Hiding Tor is difficult beyond practicality?

[Patrick]

mfc via Whonix Forum:

i find this quite lazy, a 6-year-old quote from Appelbaum is your proof that pluggable transports are useless

Other reasons where states here too.

obviously there exists a wide spectrum of adversaries and adversary capacities, some can block some pluggable transports, some can’t. the idea is to make that work as difficult as possible for them. a nice overview of the different pluggable transport approaches is here:

Blocking vs non-blocking is besides the point since that is
circumvention. “circumvention” meaning “just make it work, it’s ok if
someone finds out I used Tor later”. That use case is much easier to
keep supporting.

This is about hiding Tor, i.e. “make it work and make sure no one will
ever find out I used Tor”. Due to very realistic assumptions such as
extended logging of traffic, progress in pluggable transport detection
and retroactive policing it is a very bad idea to try to circumvent Tor
which may even be possible at the time when later (lets say weeks,
months or years) detection is still a personal risk.

in addition, from the perspective of hiding Whonix use (as currently distinct from Debian, Tails, etc), as has been mentioned in this thread, you could continue to decompose Whonix into Debian-based packages,

All of Whonix is available as Debian packages for years.

List of packages: Whonix · GitHub

“sudo apt install whonix” is possible and done so by third parties in
the wild. References:

Whonix Installation from Whonix APT Repository

'sudo apt-get install whonix' Part I / Distro-Morphing

The ability to install Whonix meta-packages packages from a repository is finished. How it Works: In two steps a user is able to convert plain Debian VMs into Whonix: First by adding the Whonix repo URLs to the apt sources list (optionally: check instructions for anonymous repo downloads) Then doing ‘sudo apt-get install whonix-(gateway|workstation)’ What Becomes Possible: The concept of distro-morphing is an incredible technical milestone because at the moment, no other derivative O…

having all Whonix packages be maintained within Debian repos.

That would be very nice for other reasons but unfortunately very
unrealistic. Few reasons given here before:

upload Whonix packages to packages.debian.org

Actually does Whonix host have to include whonix apt sources? Why not include the relevant Whonix packages in Debian servers, as done with all the other packages? Advantages: No obvious connection to Whonix servers (if updating with clearnet, or visible to exit node if going through Tor). Not relying on the security level of whonix servers (secured to the same level as debian servers?)

A Debian Maintainer who stepped down explaining the challenges /
impossibilities changing Debian in human life spawns:

Winding down my Debian involvement

But even if we had that, when even readers of linuxjournal are already
called extremists in the West with relatively many Linux users…

https://www.linuxjournal.com/content/nsa-linux-journal-extremist-forum-and-its-readers-get-flagged-extra-surveillance

…you can imagine how much users of Linux stand out in countries where
use of Tor is not only blocked but deemed dangerous.

Solution? [1] Debian or any Linux going mainstream on the desktop and
[2] producing lots of Tor traffic by default. I see neither [1] nor [2]
coming.

also helpful towards reducing network fingerprinting of Whonix users were the previous efforts to have a shared Tor Browser user profile across Whonix, Tails, Tor Browser.

Whonix uses the same Tor Browser profile as Tor Browser, in other words
unmodified. What Tails is doing is up to Tails. They’ve been criticized
for their custom profile by others. Arguments were made. I don’t think I
could talk them out of it.

However, Tor Browser fingerprint matters at the end of the connection,
i.e. at the destination server. ISPs won’t be able to differentiate
Whonix, Tails, Tor Browser at the ISP level (unless something is very
wrong).