2

Recently I discovered that there is a tor relay in my own country. While it is a good sign it is impossible to know if the relay is by a good or a bad actor. While the same can be said of any tor relay anywhere in the world, is there a way to set preferences somewhere so tor relays from other countries are preferred over your country.

I do know and understand that it may (or may not) add significant latency on the connection depending upon the application I'm using, for e.g. web pages should be probably instantaneous but something like wget or any bandwidth-intensive application may take a hit.

I am on Debian testing/buster.

3

Well, it depends on the relay's place in the chain:

  • Entry node - yes, you can use EntryNodes {us},{fr} for example, to specify the countries USA and France
  • Middle node - via configuration file - no, but if using Tor control protocol - yes, physically possible, but not a good idea(I'll explain it later).
  • Exit node - yes, you can use ExitNodes {us},{fr} and ExcludeExitNodes {us},{fr} for example, to tell to use or to avoid the nodes listed.
  • Any node - there's an ExcludeNodes {us},{fr} that tell Tor to do it's best to avoid the nodes listed on any place, but there's no strict enforcement/guarantee

If using any of directives above, you must specify StrictNodes 1 in your torrc config to make it actually have an effect. In a curly bracket there can also be a hash-id's of the specific nodes.

About middle nodes - why are they not tweakable via config? Because it can hurt the network badly - it's really easy to implement something like ExcludeMiddleNodes and MiddleNodes directives, but there's a great and grave danger to the anonymity and to the whole network itself: it makes split happen, i.e. we can have 2 or more node groups that do not intersect even by middle nodes, and we have a significant simplification of almost any attack against Tor and it's users: the adversary/censor will have to "care about"/"look after" a way lower number of nodes... So - the explicit circuit construction by control protocol is the one and only way to construct the circuit you wish with all the custom filters.

  • I found the local path to torrc as it has been changed a bit in Debian, see tor.stackexchange.com/questions/4018/… – shirish Oct 14 '17 at 11:49
  • I put the following, is this ok/good EntryNodes {us},{fr} ExcludeNodes {in} StrictNodes 1 – shirish Oct 14 '17 at 11:50
  • well, actually - just IMHO - a -f /full/path/to/your/fully/custom/config is a must in a startup scripts: configs can be possibly overwritten even with a source-build installs. And - as for me - I'm always doing a source-builds at least for Tor to acive a way better perfomance. I can post the build settings if you need ones – Alexey Vesnin Oct 14 '17 at 11:53
  • I'm stumped by what you mean, should I make another question using your answer so you can elaborate what you mean. You will have to elaborate/show me what you mean. I can share the behavior as it happens or what I think happens in Debian and then you could elaborate on what you just shared, let me know which path/way do you prefer ? – shirish Oct 14 '17 at 11:59
  • post a link for the question here if you'll make one - I'll answer it. Now I'm going offline - so take your time – Alexey Vesnin Oct 14 '17 at 12:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.