Obscura: Enabling Ephemeral Proxies for Traffic Encapsulation in WebRTC Media Streams Against Cost-Effective Censors
Authors: Afonso Vilalonga (Universidade NOVA de Lisboa & NOVA LINCS), Kevin Gallagher (Universidade NOVA de Lisboa & NOVA LINCS), João S. Resende (INESCTEC, Universidade do Porto), Henrique Domingos (Universidade NOVA de Lisboa & NOVA LINCS)
Volume: 2026
Issue: 1
Pages: 583–603
DOI: https://doi.org/10.56553/popets-2026-0030
Abstract: Recent research on online censorship has provided valuable insights into common censorship strategies and censors' tolerance for collateral damage. A consistent finding across these studies is that censors tend to favour cost-effective techniques such as proxy enumeration, active probing, and deep packet inspection (DPI), rather than more complex and non-deterministic methods such as deep learning-based traffic analysis. For example, a recent study on the Snowflake censorship evasion system reinforced this finding by demonstrating that authoritarian regimes primarily relied on DPI to target the system. However, as censorship techniques continue to evolve, two critical questions arise: (1) What future attack vectors are likely to emerge based on current research and observed censor capabilities? (2) How can these emerging threats, along with previously utilised censorship methods, be effectively mitigated? In this paper, we present Obscura, a censorship evasion system designed to resist cost-effective, historically grounded censorship techniques while also defending against a class of plausible future attacks within a cost-effective threat model targeting WebRTC-based censorship evasion systems. Obscura is built upon four core features: (1) encapsulation of traffic within WebRTC media streams, (2) the use of a reliability layer, (3) support for both browser-based and Pion-based clients and proxy instances, and (4) the use of ephemeral proxies. Each feature is intended to mitigate either a known attack observed in the wild or a theoretically plausible attack consistent with the capabilities of a cost-effective censor. We provide a security analysis to justify our design choices and a performance evaluation to demonstrate that Obscura maintains reasonable throughput for typical online activities.
Keywords: Censorship Evasion, WebRTC, Ephemeral Proxies
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution 4.0 license.
