Why couldn’t a country just block the broker IP since it is well-known? The answer is a technique called “domain fronting.” The details of domain fronting can be found elsewhere, but in brief, domain fronting lets the client make a request that looks like an ordinary web request for, and thanks to HTTPS the request is able to hide its “Host” header which is actually for an arbitrary web service hosted on Google’s cloud. The obvious weak point here is the broker server. If you are ready to get started you can install the Snowflake browser add on, or if you run a server you can run the standalone version written in Go.

Now, thanks to a new pluggable transport called “Snowflake,” anyone can run a pluggable transport in their browser with just a couple of clicks and help people all over the world access the unrestricted internet. In the past, running a pluggable transport was difficult to set up, requiring a server and a good deal of time and technical knowledge. To deal with this, Tor has a clever solution called “pluggable transports.” Pluggable transports disguise your Tor connection as ordinary traffic to a well-known web service such as Google or Skype, and smuggles your Tor connection inside of the seemingly innocuous traffic. Bridge connections can also be identified (or “fingerprinted”) as connections to the Tor network by an ISP using deep packet inspection.

Of course, ISPs in countries where Tor is banned are constantly trying to find the IP addresses of bridges and block them to prevent people from accessing Tor. The number of bridge users in Iran grew exponentially in the last week of September 2022.

Skype logo gray