Not only the free web is victim to China’s excessive censorship, but also the Tor anonymity network: the Great Firewall of China prevents thousands of potential Tor users from accessing the network ...
Wilde was able to narrow down the suspected cause for active scanning to the cipher list sent by the Tor client inside the TLS client hello The TLS client hello is sent by the client after a TCP connection has been established. Details can be found in the Tor design paper @cite_29 . . This cipher list appears to be unique and only used by Tor. That gives the GFC the opportunity to easily identify Tor connections. Furthermore, Wilde noticed that active scanning is done at multiples of 15 minutes. The GFC launches several scanners to connect to the bridge at the next full 15 minute multiple when a Tor cipher list was detected. An analysis of the Tor debug logs yielded that Chinese scanners initiate a TLS connection, conduct a renegotiation and start building a Tor circuit, once the TLS connection was set up. After the scan succeeded, the IP address together with the associated port (we now refer to this as IP:port tuple'') of the freshly scanned bridge is blocked resulting in Chinese users not being able to use the bridge anymore.
@cite_29
1655958391
We present Tor, a circuit-based low-latency anonymous communication service. This second-generation Onion Routing system addresses limitations in the original design by adding perfect forward secrecy, congestion control, directory servers, integrity checking, configurable exit policies, and a practical design for location-hidden services via rendezvous points. Tor works on the real-world Internet, requires no special privileges or kernel modifications, requires little synchronization or coordination between nodes, and provides a reasonable tradeoff between anonymity, usability, and efficiency. We briefly describe our experiences with an international network of more than 30 nodes. We close with a list of open problems in anonymous communication.