2

(I feel insecure in my country after the relays I've been using turned out to be state-compromised. Now I'm starting to doubt the integrity of the directory nodes.)


Qu: How do we know for sure that the majority of the nine directory nodes haven't been compromised? Is there a list online?

I have been trying to look up who the authorities behind them are, but I cannot seem to find a direct answer.

Thanks in advance.

0

You can not trust anyone except yourself, but you don't have to. According to the man page, you can even run your own private tor network! Obviously you have to edit your torrc file.

From the man page:

FallbackDir ipv4address:port orport=port id=fingerprint [weight=num] [ipv6=[ipv6address]:orport]

When we’re unable to connect to any directory cache for directory info (usually because we don’t know about any yet) we try a directory authority. Clients also simultaneously try a FallbackDir, to avoid hangs on client startup if a directory authority is down. Clients retry FallbackDirs more often than directory authorities, to reduce the load on the directory authorities. By default, the directory authorities are also FallbackDirs. Specifying a FallbackDir replaces Tor’s default hard-coded FallbackDirs (if any). (See the DirAuthority entry for an explanation of each flag.)

UseDefaultFallbackDirs 0|1

Use Tor’s default hard-coded FallbackDirs (if any). (When a FallbackDir line is present, it replaces the hard-coded FallbackDirs, regardless of the value of UseDefaultFallbackDirs.) (Default: 1)

DirAuthority [nickname] [flags] ipv4address:port fingerprint

Use a nonstandard authoritative directory server at the provided address and port, with the specified key fingerprint. This option can be repeated many times, for multiple authoritative directory servers. Flags are separated by spaces, and determine what kind of an authority this directory is. By default, an authority is not authoritative for any directory style or version unless an appropriate flag is given. Tor will use this authority as a bridge authoritative directory if the "bridge" flag is set. If a flag "orport=port" is given, Tor will use the given port when opening encrypted tunnels to the dirserver. If a flag "weight=num" is given, then the directory server is chosen randomly with probability proportional to that weight (default 1.0). If a flag "v3ident=fp" is given, the dirserver is a v3 directory authority whose v3 long-term signing key has the fingerprint fp. Lastly, if an "ipv6=[ipv6address]:orport" flag is present, then the directory authority is listening for IPv6 connections on the indicated IPv6 address and OR Port. Tor will contact the authority at ipv4address to download directory documents. The provided port value is a dirport; clients ignore this in favor of the specified "orport=" value. If an IPv6 ORPort is supplied, Tor will also download directory documents at the IPv6 ORPort.

If no DirAuthority line is given, Tor will use the default directory authorities. NOTE: this option is intended for setting up a private Tor network with its own directory authorities. If you use it, you will be distinguishable from other users, because you won’t believe the same authorities they do.

DirAuthorityFallbackRate NUM

When configured to use both directory authorities and fallback directories, the directory authorities also work as fallbacks. They are chosen with their regular weights, multiplied by this number, which should be 1.0 or less. The default is less than 1, to reduce load on authorities. (Default: 0.1)

AlternateDirAuthority [nickname] [flags] ipv4address:port fingerprint

AlternateBridgeAuthority [nickname] [flags] ipv4address:port fingerprint

These options behave as DirAuthority, but they replace fewer of the default directory authorities. Using AlternateDirAuthority replaces the default Tor directory authorities, but leaves the default bridge authorities in place. Similarly, AlternateBridgeAuthority replaces the default bridge authority, but leaves the directory authorities alone.

| improve this answer | |
  • this doesn't answer the question. the question was whether or not we can trust the existing directories, not how to run your own. – tao_oat Jan 7 at 14:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.