It is possible to write a TLS-on-443 VPN that is hard to distinguish from HTTPS.

However, if someone claims (or as good as) that "encrypted over TLS on 443" intrinsically pos5esses this property, they demonstrate that they

• do not understand the state-of-the-art in L7 firewalls as of 2010, let alone today

• don't understand common enterprise and state-level controls like HTTPS decrypt (which instantly break this)

• haven't read any of the last decade of papers on detecting protocols like obfsproxy

• haven't even bothered to look at existing takes on this (like tor) and the compromises that they make

---

From the whitepaper:

> Desktop, CLI, and Android clients use BoringSSL to mimic a Chrome TLS 1.3 ClientHello fingerprint, helping evade deep-packet inspection.

Do you set an SNI / eSNI? No? Trivially detectable. I believe Palo Alto AppID would flag this instantly as non-HTTPS masqueraded traffic.

Go fire this up behind China's golden shield, and see how many minutes your tunnel stays performant before they tarpit you; then come write a whitepaper.