[tor-dev] Building better pluggable transports (Google Summer of Code)

[adrelanos]

Tom Ritter:
> On 28 May 2013 14:51, adrelanos <adrelanos at riseup.net> wrote:
> 
>> How good are SSH connections with hiding what's inside?
>>
>> Website fingerprinting has demonstrated, that SSH connections may hide
>> communication contents, but which website was visited, could be guessed
>> with a fairly good results.
>>
>> Tor isn't a website, but if SSH leaks which website has been visited
>> even when using a SSH tunnel, will it also leak the fact, that someone
>> is using Tor through a SSH tunnel?
> 
> 
> I think that if we make the adversary upgrade from probing and byte
> matching (e.g. look for specific ciphersuites) to statistical protocol
> modeling, especially with a small time investment on our part, we have won
> a battle.  Development effort isn't free.
> 
> You probably can detect Tor traffic inside of SSH with some probability X
> after some amount of traffic Y.  But what X, what Y, and how much effort on
> behalf of the adversary will it take?  I don't know, but I do think we
> should work to move the fight beyond something as simple as byte matching.

Yes. Don't let me put off this idea. It was just a wild guess. Most
likely an ssh transport will always work for a few people and that
already an improvements. The more pluggable transports, the better.
Maybe if there are enough transports, the other side just gives up.