[tor-talk] What is being detected to alert upon?

[Philipp Winter]

On Thu, Apr 30, 2015 at 02:20:34PM -0400, Frederick Zierold wrote:
> Thanks for replying.  I understand it is a spy vs spy type of situation but
> what do they see currently?  I don't believe they are seeing it by the IP
> addresses (or so they claim).
> 
> Is it something in the handshake the is triggering the alert?

Here's how the Great Firewall does it:
<http://www.cs.kau.se/philwint/gfw/>

And here are some thoughts on TLS handshake signatures that can be used
to fingerprint traffic:
<https://trac.torproject.org/projects/tor/wiki/org/projects/Tor/TLSHistory>

Cheers,
Philipp