TL;DR
Tor’s anti-censorship team tracked intensified blocking in Iran and evolving filtering in Russia, and adjusted tools and distribution to keep users connected. Key upgrades in 2025 included Snowflake hardening, tests of domain-fronting options, Conjure development, WebTunnel fixes, and improvements to bridge distribution systems.
What happened
In 2025 the Tor Project focused its anti-censorship efforts on two acute environments: Iran, where an internet shutdown in June coincided with regional conflict, and Russia, where allowlist and address-based blocking increased. Tor used an in-region vantage-point monitoring network to collect real-time data, run automated domain-fronting accessibility tests, and select effective configurations. The team upgraded Snowflake — moving browser extensions to Manifest V3, improving NAT detection for better proxy assignment, enhancing standalone proxy metrics, and creating a Snowflake staging server for stress testing. Tor also advanced Conjure, a pluggable transport that leverages unused ISP address space and added multiple bootstrap methods (DNS and AMP-cache) plus additional transports (DTLS and prefix). WebTunnel received protocol-level fixes such as SNI imitation and safer certificate handling. Bridge distribution tactics shifted too: rdsys gained a staging server, and Telegram distribution was extended to include WebTunnel bridges to counter bulk listing by censors.
Why it matters
- Real-time local monitoring helps select obfuscation methods that remain reachable under active censorship.
- Technical upgrades to Snowflake and WebTunnel aim to make circumvention tools blend into common traffic and resist rapid blocking.
- Conjure’s use of transient or unused address space reduces the impact of address-listing-based censorship.
- Improved distribution systems and staging environments increase the chance that new anti-censorship features are stable on deployment.
Key facts
- In June 2025 Iran experienced intensified censorship and a multi-day internet disconnection during the Iran–Israel conflict.
- Tor operates an in-region vantage-point system inside Iran for more current censorship measurements than public datasets provide.
- An automated testing tool checked domain-fronting configurations for accessibility of Snowflake broker and Moat across vantage points.
- Snowflake received upgrades: browser extension moved to Manifest V3, better NAT checking logic, enhanced proxy metrics, and a staging server for stress testing.
- Conjure is a pluggable transport developed to limit the damage from bulk bridge-listing by leveraging unused ISP address space.
- Conjure’s Tor implementation added multiple registration/bootstrap methods (DNS and AMP-cache) and integrated extra transports (DTLS and prefix).
- WebTunnel was adopted widely in Russia; it received fixes including SNI imitation and non-WebPKI certificate support with certificate-chain pinning.
- Bridge distribution shifted tactics after censors listed many WebTunnel bridges; Telegram distributor support for WebTunnel was added.
- rdsys, Tor’s bridge distribution system introduced last year, gained a staging server to allow pre-production testing.
What to watch next
- Planned rollout of Conjure beginning next year (team plans to start distributing it to censored regions).
- Continued WebTunnel improvements and further hardening of Snowflake ahead of anticipated future censorship events.
- Exact timelines and regional rollout schedules for Conjure and other features are not confirmed in the source.
Quick glossary
- Snowflake: A Tor pluggable transport that uses short-lived volunteer proxies (often in browsers) to relay traffic for censored users.
- Conjure: A pluggable transport designed to reduce the effectiveness of bridge-listing blocks by using temporary or unused address space within cooperating networks.
- Domain-fronting: An obfuscation technique that makes traffic appear to be destined for high-profile domains to evade censorship that blocks based on destination.
- WebTunnel: A pluggable transport that aims to blend Tor connections into normal web traffic patterns to avoid detection and blocking.
- Bridge: A Tor relay not listed in the public directory, used to help censored users connect to the Tor network.
Reader FAQ
Did Iran cut internet access in 2025?
The source reports that in June 2025 Iran’s censorship intensified and the internet was disconnected for a few days during the Iran–Israel conflict.
What is Conjure and when will it be available?
Conjure is a pluggable transport that uses unused ISP address space and multiple bootstrap methods; the team plans to begin rolling it out next year.
Is distributing bridges via Telegram safe?
The source notes that Telegram distribution has been useful because censors find it harder to extract all bridges, but also cautions that Telegram may not be the safest place for sensitive communications.
Will Snowflake remain a primary tool in Iran?
The source says Snowflake is the most-used obfuscation tool in Iran and describes several upgrades to keep it accessible and resilient.
system 25d by meskio and shelikhoo | December 3, 2025 lead.jpg 960×540 149 KB From internet blackouts in Iran to Russia's evolving censorship tactics, 2025 has tested Tor's anti-censorship tools…
Sources
- Staying ahead of censors in 2025
- Staying ahead of censors in 2025: What we've learned from …
- Tor highlights evolving censorship evasion tactics during …
- Posts by 'shelikhoo' | The Tor Project
Related posts
- John Simpson: After reporting 40 wars, 2025 feels uniquely alarming
- Tor’s 2025 anti-censorship push: lessons from Iran and Russia
- Accused data thief threw MacBook into a river to destroy evidence