CensorLess: Cost-Efficient Censorship Circumvention Through Serverless Cloud Functions

Despite AWS, Google, and Microsoft having publicly withdrawn CDN-level domain-fronting support to preserve commercial relationships with censoring states, domain fronting remains functional on AWS Lambda as of early 2026. Microsoft Azure Functions explicitly rejects mismatched SNI/Host headers, whereas AWS Lambda permits a client to present a legitimate *.lambda-url.*.on.aws SNI while routing internally to a different serverless function via the HTTP Host header.

§4.7 defense sni-blocking generic

CensorLess's function refresher automatically retires serverless bridges and deploys fresh ones in batches across diverse regions; the expected time until a bridge is identified and blocked in practice is 2 days (per Fifield et al.), while Tor bridges in China are discovered within 2–36 days. The old bridge is only removed after all clients have completed live migration to a new URL, maintaining uninterrupted connectivity.

§4.5 defense active-probingip-blocking cn

During the cold-start phase on a newly migrated serverless bridge (approximately the first 0–50 invocations), average function duration spikes to over 6,000 ms and success rate occasionally drops below 90%. The system stabilizes between invocations 100–200, with average durations consistently below 1,000 ms and success rates above 95%; AWS Lambda by default supports up to 1,000 concurrent invocations without throttling.

§6.2, Figure 5 evaluation generic

CensorLess's threat model explicitly relies on a rational-censor assumption: the censor will not block entire cloud-provider IP ranges or domain namespaces because the collateral damage to legitimate business services would be politically and economically unacceptable. AWS Lambda's inherent IP-address ephemerality (new IPs on each invocation, function lifetime up to 15 minutes) means even censors willing to attempt enumeration face a continuously shifting target distributed across the cloud provider's global address space.

§4.2 defense ip-blockingasn-blackholingactive-probing cnirru

CensorLess vanilla mode costs $0.27/month for a single proxy processing 6.76 GB of traffic monthly, a 97.1% reduction (34.4×) over SpotProxy's optimal single-NIC configuration ($9.28/month). The private mode, which adds a t4g.micro EC2 VPS for end-to-end encryption via SOCKS, costs $3.41/month — still 63.3% cheaper than SpotProxy's cheapest option. Costs remain below $3.50/day even when scaling to 300 proxies.

§6.3, Figure 6 evaluation ip-blockingsni-blockingdns-poisoning generic