Re:Detecting Tor Communication in Network Traffic
by nitrogen on Saturday April 06, 2013 @07:24PM
(#5505448)
Dead comment from h72a (brand new account; possibly double-posted and deleted the wrong one?):
h72a 14 minutes ago | link [dead]
Tor's TLS handshake exhibits a number of peculiarities which distinguishes it from HTTPS. The cipher list inside the TLS client hello used to be a (almost?) unique (see http://www.cs.kau.se/philwint/static/gfc/ ) and the SNI contains a random bogus domain.
h72a 14 minutes ago | link [dead]
Tor's TLS handshake exhibits a number of peculiarities which distinguishes it from HTTPS. The cipher list inside the TLS client hello used to be a (almost?) unique (see http://www.cs.kau.se/philwint/static/gfc/ ) and the SNI contains a random bogus domain.