Disguised Transport: Messaging on Filtered Networks

In many countries, networks filter or block messaging apps. Encryption protects what you say, but a filter can still recognise a messenger’s traffic and cut it off. OSHI gives you three ways to keep talking: the offline Bluetooth and Wi-Fi mesh, which needs no internet at all; our encrypted relay, optionally reached over Tor; and an optional disguised transport that makes your traffic to that relay look like ordinary web requests. This page explains exactly what the disguised transport does — and, just as importantly, what it does not do.

What it is

When you switch it on in Settings (it is off by default, on iOS and Android), every request the app sends to the OSHI relay — sending, fetching, acknowledgements, keys, attachments — is wrapped as a routine analytics-style web event, the kind of “page view” or “screen view” request that countless websites and apps send every second. Requests go to one of several generic addresses on our relay rather than to a recognisable messenger API.

Each request is also padded to one of a few fixed sizes, from 4 KB up to 4 MB, so an observer cannot read the exact length of what you send. The relay unwraps the request and handles it exactly like a normal one, with the same signatures and identity checks.

What it can help with

• Filters that block known messenger traffic by keyword, URL pattern or recognisable API calls.
• Hiding the exact size of your messages behind coarse padding.
• Keeping a consistent, ordinary-looking traffic profile instead of mixing disguised and direct requests.

What it does not do

We would rather you know the limits than rely on something that fails when it matters:

• It is not steganography and not anonymity. Nothing is hidden inside photos or text. The relay still sees which public keys talk, when, and the padded size of each request.
• It is not proven against advanced censorship. It has been tested for correct, lossless delivery — including when the normal endpoints are blocked — but not against real-world deep packet inspection or statistical traffic analysis, and we do not claim it is indistinguishable from genuine web traffic.
• It still needs our relay. The connection goes to OSHI’s relay over HTTPS. If the relay’s address or hostname is blocked, or only allowlisted sites work, the disguised transport cannot get through.
• It does not work through an internet shutdown. When there is no internet at all, use the mesh.

When the internet is gone: the mesh

On iOS and Android, OSHI can send messages directly between nearby phones over Bluetooth and Wi-Fi, with no server and no internet connection involved. Messages can hop through other OSHI users’ phones to reach people further away. This is what keeps OSHI useful during a full shutdown — see Mesh Networking.

Who it is for

Journalists, activists and ordinary people on networks that filter messaging apps, who want one more layer on top of end-to-end encryption. If your life or liberty depends on not being detected, treat the disguised transport as one tool among several — combine it with the mesh, with Tor, and with careful operational security — not as a guarantee.

How it compares

No messenger can promise to beat every censor. OSHI’s aim is to give you several independent paths — mesh, relay, Tor and the disguised transport — and to be honest about what each one does.