On 30 September 2013 07:01, Ian Goldberg wrote:
> On Mon, Sep 30, 2013 at 01:03:14AM -0700, Rohit wrote:
>> This should satisfy most goals.
>> - A passive attacker wouldn't be able to distinguish between HTTPS->HTTPS
>> traffic and Tor->Bridge. (Both use TLS)
>
> This seems false to me; it's not
On Mon, Sep 30, 2013 at 01:03:14AM -0700, Rohit wrote:
> This should satisfy most goals.
> - A passive attacker wouldn't be able to distinguish between HTTPS->HTTPS
> traffic and Tor->Bridge. (Both use TLS)
This seems false to me; it's not too hard to distinguish Tor-over-TLS
from HTTP-over-TLS,
On 2013-09-30 13:01 , Ian Goldberg wrote:
> On Mon, Sep 30, 2013 at 01:03:14AM -0700, Rohit wrote:
>> This should satisfy most goals.
>> - A passive attacker wouldn't be able to distinguish between HTTPS->HTTPS
>> traffic and Tor->Bridge. (Both use TLS)
>
> This seems false to me; it's not too ha
Hi,
I was thinking about proposal #203 (Avoiding censorship by impersonating an
HTTPS server) and have a few thoughts.
I'm not sure if I've understood how everything fits correctly but here goes:
For each bridge, we give their identity fingerprint and a shared secret along
with their IP address
