Research Circumvention Tools

[phabricator-migrator]

Information

ID: 74
PHID: PHID-TASK-ognnkpv7wtiodij7w5mq
Author: JasonJAyalaP
Status at Migration Time: open
Priority at Migration Time: Normal

Description

Non-bridge Censorship Circumvention Tools

Need to figure out if they can be used on the host or Whonix-Gateway to let Whonix (Tor) connect through them.

Requirements:

• Tor compatibility

Bonus:

• Usability
• Nonproprietary
• Crossplatform

Comments

---

HulaHoop

2016-02-21 15:31:31 UTC

I’ve thought about it and I don’t think we should advise putting censorship circumvention tools between a user and entry guard (except bridges and pluggable transports of course). All other tools besides pluggable transports are ill equipped to resist protocol fingerprinting and can have security problems. Using them to mask Tor traffic would be a red flag that narrows the user base to people who have seen this page which goes against advGoalTracking.

I still think the information is useful but it should be advised to use them as an exit point for traffic beyond Tor if they can work like that.

---

Patrick

2016-02-21 21:14:47 UTC

HulaHoop (HulaHoop):

I’ve thought about it and I don’t think we should advise putting
censorship circumvention tools between a user and entry guard (except
bridges and pluggable transports of course). All other tools besides
pluggable transports are ill equipped to resist protocol
fingerprinting and can have security problems. Using them to mask Tor
traffic would be a red flag that narrows the user base to people who
have seen this page which goes against advGoalTracking.

Then we exactly point that out. These tools may still be useful the
censorship-circumvention-but-not-care-about-detection-so-much use case.

This goes for most circumvention methods anyhow.

Quote by Jacob -
Hide Tor use from the Internet Service Provider

“Some pluggable transports may seek to obfuscate traffic or to morph it.
However, they do not claim to hide that you are using Tor in all cases
but rather in very specific cases. An example threat model includes a
DPI device with limited time to make a classification choice - so the
hiding is very specific to functionality and generally does not take
into account endless data retention with retroactive policing.”

---

HulaHoop

2016-02-22 19:12:02 UTC

Then we exactly point that out.

OK

Quote by Jacob -

Yes I know. The goal is to not stand out from a sizable set of users doing circumvention any point in time, not to protect from traffic identification retroactively.