4

Consider the following recommendation, taken from the official FAQ :

You should set MyFamily if you have administrative control of the computers or of their network, even if they're not all in the same geographic location.

Now let's say I operate two relays and apart from who pays the bills, those have nothing in common: they run different OSes on different hardware and are hosted by different ISPs in different countries. Heck, let's even say that they don't run the same Tor version.

Let's also say that I omitted to set the MyFamily field and consider the rare event where a user selects a circuit that involves both my relays.

If I'm:

  • a bad guy (that is, I monitor all traffic passing through), then that's cool because that'll make traffic analysis orders of magnitude easier;

  • a good guy, then that's cool because I'm a good guy and I know my relays are clean so the more of my machines that channel involves, the safer it is ultimately.

So the only useful use case I see for the family property is for a bunch of relays that somehow share the same infrastructure, not the same admin. I know I'm probably wrong thinking this, so:

Why would I want to set this field?

Improve this question

2 Answers 2

Reset to default
4

"Why would I want to set this field?"

Because you're a good relay operator and therefor you don't "know" your relays are "clean" with certainty [sufficiently advanced stupidity is indistinguishable from malice...]

Even if you were arrogant enough to believe that they were "clean" [absence of evidence in not evidence of absence]:

  • The more relays that are passed through by users that are in your control, the more useful it is for Mallory to do bad things to you to compel you to do bad things on their behalf (N.B. this applies also to anyone playing Mallory, other Mallorys may covet what you have.).
  • Some of the attacks on onion routing don't require Mallory to be the relay, only to have Eve observe it. A wiretap order on you may act in effect as a wiretap order on everyone using your infrastructure.
  • It makes it easier for the Tor Project and interested community members to get a better idea of what the network looks like, where diversification should happen and how it could be improved.

Comment responses

It makes sense for someone running many relays to make themselves as uninteresting a target as possible. Rather than the operator knowing that they do not collude with their own relays, they have the opportunity to tell clients which relays they run. This means that the clients can make a sane decision to avoid using two of the relays in the same circuit and it means that compromise of one or more of the relays in the family would only ever amount to one point of observation on the network for any given circuit.

"you might [...] be coerced [...] if you operate [...] a single exit node with a high throughput"

This data isn't worth much on it's own, it is only a single point in the network. Tor is designed such that one relay can be Mallory and it would still provide protection for the user from Mallory.

"what about government agencies..."

Just because a large well funded TLA might be able to do something, does not mean that we should allow lesser adversaries the same opportunity, it is not a zero-sum game. I'd also contest your implicit/loaded assumption that they can "spy on whoever they want without never(sic) having to speak to a judge". They are not omniscient and even if they could find a thing out, it may cost them or risk more to act on it than they deem it worth.

Improve this answer
2
  • Thanks, however I only get your third point yet: I understand how public families can be used as a statistics tool, but not how they increase security and/or anonymity. Tor is not about trusting individuals but the random circuit. That means all relays could be compromised but it holds as long as they don't coordinate, right? Point 1: you might indeed be coerced by rubber and hose but this is also the case if you operate, say a single exit node with a high throughput.
    – dummydev
    Commented Jun 10, 2016 at 8:48
  • Point 2: it covers law enforcement but what about government agencies (NSA and its offspring in the western world)? We can assume them to spy on whoever they want without never having to speak to a judge.How are those attacks different from Mallory just deploying a bunch of secretly related relays (or from Eve eavesdropping on a random bunch of relays) and working from there?
    – dummydev
    Commented Jun 10, 2016 at 8:48
3

Think about this instead from the perspective of the Tor Project.

Say you're a dev and you notice that a bunch of nodes that appear to be operated by the same person, but they aren't grouped together in a family. It's possible this is an accident, but it should also throw up a red flag for you because it may be an intentional ploy to deanonymize users - so you'll spend some more time digging in to see if it's a problem.

Tor is designed to resist attacks from a single compromised node, so having multiple nodes from "a good guy" doesn't actually help that much. And in turn, you're signaling to the caretakers of the network that you're doing something suspicious, which is a waste of their time to investigate if you actually aren't.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .