An Evaluation of Snowflake as an Indistinguishable Censorship Circumvention Tool

Abstract

While absolute control of user activity has become infeasible, many forms of internet censorship are prevalent in authoritarian countries. The Tor network is a powerful tool for circumvention but is often detectable using deep-packet inspection. Pluggable transports address this attack by transforming the traffic between the client and the bridge. In this thesis, we evaluate Snowflake, a novel pluggable transport, as an indistinguishable censorship circumvention tool. Snowflake employs WebRTC, a popular suite of web frameworks and protocols, to establish a connection to the Tor network. We collect 865 instances of WebRTC from Snowflake, Facebook Messenger, Google Hangouts, and Discord and observe that Snowflake is identifiable among these applications with 100% accuracy. We show that several features of Snowflake’s WebRTC implementation, among them the extensions and cipher suites offered, are unique to Snowflake. Finally, we suggest recommendations for improving fingerprint resistance in Snowflake and future work to continue strengthening its implementation.