1

i need to use tor under tight DPI censorship situation. I need to be able to hide the fact i'm using Tor both from my gvt's DPI GFW and from my ISP. The only way for me to get Tor working is through the meek_azure bridge (as long as it lasts) or an obfs4 bridge. These supposedly wrap my SSL traffic in a http layer, right, allowing my to bypass the GFW.

Now: how good this really is for hiding me using Tor? 1. how can i be sure the entry node or bridge isn't malicious ? And if it is, what information can it get ? Just my ip address ? 2. what information my ISP or GFW can get when connecting by meek or obfs4. How can i be sure they really don't know this is hiding Tor traffic? 3. if i wanted to be sure, should i use a VPN before connecting to Tor? Are there obfuscating VPNs? 4. Is there a way to obfuscate my real ip from my ISP (by spoofing)?

What would be the best settings possible for my scenario ?

Improve this question

3 Answers 3

Reset to default
0

Obfs4 is pretty resistant against detecting and blocking. Of course government can run bridges and distribute them using tor project mechanisms, they will get your IP address.

VPN do not add additional defense against government, they simply request information from VPN provider. It can only delay action against you.

Improve this answer
0

GFW already knows where the obfs4 bridges are, so their IP addresses are blocked. You MIGHT be able to get Tor to work with a private obfs4 bridge, i.e., a bridge you build yourself on a VPS, and which is not listed in the bridge directory.

The ISP and GFW see only your own IP address and your bridge or entry node. They do not know what the final destination IP address is. Also, your data sent and data received is encrypted.

You can never hide your own IP address from your ISP.

As you say, meek_azure is the last meek that still works.

You should be able to get Tor through SSR to work. But in this case, you might find that SSR alone meets your needs.

Improve this answer
2
  • thanks for the info. So basically it's a cat and mouse game. I can never hide my ip from my ISP and the DPI blocks more and more of the obfs4 bridges when they're becoming known as such. In order to get one working obfs4 bridge, there's a bunch that don't (guess their cover got burnt). Problem is, i can't know that on forehand and as such I'm probably alerting both the ISP and the DPI that indeed I'm trying to connect to a Tor obfs4 bridge, which I find alarming. How can i SAFELY and ANONYMOUSLY connect to obfs4 bridges ? Ps: what's SSR ?
    – istackexchange
    Commented Sep 29, 2018 at 8:16
  • SSR is ShadowsocksR. It is a common method of jumping the wall. There’s also a newer one called V2Ray. cinsmi.github.io
    – jfl
    Commented Oct 1, 2018 at 2:49
0

  1. Don't even think unless you have full control over them. I have posted a question on this, but there is no answer yet.

  2. It's difficult to answer. They can see very few things (two endpoints of a quirky encrypted connection) directly, but by using some statistics they might be able to figure a lot. Again, you can't be sure. You know (or not), The Parrot is Dead.

  3. I would say no under most threat models. Wrapping random-looking bytes again through another provider doesn't make much sense. There are obfuscating VPNs like VyprVPN or ... just OpenVPN over obfs4 (self-defeating like ever).

  4. No. You simply can't do anything against those who provide you with Internet access.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .