I am trying to figure out what is the best way to hide Tor traffic in order to improve anonymity.
While Tor is pretty good at hiding users’ IP addresses, its traffic stands out. This can be detrimental in some cases.
In this article (FBI agents tracked Harvard bomb threats despite Tor), the perpetrator has been identified by matching the timing between Tor connections on Hardvard’s network and the email threats. Has he been able to mask the Tor traffic, he might not have been singled out as a suspect.
Some methods that have been proposed are:
Connecting to Tor through a VPN. Some well known companies such as ProtonVPN offer such service. However, adding a VPN increases the attack surface and ties billing information to the user. cf. Why is Home --> VPN --> Tor worse than Home --> Tor? Also, (to be confirmed), I think that a VPN won’t hide the fact that all Tor packets have the same known length, which can be a give away.
Using Tor bridges with obfsproxy. Obfuscated bridges are designed to circumvent DPI. While it is more difficult to detect with obfuscation, under manual inspection the traffic can still be recognized as Tor traffic. (Lightly explained here, so I wont dive into more details Different types of Tor bridges - implications for detection of Tor use )
For some people such as whistleblowers, journalists and activists, beind de-anonymized can be fatal. So when generating Tor traffic is suspicious, what is the best way to hide it?