2015-frolov-the-use-of-tls

The use of TLS in censorship circumventioncore

Abstract

We measure how circumvention tools use TLS, identify divergences from real browser fingerprints (the "uTLS" project), and evaluate the detectability of these fingerprints by a passive observer.

Team notes

Origin of uTLS. Required reading for anyone touching Lantern's TLS- mimicking code paths. The "you must mimic Chrome's TLS fingerprint exactly" mandate that every TLS-based pluggable transport now follows comes from this paper.

Tags

censors
cnirru
techniques
tls-fingerprintdpitraffic-shape
defenses
mimicrymeekobfs4shadowsockstunneling
method
measurement-studyml-evaluation