Threat Model: Two Types of Discovery


In-Band: Censor becomes a client
Principle: No single client should ever know a large portion of the proxies.
Mechanism: Assign each client a unique set of proxies, require initial investment of resources to discover proxies.

Out-of-Band: Scan for proxies, traffic patterns, etc.
Principle: To an arbitrary Web client, a proxy should not appear to be a proxy.
Mechanism: Clients "hop" between proxies that serve them.