14

The Tor Project's official guide is available here. It has instructions on how to set up an obfs4 bridge for several platforms, including Debian and Ubuntu. Don't forget to make sure that your OR port and your obfs4 port must be publicly reachable. Tor automatically tests its OR port but it currently (as of August 2019) does not test its obfs4 port. You can ...


11

The pluggable transport bundles include FlashProxy and Obfsproxy, to let users get around censors who are trying to block access to the Tor network. You can read more about pluggable transports here: https://www.torproject.org/docs/pluggable-transports.html.en The pluggable transport bundles come pre-configured with a handful of bridge addresses, which is ...


7

The Tor Project Wiki has a good article covering this: A Childs Garden Of Pluggable Transports. The pluggable transport is used as a proxy for tors traffic, it provides an extra layer of transformation that exists around the core OR protocol traffic to mask it from censors or eavesdroppers trying to discover it's true nature. In truth, pluggable transports ...


5

To connect using Pluggable Transports as a client, you need to know about at least one bridge relay that offers this particular pluggable transport. This list of bridges is not public, because that would make them trivial to block - directly working against the point of having bridges in the first place. If you connect to the Tor network directly, you don'...


4

This is rather a non issue, I think. People typically use bridges when their Internet uplink (ISP, university, employer, etc.) blocks access to known entry guards. This may be part of national policy, as with China, Iran, etc. Savvy adversaries monitor public lists of bridge IPs, and so the Tor Project distributes them via email. This is not a perfect ...


4

Tor Pluggable Transport bundles are the new name for the old 'Pyobfsproxy/Flashproxy' and 'Obfsproxy' Tor Browser Bundles [1]. The PTB's include the python version of obfsproxy (not the old C version), and include more transport modes (see below). The overall idea behind the PTB's attempt to disguise Tor traffic to look like traffic from other common ...


4

I've built meek-client for RPi and RPi 2 at here, and I altered the provided install script a bit at here to automatically install meek-client and use meek-amazon. Install via curl -fsSL https://raw.github.com/bbs4us/onion_pi/master/setup.sh | sudo bash


4

Great explanation, it helped me a lot. Like to add the following; These days I do not see a lot of obfs4 traffic yet. If you want to publish as an obfs3 AND obfs4 bridge relay you can change the line ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy to ServerTransportPlugin obfs3,obfs4 exec /usr/bin/obfs4proxy You only need to install obfs4 as ...


3

TOR cell size is 512 bytes but most TOR packets have size of 586 bytes. My question is that why there is such difference in size (74 bytes difference)? The 586-byte packet being referenced in the papers is Tor's 512-byte cell wrapped in the headers of three different protocols: TLS, TCP, IP. In my set up, using Wireshark, I'm seeing lots of outgoing ...


3

Seems like you've failed to launch obfsproxy application. I suggest you to download a fresh copy of Pluggable Transport, verify it's signature, get some obfs3 bridges from BridgeDB (as described here), add them to Vidalia and relaunch PT Bundle. You may want to open a ticket or email help@rt.torproject.org if you keep getting that error.


3

When ignoring the factors pointed out in alaf's comment, we are left with the actual protocol differences. The obfs3 protocol has both fairly low computational and communication overhead. The computational overhead stems from the use of AES-CTR-128 which wraps Tor's already-encrypted network traffic. The communication overhead is caused by the variable-sized ...


3

There is no absolute answer to this question. Your browsing experience, meaning mostly the lag to open or browse a web service, is depended on the resources of the obfuscate bridge you connect to. We can assume with fair certainty that some obfs bridges have more resources than other. What's more, your experience will vary due to variance of usage of the ...


3

Tor doesn't officially support overwriting one bundle with a newer version. Overwriting with a different sort of version or overwriting a 2.x version with a 3.x version is even more likely to lead to problems. Tor tends to update the “vanilla” Torbrowser bundles first then release PT bundles a little later. Since most Torbrowser updates are security and bug ...


3

Today, Tor is moving away from looking like TLS, with pluggable transports being the solution for censored users. Tor is moving to using stronger cryptographic primitives so looking like a browser is no longer the goal. Detecting Tor relays not behind pluggable transports is relatively straightforward. One of the ways is doing what you describe.


2

Fingerprint is not necessary here. Just type obfs3 ip:port and it will work. The "bridge" will be added automatically for each bridge and you might just keep it as it is. When the format isn't correct, you'll see warning messages in Tor log.


2

From my point-of-view, torsocks and using TransPort selectively for some applications (e.g. like Mike's suggested setup for Android) is quite equivalent. Two key differences, though: torsocks will take care of DNS leaks, so extra care is needed when using TransPort. torsocks 2.0 will take care of filtering and blocking some network system calls. Again, it ...


2

How about bitmessage? https://bitmessage.org If Tor gives a bitmessage address to request bridges like how it is done in email. Bitmessage is said to be encrypted P2P messaging protocol but it is still running in beta stage.


2

You need Pluggable Transport bundle to use obfuscated bridges. And you seems like using non-pt bundle (no yet 3.5.2-pt built).


2

The attacker wouldn't be able to find you if nobody tries to connect to your ORPort. If you didn't publish the bridge descriptor, nobody will know your ORPort.


2

Probably has something to do with the GFW admins deploying something like this fairly recently described classifier. All the current obfuscators seem to fall to entropy distribution, header length, and decision tree-based machine learning attacks with very low false-positive rates. https://dl.acm.org/citation.cfm?doid=2810103.2813715 Also, this written by ...


2

All of the valid config options are detailed in the Tor config manual. It'd probably be quicker for you to read that than for us to enumerate each of the options included in your question. What if I do not want IPV6? Can I change that line - and if so, to what? Remove the IPV6 options. They are only set if they are included at all. For reference, here'...


2

it looks a version mismatch/conflict. It happens when you have an old version of package from your OS package manager and a new one installed otherwise in another location


2

obfsproxy should be setup inside of torrc if you wish to use it with tor, it shouldn't be executed seperately. The managed flag indicates that the opening process will be "managing" it, in this case the opening process is your shell and it's not providing the required configuration parameters. The process for adding obfs3 bridges is outlined in this answer: ...


2

The meek servers are distributed with Tor Browser. The point of meek is to be difficult to censor not because the bridges are hard to find but because they're hard to distinguish from other traffic. You might have luck requesting meek bridges from BridgeDB but it's not the most common transport, since it's only effective if there are other types of traffic ...


2

What numbers to choose for OR and obfs4proxy ports? For an obfs4 bridge I'd recommend: Picking a low numbered port that's used by a common service for obfs4 (it takes a few extra steps to allow obfs4 to bind to low ports) might help some user (and may hinder others, e.g. if their DPI reasons: "I know that obfs4 traffic definitely isn't the service that ...


1

It is just normal. It means Tor client did not finish fetching consensus, and as soon as it finishes, it starts to build circuits.


Only top voted, non community-wiki answers of a minimum length are eligible