Every time I start Tor or switch to a new identity, the first web address in the list of Tor circuit connections is (Germany) 126.96.36.199. Is Tor supposed to work this way? I was under the impression that an entirely new path was created every time you switch identities.
So after reading this answer by Jens, I looked for and found this "state" file in [...]\TorBrowser\Data\Tor , deleted it and finally got a realy new circuit because the TBB created a new file after restart.
This was really crucial to me, because the friggin Ukrainian "guard note" it used before drove me nuts, because it was so unbeliviably slow it rendered tor unusable to me. And that cannot be the goal of a "security improvement", since it would eventually drive me to use a normal browser if it had continued for another couple of weeks :o .
So @developers, please don't make this "fix" impossible.
Tor is supposed to work in this way. Former versions of Tor built a complete new circuit every time. However some researcher found out that a so-called service location attack is possible. So the Tor Project changed the design in a way that defends this kind of attack. The defense is that the first relay in a circuit stays the same for some period of time. This node is now called guard node.
Usually Tor keeps using the same guard node for several weeks. Tor uses a
state file (within your Tor installation) to keep track of guard nodes. You'll find several lines like:
EntryGuard AloneWithOurRecords 783C36CF2F61A1B3C4238499D92C619A9CDDEA3B DirCache
in this file. Those lines determine the guards you'll use.
In an e-mail, Tor project leader Roger Dingledine said the requirements of the attack greatly limited its effectiveness in real-world settings. First, he said, the adversary must control one of the entry guards a hidden service is using. Such entry guards in theory are assigned randomly, so attackers would have to operate a large number of Tor nodes to have a reasonable expectation of seeing traffic of a given hidden service. Additionally, he cited research from last year arguing that researchers routinely exaggerate the risk of website fingerprinting on anonymity.
A response to another research that claimed they could de-anonymise TOR. Clearly the bit about entry guards being assigned randomly is not true.