TL;DR
Tor's anti-censorship team reports adaptations made in 2025 to keep users connected amid intensified blocking in Iran and Russia. Key moves include upgrades to Snowflake, rollout plans for Conjure, improvements to WebTunnel, and changes to bridge distribution and monitoring.
What happened
In 2025 Tor’s anti-censorship team focused on countering intensified interference in Iran and evolving blocking tactics in Russia. In June, Iran experienced multi-day internet disruption amid regional conflict; Tor used an in-region network of monitoring vantage points to collect up-to-date data and to evaluate domain-fronting configurations. Snowflake — Tor’s widely used traffic-obfuscation proxy in Iran — received several updates: a browser extension upgrade to Manifest V3, improved NAT detection for better proxy assignment, enhanced proxy metrics, and a dedicated staging server for stress testing. Tor also developed Conjure, a transport that leverages unused ISP address space and multiple bootstrap methods (DNS and AMP-cache) and added transports such as DTLS and prefix to make connections harder to block. In Russia, WebTunnel was refined with features like SNI imitation and certificate-chain pinning; bridge distribution shifted toward tools such as a Telegram distributor and rdsys, which was hardened with a staging system.
Why it matters
- Improved obfuscation and varied transport options make it harder for censors to block individual connection methods.
- In-region monitoring provides faster, more accurate signals about which circumvention techniques are currently effective.
- Staging and automated testing reduce the risk of deploying changes that fail under real-world censorship events.
- Community contributors and local testers remain central to identifying workable tools for different censorship scenarios.
Key facts
- In June 2025 Iran saw intensified censorship and a multi-day internet disconnection during the war between Iran and Israel.
- Tor used an in-region vantage-point system to monitor censorship and to test domain-fronting configurations.
- Snowflake is described as the most used obfuscation tool in Iran and received upgrades including a Manifest V3 web extension and improved NAT checking.
- A staging server for Snowflake was created to stress-test features before deployment.
- Conjure is a pluggable transport that leverages unused ISP address space and supports multiple registration methods (DNS and AMP-cache).
- Tor integrated additional transports (DTLS and prefix) into Conjure to make traffic resemble common protocols.
- WebTunnel gained fixes such as SNI imitation and safe non-WebPKI certificate support with certificate-chain pinning to resist allowlist and rapid blocking tactics.
- Bridge distribution efforts shifted toward a Telegram distributor for harder-to-extract bridge lists and improvements to rdsys, including a staging server.
What to watch next
- Planned Conjure rollout starting next year and how widely it will be deployed across censored regions.
- Major Snowflake changes being stress-tested in the new staging environment and their effectiveness during future outages.
- How censors respond to expanded use of WebTunnel, Conjure, and Telegram-distributed bridges — not confirmed in the source.
Quick glossary
- Snowflake: A Tor pluggable transport that uses temporary volunteer-run proxies (often browser-based) to obfuscate traffic and help censored users reach the Tor network.
- Conjure: A pluggable transport designed to reduce the impact of address-based blocking by using unused address space and multiple bootstrap mechanisms.
- Domain-fronting: A technique that makes blocked traffic appear to go to a popular, hard-to-block domain so that censorship systems have difficulty distinguishing it from allowed traffic.
- Pluggable transport: A modular network component that modifies how traffic appears on the wire to resist censorship and improve reachability.
- SNI (Server Name Indication): A TLS extension that indicates the hostname a client wants to connect to during the TLS handshake; imitating or hiding SNI can help evade some censorship filters.
Reader FAQ
What is Conjure and why was it developed?
Conjure is a pluggable transport that uses unused ISP address space and multiple bootstrap methods to limit the damage of address-list based blocking.
What updates did Snowflake receive in 2025?
Snowflake received a Manifest V3 web extension update, improved NAT checking, enhanced proxy metrics, and a dedicated staging server for testing.
Is Tor using Telegram to distribute bridges?
Yes. Tor added support for distributing WebTunnel bridges via its Telegram distributor because censors have a harder time extracting bridges from it, though the platform itself may not be the safest place for sensitive communications.
When will these anti-censorship changes be available to users?
Tor plans to start rolling out Conjure next year and will continue improving WebTunnel and Snowflake, but precise timelines and region-by-region deployment details are not confirmed in the source.
system 25d by meskio and shelikhoo | December 3, 2025 lead.jpg 960×540 149 KB From internet blackouts in Iran to Russia's evolving censorship tactics, 2025 has tested Tor's anti-censorship tools…
Sources
- Tor staying ahead of censors in 2025
- Staying ahead of censors in 2025: What we've learned from …
- December 2025 Tor News
- The Tor Project: "In 2025, Tor faced some of the…"
Related posts
- Accused data thief threw MacBook into a river to destroy evidence
- NextDNS: My new favourite DNS service for privacy, blocking and speed
- China drafts rules barring AI clones that impersonate relatives for elders