[tor-dev] HTTPS Server Impersonation
jeroen at massar.ch
Mon Sep 30 11:07:04 UTC 2013
On 2013-09-30 13:01 , Ian Goldberg wrote:
> On Mon, Sep 30, 2013 at 01:03:14AM -0700, Rohit wrote:
>> This should satisfy most goals.
>> - A passive attacker wouldn't be able to distinguish between HTTPS->HTTPS traffic and Tor->Bridge. (Both use TLS)
> This seems false to me; it's not too hard to distinguish Tor-over-TLS
> from HTTP-over-TLS, right?
Mostly indeed as Tor will typically have long-lasting connections.
The primary advantage of such a setup is that a probe can't distinguish
anymore between a real webserver on port 443 or Tor.
The moment an adversary looks at
flow-lengths/times/byte-counts/packet-timing-variances for a host it
could easily catch on that this is not a normal webserver though.
Fortunately long-lasting HTTPS flows are not that uncommon in todays
More information about the tor-dev