3 ms·
Probably it will be even easier to detect Tor nodes - just look for IPs which never receive SNI in TLS exchange on 443 port.
by monort 12y ago
Probably it will be even easier to detect Tor nodes - just look for IPs which never receive SNI in TLS exchange on 443 port.
- userbinator 12y agoThinking over the protocol again I think TLS wasn't a great choice for Tor - not only because of SNI but other things like server certificates are also sent in cleartext during the handshake so it's easy to distinguish and just block all TLS traffic that uses self-signed or otherwise certificates not issued by the big CAs. Something more like SSH, not relying on central CAs, would be less distinguishable - is it Tor traffic, or is it just someone accessing his/her server remotelly.
- conductor 12y agoI would suggest impersonating other encrypted protocols with heavy traffic like encrypted BitTorrent or P2P Skype (is it still P2P or MS centralized it already?). On the other hand, systems administrators are frequently blocking BitTorrent and Skype traffic so the "TLS" traffic on port 443 has more chances to pass.