Running a Tor Bridge recommends using port 443 and even when running a bridge using a pluggable transport an open (non-transport) bridge port seems to be required.

Assuming someone runs obfs4 and a censored user connects to it. A system like the Great Firewall would probably not be able to find that the user connects to the Tor network by just looking at the traffic, but it could easily scan for the non-pluggable transport on port 443 or a predefined range. These days there are really efficient tools to do such scans on a very large scale. An attacker using a certain rule set to determine whether such an attack is feasible/the use of Tor is likely could reduce the resources required for such an attack.

My question here is whether this is correct and if so whether there are plans to mitigate such an attack.

1 Answer 1


Yes, the issue you're describing is a real issue and has been thought about a lot before. The suggestion to use port 443 has been removed due to your question, now the suggestion is to use a random port. This is not a real solution of course.

Suggested solutions are putting the orport on a different IP and changing the pluggable transports/bridge infrastructure to not require the bridge to expose the tor protocol on any port. Additionally supporting IPv6-only nodes in the Tor network would help with reducing scanning possibilities. Related Tor bug reports seem to be https://trac.torproject.org/projects/tor/ticket/14579, https://trac.torproject.org/projects/tor/ticket/14581, https://trac.torproject.org/projects/tor/ticket/9498

  • 2
    trac.torproject.org/projects/tor/ticket/7349 is the ticket you are looking for. It's tricky because it requires changes to hwo the Bridge Auth. decides how Bridges are running (and there's even better ways to enumerate bridges than looking for the ORPort).
    – user78
    Commented Apr 25, 2015 at 7:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .