The consensus includes details of exits that are flagged as "Bad Exits".
What are the specific conditions under which the Bad Exit flag is given to an exit?
weasel - Peter Palfrader
5,1481 gold badge24 silver badges39 bronze badges
asked Oct 1, 2013 at 18:54
Add a comment
|
1 Answer
Usually it implies that they are breaking stuff, either maliciously or through misconfiguration.
The most common misconfiguration I have seen is using OpenDNS as a host's nameserver with what I think is the OpenDNS default configuration. Services such as OpenDNS lie to you, under the name of protecting you. The result is for instance getting redirected to their webpage when you want to visit evil sites such as https://www.torproject.org/.
One example of either misconfiguration or actual intended malicious behavior is exit nodes that do man in the middle attacks on outgoing HTTPS connections, do SSL stripping (i.e. replacing https:// links with http:// links), or do man in the middle attacks on other protocols like ssh.
Whenever Directory Authority operators find such nodes, or somebody points them out to an operator, they are given the BadExit label. That will cause Tor clients to avoid them for exit connections. They are still useful and will get used for other positions in a circuit.
answered Oct 1, 2013 at 19:20
-
1So BadExit flags are manually applied by Tor Project (or is it the Directory Authorities who apply it?), relying on their experience or user reports, rather than being determined by some form of algorithm? Interesting. Commented Oct 1, 2013 at 19:23
-
3It's a subset of the directory authority operators who add the flag manually, either for specific IP addresses, network ranges or relay fingerprints. The Consensus Health page has an overview of which directory authority votes for what. Commented Oct 1, 2013 at 19:37
-
1Great answer, Peter! Added it to trac.torproject.org/projects/tor/wiki/doc/badRelays– DamianCommented Oct 2, 2013 at 15:40