|
| ▲ | tptacek 5 hours ago | parent | next [-] |
| It's trivial to make WireGuard look like a regular TLS stream. It's probably not worth a 15 year regression in security characteristics just to get that attribute; just write the proxy for it and be done with it. It was a 1 day project for us (we learned the hard way that a double digit percentage of our users simply couldn't speak UDP and had to fix that). |
| |
| ▲ | eptcyka 4 hours ago | parent | next [-] | | It is, we did the same. It is a shame that only Linux supports proper fake TCP though. | | |
| ▲ | coppsilgold 4 hours ago | parent [-] | | Doesn't the Chinese firewall perform sophisticated filtering? Fake TCP should not be difficult to catch. I recall reading how the firewall uses proxies to initiate connections just to see whats up. | | |
| |
| ▲ | mmooss 4 hours ago | parent | prev [-] | | I don't suppose you'd release it, please? | | |
|
|
| ▲ | gruez 5 hours ago | parent | prev | next [-] |
| >OpenVPN looks like a regular tls stream - difficult to distinguish between that and a HTTPS connection. I thought openvpn had some weird wrapper on top of TLS that makes it easily detectable? Also to bypass state of the art firewalls (eg. China's gfw), it's not sufficient to be just "tls". Doing TLS-in-TLS produces telltale statistical signatures that are easily detectable, so even simpler protocols like http CONNECT proxy over TLS can be detected. |
|
| ▲ | cyberax 4 hours ago | parent | prev | next [-] |
| Raw OpenVPN is very easy to distinguish, its handshake signature is very different from the regular TLS. OpenVPN is fine if you want to tunnel through a hotel network that blocks UDP, but it's useless if you want to defeat the Great China Firewall or similar blocks. |
|
| ▲ | randomstuffs 3 hours ago | parent | prev [-] |
| [dead] |
