> analyzing how much data flows in which direction and when
Encapsulated TCP SYN packets, for example, smaller than any HTTP request inside TLS would be.
Want to beat that by padding? Everything always being the same size is an anomaly too.
Encapsulated TCP SYN packets, for example, smaller than any HTTP request inside TLS would be.
Want to beat that by padding? Everything always being the same size is an anomaly too.
How else do they figure it out? My mind jumps directly to funny traffic patterns like a single person using the domain or maybe a non-normal looking website that doesn't serve static assets to non-vpn users or other normal things, etc. Can they probe the server somehow and and figure out it's a vpn?
Does the user need to visit other sites unrelated to the vpn in order to mask their own usage and appear normal?
Only makes sense if you are doing it for a bunch of people and at that point you are another VPN provider.