given that BridgeAuthority relay has information of all published (non-private) bridge relays, it could be used to compromise pluggable transport, is that the case?
1 Answer
Yes, the bridge authority or bridgedb knows all of the published bridges.
It couldn't really be used to "compromise" pluggable transports, but if a censor was able to recover the full list, it could try to block all the IP/Port combinations but it wouldn't last into the future. There are more effective and less risky censorship methods available to serious and well-funded censors.
Some pluggable transports use a different method of censorship evasion, like meek or snowflake. Instead of relying on not being a known address, they use domain fronting to masquerade behind popular CDNs.
This makes it costly for censors to block them even if the location is known since it is difficult to distinguish normal CDN traffic from that of the pluggable transport and the censor cannot inspect the traffic under TLS to determine where it is really destined. Outright blocking would break a lot of users web traffic and attempts to distinguish them would result in false positives and negatives.
-
1For the record, meek is trivial to defeat via statistical analysis with a very low false positive rate. Anyone that expects more than "defeats some lightweight automated analysis" out of any Pluggable Transport will be disappointed.– user78Commented Nov 17, 2017 at 6:32
-
Interesting, is this stuff documented anywhere? I'd love to know how pluggable transports really deal with real world adversaries' DPI. I guess such research is prohibitively expensive as it requires access to expensive DPI boxes though... Commented Nov 17, 2017 at 8:30
-
@YawningAngel yet it evades even the firewall of china(DPI) that used ML, and statistical analysis, it's the game of mice and cat of who gets the latest technology.– ErrorCommented Nov 17, 2017 at 8:39
-
and because it's economically prohibitive (collateral freedom)– ErrorCommented Nov 17, 2017 at 9:47