2

I'm actually in a country that blocks many services: the only way to access them is tor (or use VPN).

The only way to use tor is obfsproxy bridges or meek.

Unfortunately, both the options are very unstable/slow ... ... so I wonder if it is possible to use them together in order to improve performance.

Improve this question

2 Answers 2

Reset to default
1

You can! Tor's source code patch required - as I did it at first, but there is an easier way to do so, I've figured it out and it is literally zero-patch one! You'll need three Tor instances running locally on the very same host:

  • An Obfs4 one - it will connect through OBFS4 and will have it's ORPort exposed in an isolated environment
  • A Meek one - it will connect through OBFS4 and will have it's ORPort exposed in an isolated environment
  • A working one - it will connect forcibly through the ones above only and will provide you the connectivity
Improve this answer
0

Unfortunately, the answer to this is "no" – the two bridge methods provide more secure ways of entering the tor network and fundamentally work differently. Obfs4proxy is designed to make traffic look like encrypted web traffic, known as SSL, and alters the statistical properties of the traffic as a result. The path your data takes when using obfsproxy looks a bit like this (sorry for the awful diagram!)

 OBFSPROXY CASE
 +--------------------------------------------------------------+
 |                                  +----------|                |
 |   Your Computer                  |Tor node+--------->Internet|
 |         +                        +--------> |                |
 |         |                        +v-----|   |                |
 |         |                        |  |---->  |                |
 |         v                        +----------+                |
 |   Obfs4proxy server+----------->   Tor node                  |
 |                                                              |
 +--------------------------------------------------------------+

In other words, the obfs4proxy server just acts as a bridge to the tor network. That's why they're called bridges – the network itself does its onion routing thing, and then directs your data to its destination, be that an onion site within the network or an external webserver.

Meek works differently, using a technique called domain fronting to make it appear that you are connecting to one website in particular -- nowadays, Microsoft Azure alone. So, the diagram looks a bit different but the concept is the same:

MEEK-AZURE CASE
 +--------------------------------------------------------------+
 |                                                              |
 |   Your Computer                  +----------|                |
 |         +                        |Tor node+--------->Internet|
 |         |  +------>+             +--------> |                |
 |         |  |       |             +v-----|   |                |
 |         v  +       |             |  |---->  |                |
 |   Microsoft Azure  |             +----------+                |
 |                    +------------->Tor guard                  |
 +--------------------------------------------------------------+

Note that the difference is with meek you don't actually connect to Azure, really, unlike with obfs4proxy. So it's much more censorship resistant, but because of these single links, unfortunately is really quite slow. They are very hard to block though. Signal uses this technique in China, and there's a good explanation of how it works here: https://securityaffairs.co/wordpress/54659/digital-id/signal-domain-fronting.html

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .