3 ms·
They could identify connections into the Tor network by analyzing handshake traffic and it seems that this may be exactly what is currently happening.
by brl 17y ago
They could identify connections into the Tor network by analyzing handshake traffic and it seems that this may be exactly what is currently happening.
- gasull 17y agoThey are SSL-encrypted. They cannot identify Tor connections unless it is to a publicly known Tor node.
- brl 17y agoThe way Tor uses TLS/SSL is unique enough that it seems very possible to automatically classify Tor traffic. I don't think this is really happening in Iran, but nobody knows for sure. My comment was misleading and what I really meant to say is that there is some evidence that encrypted protocols which can be used for tunneling traffic such as SSL and SSH are being automatically detected. Rather than blocking the connections completely, they are traffic shaping them to make them very slow. Since the Tor link protocol is basically just SSL it will also be affected by any policy applied to all SSL connections.
- gasull 17y agoThe way Tor uses TLS/SSL is unique enough that it seems very possible to automatically classify Tor traffic. Do you have more information on this?
- brl 17y agoNo, and I'm not sure about it. The way that Tor uses certificates does not seem to be very well documented or I would have a stronger theory about how it could be done without causing an unacceptable level of false positives on regular SSL traffic.