FINDING · DETECTION
Balboa's synchronous leaf-content replacement adds non-negligible timing differences that allow censors to identify its activity with up to ~90% accuracy over different network conditions. The timing anomaly arises because Balboa performs data substitution directly at each data exchange, delaying the server's response while covert data is prepared.
From 2026-kamali-huma — Huma: Censorship Circumvention via Web Protocol Tunneling with Deferred Traffic Replacement · §I (Introduction), §II-A · 2026 · Network and Distributed System Security
Implications
- Avoid any inline content-replacement or proxy processing that adds measurable latency to the server's first response byte — the response must be issued immediately from a pre-built buffer to be indistinguishable from a cache hit.
- Decouple covert payload preparation from the request/response cycle entirely; pre-build replacement content asynchronously so serving latency matches benign baseline.
Tags
Extracted by claude-sonnet-4-6 — review before relying.