Different types of Tor bridges - implications for detection of Tor use

Question

I am trying to figure out the implications of using the different types of Tor bridges - such as meek, obfs4, etc.

My threat model: I am engaged in entirely legal, non-violent communications, but I am concerned about potential harassment from my nation state as I am an organiser. The government is known to be trying to track Tor usage. My primary concern is to avoid being flagged in dragnet surveillance by either my communications or by my Tor usage. I am not so concerned about targeted surveillance - if it reaches that point I will be harassed anyway.

In light of this, I had guessed that:

• Meek might be safest, since the connections are going to innocuous IP addresses associated with Google App Engine / Azure / Amazon.

• The recommended obfs4 transport would be less safe, since connections are going to IP addresses of bridges, which may be known to the surveillance agencies.

I'm aware that this might be a complete misunderstanding of these transports :).

Is this analysis correct? I can't find any information online re the relative safety of these transports in these terms, only a generic recommendation everywhere that "obfs4 is best." I would prefer obfs4 if possible, only because it is much, much faster, but thought I should check.

Answer 1

You have to understand that both transports have a different threat model than yours. They both address "blockability" while you need to address "detectability", or as meek's threat model docs put it: "observability".

You mention that:

My primary concern is to avoid being flagged in dragnet surveillance by either my communications or by my Tor usage

Hiding the fact that you're even using tor is much more difficult than hiding the content of your communications.

Both bridges (and tor bridges in general) try to achieve the same goal: to not be blocked by standard detection methods. None of them are listed in the main directory. From the tor docs on bridges:

Since there is no complete public list of them [the bridges], even if your ISP is filtering connections to all the known Tor relays, they probably won't be able to block all the bridges.

Using a bridge in your situation is better than not using it, but it might not be enough to hide the fact that you're using tor.

This are the protections offered by bridges:

1. Block by content: censor will not be able to see what the content of your communication is
2. Block by address: censor will not be able to know who you're talking to, or whether the other end is a TOR relay
3. Active probing: for obfs4 a probe would require the node ID and the public key, which can't be easily obtained because bridges aren't easily enumerable. For meek an active probe may be able to determine there's a domain-fronted relay, but not whether anyone communicating with the CDN actually used it.

They both try to provide some protection against fingerprinting of headers, traffic patterns, etc. But it's not their primary goal.

Even though with meek you're connecting to a CDN that's used by lots of sites, your traffic patterns may be very different from those of other users not accessing a tor bridge.

Also, with meek you mostly depend on HTTPS and its PKI. If your government controls a trusted CA you will have to take extra care of not being MITMed on your way to the domain front. This might mean removing their CA from your trust store, and doing that might give away that you're doing something private.

Conclusion

Both bridges will offer you similar protection, but they aren't specifically designed for your problem (hiding the fact that you're using a private communication channel).

They do, however, hide that fact from most automated detection tools, because that's a precondition to bypass blocking.

This might be enough for your case, but be very careful and implement additional measures where possible.