What prevents directory server from being attacked?

Question

I understand that the first thing a Tor user do is connect to a directory server to obtain a list of tor nodes, which can be found here: https://atlas.torproject.org/#search/flag:authority

1. What prevents a directory server from being dishonest and give malicious data to the user?

2. What prevents attackers from attacking the directory server, i.e DDoS or anything forms of attacks?

Answer 1

What prevents a directory server from being dishonest and give malicious data to the user?

The information served by the directories is generated by reaching a consensus between the authorities. You would have to control the majority of the authorities to manipulate the consensus. This should be fairly hard as they are neither under the control of one single entity nor within a single legal jurisdiction. Manipulating the consensus is exactly easy either, the votes are cryptographically signed.

Also, I don't think it's worth the effort. I'm not sure for how long you can manipulate the consensus without anyone noticing it. The directory information can be checked by anyone, just replacing all relays, for instance, should be fairly easy to detect.

What prevents attackers from attacking the directory server, i.e DDoS or anything forms of attacks?

Tor comes with a list of hardcoded directory mirrors that are used when you first connect. This spreads the load among many hosts, making DDoS attacks harder. When you connect the next time, you'll have the full list of mirrors from the consensus you fetched. (Directory mirrors are shown as V2Dir in Atlas.)