obfs4 VS bbs

https://blog.torproject.org/tor-heart-bridges-and-pluggable-transports/ https://github.com/Yawning/obfs4/

Folks interested in the state of the art of this kind of DPI evasion might want to check out [obs4](https://github.com/Yawning/obfs4), which is a "look-like nothing obfuscation protocol", and the [default pluggable transport](https://support.torproject.org/glossary/obfs4/) for connecting to tor bridges from places where tor is blocked.

See Tor Project old 2019 site → Documentation—"This website is an online archive and it's outdated! Some resources you will find here are outdated." → Expert Guides → Understanding Bridges → Tor: Bridges Tip:...Click here for more information → Pluggable Transports...Tor introduced pluggable transports → Tor: Pluggable Transports → List of PTs organized by status → obfs4 and Evaluation: obfs4 Evaluation.

The meek bridge is a function provided by obfs4 plugin. The file named obfs4proxy included in the Tor Browser package is this plugin.

Scenario #2 - You are using a bridge and trying to connect an allowed IP, but failing to handshake. Perhaps IP traffic is being snooped and dropped as its seen as "Tor traffic". Others can correct me, but I think obfs4 is still the best way to try and avoid this: https://github.com/Yawning/obfs4

While the authors of the most definitely didn't handle this well, I'd argue it's a pretty severe weakness and the tool shouldn't have been released in this state. Active probing has been observed in the wild [1] and pretty much all tooling in the space handles it in their threat model [2], so its naive to not consider it.

I get why the signal team wanted something to use HTTPS, even networks with completely insane firewalls accept it and they get to reuse existing domain fronting code, but existing tools continues to viable in Iran and would have made much more sense in the circumstances.

[1] https://blog.torproject.org/learning-more-about-gfws-active-...

[2] https://github.com/Yawning/obfs4/blob/master/doc/obfs4-spec....

https://github.com/net4people/bbs/issues/63

People should be aware that privacy tools can make you stand out. Unless methods are used to obfuscate your data.

I never trusted Signal due to https://github.com/net4people/bbs/issues/60

VPNs are totally detectable - its your traffic eg what ur searching up that is hard or impossible to decrypt. to make the VPN TRAFFIC itself undetectable, you have to obfuscate it. Now there could be a lot of reasons as to how your school blocked your vpn. The ports expressvpn use may have been blocked, for example. I personally don't use express vpn but use my own, but protocols like wireguard which MAY (im not sure) be used by express vpn use udp packets and the school could have just completely dropped them completely (Most games use udp packets since its faster), or the ip ranges you have been assigned on expressvpn may have just been blocked from the school wifi. As for why the cheap free vpn may be able to bypass your school wifi, it could be that it avoids the reasons above OR its something different like a proxy, which is what I use to bypass the restrictions at my high school. The fix, or what I do, is I setup my own servers. The price of a vps server at digital ocean is like 4 dollars a month, probably around the same price if not cheaper than expressvpn. Get yourself one, setup your own proxy server and connect to that. You can search around for tutorials, but the one I use is VMESS+TCP, essentially disguising the proxy traffic as a tcp packet so that the school can't distinguish it from regular traffic. Find a tutorial online, probably ask around on here: https://github.com/net4people/bbs If you followed a guide and still can't get it to work, your gna have to find an unblocked port. I would try 443 or 123 first since usually those aren't blocked but for my school 3478 is the one that works.