How Tor Distributes Pluggable Transports Safely

Pluggable transports allow Tor users to disguise their traffic and bypass internet censorship, but delivering these private bridge addresses to users without alerting censors presents a major challenge. To prevent adversaries from harvesting and blacklisting every bridge, the Tor Project relies on secure distribution backends like BridgeDB and its newer system, rdsys (Resource Distribution System). Tor safely distributes pluggable transports by partitioning bridges into isolated pools, enforcing anti-scraping controls like CAPTCHAs and rate limits, and utilizing diverse communication channels including in-browser APIs, encrypted messaging bots, and dynamic proxy networks.

The Bridge Harvesting Dilemma

If Tor published a single public directory of all pluggable transport bridges (such as obfs4, Snowflake, or WebTunnel), censors could simply download the list and block every IP address on it. To prevent this, bridge distribution must be decentralized, rate-limited, and resilient against automated scraping.

Key Distribution Channels

Tor distributes bridge lines through several dedicated methods tailored to different levels of censorship:

• Moat (Tor Browser Integration): Built directly into Tor Browser, Moat allows users to request bridges with a single click. It communicates with Tor’s backend using domain fronting—a technique that disguises the request as ordinary traffic to major content delivery networks (CDNs)—and prompts the user with a CAPTCHA to verify they are human.
• HTTPS Bridge Database: Users can visit Tor’s bridge website to request bridge addresses. The service inspects the requester’s IP network and serves only a few bridges at a time, requiring a CAPTCHA to thwart automated scripts.
• Email Autoresponders (GetTor): Users can send automated emails containing specific keywords (such as “get transport obfs4”) to Tor’s email service. To prevent censors from generating millions of fake email addresses to harvest bridges, the system only accepts requests from trusted providers that enforce anti-spam controls, such as Gmail or Riseup.
• Messaging Platforms: Official Tor bots deployed on encrypted messaging platforms like Telegram provide an alternative distribution channel for users in regions where web and email access to Tor services is strictly filtered.

Anti-Harvesting and Defense Strategies

Tor uses several layered defenses to ensure bridge distribution remains secure:

• Pool Partitioning: The master bridge inventory is divided into distinct, non-overlapping pools assigned to specific distribution methods (HTTPS, Moat, Email, Telegram, and reserved manual distributions). If a censor manages to scrape all bridges available via email, the bridges distributed via Moat or Telegram remain untouched and operational.
• Subnet and Account Rate-Limiting: Distribution systems track requests by IP subnets and email accounts, strictly limiting the number of bridges a single entity can obtain within a given time window.
• Reputation-Based Assignment: The newer distribution engine, rdsys, can dynamically adjust distribution strategies based on bridge health and censorship events, reserving certain high-reliability bridges for manual distribution by trusted digital rights organizations.

Dynamic Ephemeral Transports

In addition to distributing fixed bridge IP addresses, Tor utilizes transports like Snowflake that bypass the need for traditional bridge distribution entirely. Snowflake pairs censored users with temporary, volunteer-run WebRTC proxies via a centralized broker. Because these volunteer connections last only minutes and change continuously, censors cannot block them through static IP harvesting.