Re: WireGuard with obfuscation support

[Bruno Wolff III <bruno@wolff.to>]

On Mon, Sep 27, 2021 at 12:34:39 +0500,
  Roman Mamedov <rm@romanrm.net> wrote:
>On Mon, 27 Sep 2021 02:11:30 -0500
>
>Don't over-estimate the resources available to DPIs, if there aren't easy
>ways to block, it might be almost as good as unblockable.
>
>And it is far from all cases that hiding traffic would result in bad
>consequences. Just hiding it enough so it evades the dumb automated filter,
>many people will thank you.

If someone is having their Wireguard traffic blogged, there is a good 
chance that they will be negative consequences to trying to evade the 
block. Just getting detected will often be enough to trigger these 
consequences, even if the traffic is getting through.

This isn't a simple problem. The assumption is that someone is seeing 
your network traffic and blocking it. They are still going to see it 
even if you disguise it. So you are going to need to disquise it as 
something that whoever is watching isn't going to care about. That 
is going to vary a lot depending on who is watching. You may also need 
to hide who you are communicating with. In some cases that will be even 
more important.

There are going to be a number of ways to detect Wireguard traffic and 
it is pretty unlikely that the bar for detection can be raised enough to 
be relevant with a few simple changes to the protocol.

This suggest that Wireguard is not the correct place to be doing these 
things. As suggested in another followup, this fits a lot closer to 
tor's mission and that would probably be a better place to look for 
help.