Getting onto the Tor network is now, for much of the world, the hard part. The relays have not changed much. The fight has moved entirely to the first hop — and it has become a contest over whether encrypted traffic can be made to look like nothing at all.

Blocking Tor is easy. That is the problem.

The list of Tor relays is public by design — that transparency is part of what lets the network be audited and trusted. It also makes the network trivial to block: a censor downloads the public relay list and null-routes every address on it. For a national firewall, this is a cron job.

So the interesting engineering is not in the relays anymore. It is in bridges: unlisted entry points that are not in the public directory, distributed in small batches so a censor cannot simply enumerate and block them all at once. Bridges are how someone behind a national firewall reaches Tor in the first place.

Pluggable transports: making traffic disappear

Knowing a bridge address is not enough if the censor can recognize Tor traffic by its shape. Modern censorship does exactly this — deep packet inspection that fingerprints the TLS handshake Tor uses. The counter is a layer called pluggable transports, which wrap the connection so it does not look like Tor:

  • obfs4 makes the stream look like uniformly random bytes, with no recognizable protocol signature. Effective against fingerprinting — though "random-looking traffic to an unknown host" is itself a signal a sophisticated censor can flag.
  • meek uses domain fronting: the connection appears to go to a large cloud provider the censor cannot afford to block wholesale. Powerful, but cloud providers have steadily disabled fronting, so its reach has narrowed.
  • Snowflake is the clever one. It routes you through ephemeral, volunteer-run WebRTC proxies — the same protocol video calls use. Blocking it means blocking WebRTC, which means breaking video conferencing for the whole country. The proxies are so short-lived and numerous that there is no stable list to block.

The pattern across all three is the same: the goal is no longer to hide that you are encrypting, but to make your encrypted traffic indistinguishable from traffic the censor cannot afford to lose. That is the whole game now — raising the collateral cost of blocking until it exceeds the political will to block.

Why this matters even if you never touch a censored network

  • It is the clearest live example of the detection–evasion arms race. The techniques censors use to fingerprint Tor are the same techniques your DPI-based security tools use to fingerprint command-and-control traffic. Watching this fight teaches you what your own detection can and cannot see.
  • Domain fronting cuts both ways. The same trick that helps activists reach Tor is used by malware to hide command-and-control behind reputable cloud domains. If you defend a network, understanding fronting is understanding a real exfiltration channel.
  • "Looks like nothing" is the future of both privacy and evasion. Traffic-shape indistinguishability is where both sides are investing. Whether you are protecting a journalist's source or hunting an intruder, the ground truth is the same: raw encryption is no longer enough to hide, and no longer enough to catch.

A note on running proxies

Running a Snowflake proxy is one of the lowest-effort, highest-leverage things a privacy-minded technical person can do. It is a browser extension or a container, it carries no exit traffic — so none of the legal exposure of an exit relay — and it directly helps someone reach an uncensored internet. Understand your own jurisdiction first, as always, but the risk profile of a Snowflake proxy is about as gentle as meaningful contribution gets.

The relays are the part of Tor everyone pictures. The bridges and transports are where the actual fight is — and it is a fight about whether traffic can be made to vanish into the noise.

That is a fight worth understanding from both sides of the wire. The defender who understands how activists evade a national firewall is the same defender who will recognize the technique when it shows up on their own network, pointed the other way.