I tried to find an answer to this question but I found none. I think it would be reasonable to be able to use always three DIFFERENT countries in a circuit if possible. Just as simple as that. And it seems like a fairly easy thing to implement via torrc or somehow... Is it possible now? Or is it a silly idea?

  • 1
    First of all, IP address is totally unrelated to geography. It's easy to fake.
    – cacahuatl
    Dec 12 '16 at 18:06
  • A python scripts are used to do so, they are working via Stem library. So either you use the ready ones - or write your own
    – Alexey Vesnin
    Dec 12 '16 at 21:24
  • Can you clarify why you'd want to? You may be starting from a false understanding. Jan 10 '17 at 16:45
  • The 3 hop circuit consists of a guard , middle and exit node. The guard node always remains the same as a protection mechanism. Correct me if im wrong.
    – Mithrandir
    Apr 15 '17 at 12:12
  • @Mithrandir It doesn't stay always the same, but it stay for a longer period and it is changed to some new guard node then. I wroter a longer answer here: tor.stackexchange.com/a/7050/88
    – Jens Kubieziel
    May 16 '17 at 8:15

TLDR This may not be a good idea, and may harm your anonymity, the best thing to do is to leave Tor do its own routing algorithm. It can however be (approximately) implemented through torrc.


This one is a lot more complicated than it sounds.

Please take the following concerns not as arguing that the idea of country-aware routing is broken or unworkable, but as an explanation for why the simple version of it is not necessarily a good idea, and why the complex version of it that might be a good idea still has a bunch of unsolved problems.

You not only need to think about the countries used by your Tor relays, but the country that you're in and the country that your destination is in. For example, if you and your destination are in the same country, and some agency in that country is monitoring and correlating its internal communications, then current low-latency anonymity designs can't help against them.

And it gets even more complicated: internet topology does not obey national borders (it's not uncommon for a connection between two places in one country to travel through a third country -- I hear it happens in Canada a lot), and nations are not connected in a clique (traffic from country A to county B often goes through some other country C).

And to add a new fun complication, there are agencies out there who allegedly do most of their snooping at national borders and IX exchanges. Maximizing country-to-country transitions would seem to increase exposure to such attackers rather than limit it.

And finally, nobody's done the math as far as I know to show whether and under what circumstances a routing algorithm of this style would give you observably different results from using the regular path generation algorithm in a way that would allow an attacker to separate your traffic from the rest of the network and thereby actually make your anonymity worse.


In spite of all of that, this is research that we do need to do. Murdoch and Zelinski have some important observations (​https://freehaven.net/anonbib/#murdoch-pet2007). I think that one of the most promising directions I know of right now for topology-aware routing is the kind of work done by Edman and Syverson (​freehaven.net/anonbib/#DBLP:conf/ccs/EdmanS09); I think some other groups are poking on it too. A forthcoming paper I did with Roger Dingledine, Paul Syverson, and Aaron Turner (assuming that it gets in where we submitted it) might also have some relevance, though it's more about mistrusting some countries more than others than it is about what to do if you mistrust all countries equally but think that they don't cooperate.

Anything that can be done to pick up the analysis work of any of these threads would be greatly helpful.


Oh! And as a workaround, if none of the above issues concern you, then you can get something close to what you want here by splitting countries with lots of Tor nodes into two halves, and saying

EntryNodes {aa},{bb},{cc},...
ExitNodes {nn},{oo},{pp},...

You'll need to use Tor 0.2.3.x for support for country codes in your EntryNodes list, and you might want to decide whether to use "StrictNodes 1" to make sure that Tor forbids circuits you don't want even when they would be needed to connect to a directory or hidden service.

  • 1
    The workaround is probably a very bad idea, first of all you need to consider that Tor relays are not equally distributed between countries either by weight or by number. As such splitting them into distinct entry/exit pools based on country code alone will result in far worse anonymity.
    – cacahuatl
    May 16 '17 at 22:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.