How would a resourceful government block Tor?

Tor is used to circumvent censorship!

No, not directly. Tor is about anonymity, not about availability. Tor alone does not help its users access blocked content. Tor helps by making it hard to link clients with site visits, so that people can publish or read content without being identified. It's used to avoid being caught in relation to banned content, not directly to spread banned content.

A government that controls all the network equipment of ISPs in the country can decide which websites and services residents are allowed to access, and can know who is accessing what. If someone is using Tor, their computer makes connections to hosts that offer Tor services (Tor relays). The ISP-level filter can detect whether the target of the connection is a Tor relay and deny it if it is.

A tool that directly helps circumvent censorship is a VPN. The ISP-level filter can block connections to a VPN, but only if it knows that the service is a VPN. Tor relays are for the most part public and have to be part of a heavy infrastructure (they have to be known from other Tor known). On the contrary, a VPN operates on its own, so it's very easy to create new ones: blocking VPN altogether is practically impossible (blocking all encrypted protocols does block most common VPN, but it's still possible to make a low-bandwidth VPN using steganography if nothing else).

VPN and Tor can of course be combined (and frequently are). An ISP can block direct use of Tor, but cannot block the use of Tor through VPNs. There even exist VPN-like services specialized to use Tor: Tor bridges. There's an arms race here where the ISP/government can block Tor bridges as they discover them, but new bridges can pop up easily.


France is going to ban Tor

No, that's not what the original article says and that's not what the THN article says either. The original article says that the police administration (not the goverment) has requested a huge array of measures of varying realism, including banning Tor. Even the article you cite claims that this request is a legislation proposal (which it isn't yet), not a law about to take effect.


In order to block Tor, all that has to be done is have the current list of Tor nodes which can be found at the following link:

http://torstatus.blutmagie.de/ip_list_all.php/Tor_ip_list_ALL.csv

and then block them bi-directionally via the Routers or Firewalls.

That said there will be numerous ways around such efforts, people can still use VPNs to connect outside of a given area and then run the Tor traffic from another location or tunnel the traffic through, but this will effectively block many of the less technical people from accessing Tor.

Similarly, the following list of Tor exit nodes could be useful for blocking Tor traffic from connecting to any given websites: https://check.torproject.org/exit-addresses

I would say it's easy to make Tor hard to use but that it's extremely hard to make it impossible to use.

Keep in mind that governments with large financial resources can spend money to run tools like ZMAP.io to find potential Tor servers, including Tor Bridges, minutes after they are started. Continuously scanning the entire IPv4 address space has become trivial for those with even a small budget so a campaign to find and block Tor nodes could easily be very effective, but it will never be absolute.

Finally, keep in mind that once Tor users have been identified the government would likely monitor future connections by that user to locate new Tor bridges or similar connections.

Note: The task of scanning IPv4 has become trivial but the process for scanning all of the public IPv6 address space would be radically unmanageable due to the scale. That said a large government project correlating other types of data such as Netflow, some type of traffic signatures, or some other form of identification would be required to identify and block Tor traffic on IPv6 networks.

Again governments can make Tor hard to use but that it's extremely hard to make it impossible to use.

It should be further noted that governments also leverage additional tactics to identify anonymous users. To protect end-users from risks related to cookies or other signatures which may give away additional information about Tor users it may be wise to use an anonymous live CD such as the following:

https://www.whonix.org/

https://tails.boum.org/

Torflow visualization may also be of interest:

https://torflow.uncharted.software

Related article: 81% of Tor Users Can be Easily Unmasked By Analyzing Router Information

http://thehackernews.com/2014/11/81-of-tor-users-can-be-easily-unmasked_18.html

Another related article about a much more dangerous but related issue: Tor Browser Exposed

https://hackernoon.com/tor-browser-exposed-anti-privacy-implantation-at-mass-scale-bd68e9eb1e95


Tor will be actually quite hard to block because of tor bridges:

Bridge relays (or "bridges" for short) are Tor relays that aren't listed in the main Tor directory. Since there is no complete public list of them, even if your ISP is filtering connections to all the known Tor relays, they probably won't be able to block all the bridges.

To ban Tor altogether, France will need to perform deep packet inspection (similar to Chinese firewall), but even such measures could be defeated by specialized tools like Obfsproxy. What effectively keeps people in China from using Tor is the threat of a prison sentence; I hope France will not go this way.

Also, I don't quite understand how banning Tor would hurt the terrorists, since there are countless options which allow them to stay under the radar. They could happily switch to OwnCloud or a similar service which cannot be blocked as a whole. Or they could communicate via GMail by sending encrypted 7zip attachments. Etc.

Keep in mind that France has just been through regional polls, and announcements like this one spawn in election time like mushrooms after a summer rain.