[tor-bugs] #4185 [Tor Bridge]: Bridge easily detected by GFW

[Tor Bug Tracker & Wiki]

#4185: Bridge easily detected by GFW
------------------------+---------------------------------------------------
 Reporter:  hrimfaxi    |          Owner:                    
     Type:  defect      |         Status:  new               
 Priority:  normal      |      Milestone:                    
Component:  Tor Bridge  |        Version:  Tor: 0.2.3.5-alpha
 Keywords:              |         Parent:                    
   Points:              |   Actualpoints:                    
------------------------+---------------------------------------------------

Comment(by arma):

 Replying to [comment:11 asn]:
 > We know that GFW detects the SSL handshake of bridges and probes them
 aftewards

 We do? Where is that documented? Seems to me that we need to do some more
 investigation before we can say that we know anything.

 In particular, if they are doing active probing of some sort, the first
 questions are 1) what causes the active probing and 2) what do they use to
 decide it's something they should block?

 In the case of 1, if the rumors are true that vanilla ssl handshakes don't
 trigger a probe, then we should find out exactly what they're DPIing on
 and fix it. In the case of 2, if the rumors are true that they're
 "recognizing Tor" somehow, e.g. during or after the handshake, we should
 find out what they're looking for.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/4185#comment:15>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online