How does obfs4 work?

Question

First of all, I am already having a working setup of tor as a systemd service that uses obfs4, and using it as proxy by my applications like chrome and firefox, so this is not a question how to make tor work for me but rather how obfs4 works. I am in Egypt and could not initially make tor work since obviously the government is using some kind of advanced DPI that I couldn't even make my own openvpn server on 443/tcp port. All commercial vpns are blocked too. Tor itself cannot work unless with obfs3/obfs4.

My question is how obfs4 making my traffic look like it's not tor traffic? I want to know because I fear that if my traffic looks very suspicious, it's better for me to return to direct communication since I don't use tor for any illegal stuff anyway (just unblocking some important domains like medium.com and watching porn lmao). Does the traffic is analyzed as if it was some HTTPS connection or what exactly?

Answer 1

obfs4-spec does a pretty decent job explaining how it actually works. The idea is to make your traffic look like nothing in particular. I strongly advise you to read the spec (specially the Threat Model section).

Now about your question, it really depends on whether you are targeted by the government or not. Yes, one could argue that making a completely uncategorized traffic (from the DPI point of view), could be considered suspicious (but in that sense, so are any other non-plaintext traffic).

But here's my two cents: If you have reasons do believe that your life might be in danger because of it, I would just not use it.