Tor Stack Exchange is a question and answer site for researchers, developers, and users of Tor. It only takes a minute to sign up.
Sign up to join this community
When I start the Tor Browser Bundle I sometimes see the message:
Your Guard … is failing more circuits than usual. Most likely this means the Tor network is overloaded.
If this one guard node is failing it seems like a good idea to move to another guard. Is this a good idea or has this approach some drawbacks? If yes, which?
No, you shouldn't pick a new guard. Your guard is still working. If it doesn't handle any circuits, Tor automatically shifts to a different one. You should let Tor do its path selection.
Those messages are new in Tor 0.2.4.x, and the goal is to help detect anonymity attacks called "path bias attacks".
You can read more details at Ticket 5458, but the basic idea of path bias detection is to recognize if one of your guards is failing a lot more circuits than the others, and warn you because while it's probably coincidence, it's possible that instead it's part of an attack similar to the one described in Denial of Service or Denial of Security? How Attacks on Reliability can Compromise Anonymity, where an adversary who controls many relays tears down circuits he can't beat, increasing the number of circuits you make and thus increasing the chances you'll build a circuit he can beat.
Unfortunately, a design like the Path Bias detector is innately hard to tune, since it involves knowing what the steady-state of circuit failures is, so it can know when to complain.
And right around the time people started upgrading to Tor 0.2.4, the botnet thing happened, and the steady-state of circuit failures changed, leading to lots of scary-sounding warnings.
If you manually rotate to another guard, a) The new one is probably going to be just as overloaded, since the whole network is overloaded with circuit create requests right now, and b) The chance that either of the guards is observable by the adversary is much higher than the chance that just the original guard is. So you are undermining the protection that guards offer by adding more of them. For more details, see this blog post which asked some early research questions about vulnerability due to guard rotation, and this research paper that provided some initial answers.
It's a tradeoff between security and connectivity. If you happened to pick a slow guard, you can pick a new guard to improve connectivity. Doing so would decrease security, because guards are fixed for a reason. Changing them when someone may want you to change them is a bad idea.
Yes with EntryNode $fingerprint Where fingeprints can be found like this https://metrics.torproject.org/rs.html#search/as:25513%20 (put your AS there).
Or just delete Tor\state file.
