Meek (Transport)

Meek is a pluggable transport that disguises censored but lawful traffic as ordinary HTTPS requests to a major, hard-to-block web platform. Its engine is domain fronting: from the outside, the connection appears to be a browser talking to a popular cloud or content-delivery service, while the true circumvention endpoint is named only inside the encrypted request where a network observer cannot see it. Meek was built for the Tor ecosystem, but the design lesson it teaches — hide inside traffic the censor cannot afford to block — applies to the whole discipline of lawful-privacy engineering.

How meek routes traffic

A meek client wraps the user's traffic in a sequence of standard HTTPS requests. In the visible parts of the connection — the DNS lookup and the TLS Server Name Indication — it presents a permitted, high-reputation front domain. The real destination travels in the encrypted Host header, which only the fronting platform can read after TLS terminates at its edge. The platform's infrastructure then forwards the request to a meek server (a bridge), which unwraps the payload and passes it into the anonymity network; responses ride back the same way, with the client polling to simulate a bidirectional channel over what is fundamentally a request-response protocol. To any middlebox running deep packet inspection, the whole exchange is indistinguishable from routine use of a mainstream cloud service. That is the core of meek's censorship resistance: blocking it means blocking the front platform itself, and the collateral damage of severing a service that thousands of local businesses depend on is a price most censors hesitate to pay.

Trade-offs and current status

Meek trades performance for reachability. Every byte detours through a third-party platform, HTTP polling adds latency, and cloud bandwidth costs real money for whoever operates the bridge infrastructure — so meek has always been positioned as a fallback for the hardest network environments rather than a daily driver. Its deeper fragility is structural: domain fronting only works while platforms permit the visible SNI and the encrypted Host header to differ. After several major cloud providers disabled that behavior in 2018, the population of viable fronts narrowed considerably, and the technique's availability now depends on the policies of a small number of large companies. Successor approaches respond to the same pressure from different angles — Snowflake routes through ephemeral volunteer proxies instead of corporate clouds, while obfs4 takes the opposite tack of looking like nothing recognizable at all.

Why it belongs in a sovereignty glossary

Meek is a case study in the asymmetry that makes censorship circumvention possible: the defender only needs one indistinguishable channel, while the censor must classify all traffic perfectly or accept collateral damage. It also illustrates the honest limits of borrowed infrastructure — a transport whose survival depends on a cloud vendor's policy is resilient against censors but fragile against boardrooms. For people whose privacy tooling protects lawful speech, journalism, or simply the principle that reading should not be surveilled, meek's story argues for the layered approach: multiple transports, swappable disguises, and no single point of permission. That is the same decentralization instinct that drives running your own node — reduce every dependency you can, and understand precisely the ones you cannot.

The framing deserves repeating: transports like meek exist to keep lawful communication reachable, not to launder wrongdoing — the same encryption that carries a dissident's dispatch carries your banking session, and weakening one weakens both. Meek's specific contribution to the field was proving that collateral-damage economics work as a defense: a censor forced to choose between blocking everything on a major cloud platform or tolerating a trickle of tunneled traffic will usually tolerate the trickle. Every transport since has been a variation on that bet, refined against smarter classifiers and shifting platform policies.