Is there a way in tor to tell to prefer tor relays from another country?

Question

Recently I discovered that there is a tor relay in my own country. While it is a good sign it is impossible to know if the relay is by a good or a bad actor. While the same can be said of any tor relay anywhere in the world, is there a way to set preferences somewhere so tor relays from other countries are preferred over your country.

I do know and understand that it may (or may not) add significant latency on the connection depending upon the application I'm using, for e.g. web pages should be probably instantaneous but something like wget or any bandwidth-intensive application may take a hit.

I am on Debian testing/buster.

Answer 1

Well, it depends on the relay's place in the chain:

• Entry node - yes, you can use EntryNodes {us},{fr} for example, to specify the countries USA and France
• Middle node - via configuration file - no, but if using Tor control protocol - yes, physically possible, but not a good idea(I'll explain it later).
• Exit node - yes, you can use ExitNodes {us},{fr} and ExcludeExitNodes {us},{fr} for example, to tell to use or to avoid the nodes listed.
• Any node - there's an ExcludeNodes {us},{fr} that tell Tor to do it's best to avoid the nodes listed on any place, but there's no strict enforcement/guarantee

If using any of directives above, you must specify StrictNodes 1 in your torrc config to make it actually have an effect. In a curly bracket there can also be a hash-id's of the specific nodes.

About middle nodes - why are they not tweakable via config? Because it can hurt the network badly - it's really easy to implement something like ExcludeMiddleNodes and MiddleNodes directives, but there's a great and grave danger to the anonymity and to the whole network itself: it makes split happen, i.e. we can have 2 or more node groups that do not intersect even by middle nodes, and we have a significant simplification of almost any attack against Tor and it's users: the adversary/censor will have to "care about"/"look after" a way lower number of nodes... So - the explicit circuit construction by control protocol is the one and only way to construct the circuit you wish with all the custom filters.

The two-character country code according to ISO3166 can be used in either upper or lower case letters.