lived certificates, but no real https site is going to use an ssl cert that expires in a couple hours. There were some other ways to fingerprint Tor traffic, but I'd have to watch the video again to remember. The Tor developers also apparently have a list of potential ways to identify Tor traffic, but haven't fixed all of them because they're waiting for evidence that they're being used to block Tor traffic first. As for relays - the bridge system addresses that. It's difficult or impossible to compile a complete list of bridge nodes, so that method should be pretty effective. It's also possible to run a "private" bridge and share it out of band with other. That method certainly should make relay identification extremely difficult.

Pitarou 14y ago

I don't think they're proposing to block the PROTOCOL. (Is it even possible to reliably distinguish Tor traffic from other encrypted traffic?) Rather, I think they're proposing to block all packets being sent to known Tor end-nodes. Of course, miscreants can get around this by bouncing their packets off a relay outside Japan. This will actually HELP Japanese criminals who go to the trouble of using a relay. When they cause trouble, the first response of the authorities will be, "This is the work of foreign criminals." (A common scapegoat, alas.) "It can't possibly be coming from Japan, because we've blocked Tor." (and we're certainly not going to admit that our firewall leaks)