3

I've been using Tor Browser Bundle for a long time, and it used to always pick a different circuit for every site, including changing the entry node for every circuit but then it just suddenly became static with the entry nodes. The version didn't change, it was the latest one and behaved "normally" (as it always used to) before starting doing this.

My entry node always stays the same, and doesn't change, even when connecting to different sites, even after using New Tor Circuit for this Site. Even after restarting Tor Browser, the entry node is still the same, for every circuit.

The circuits themselves do change and are different each time, just the entry node always stays the same. It's driving me crazy. I've even reinstalled Tor Browser multiple times, that actually did change the entry node I was connecting to, but again, it was the same one for every circuit and every site.

I don't really see a security risk in this but it seems suspicious since there was no update before this started.

Why is this? Is this normal Tor behavior now?

3

This is the normal behaviour for entry guards.

The Tor FAQ explains why we'd want to do this:

... But profiling is, for most users, as bad as being traced all the time: they want to do something often without an attacker noticing, and the attacker noticing once is as bad as the attacker noticing more often. Thus, choosing many random entries and exits gives the user no chance of escaping profiling by this kind of attacker.

To simplify: the more often you change your guard node, the more chance there is of connecting to one owned by the Bad Guys.

The length of time you use the same guard for is called the rotation period. More details about this can be found in Changing of the Guards and One Fast Guard for Life.

  • Thanks for your answer. Just one question about this part of your answer: "To simplify: the more often you change your guard node, the more chance there is of connecting to one owned by the Bad Guys." If TOR always connects to the same IP how do I know this isn't a "bad guy" anyway. Is there any way of validating the "good guy" status of what you call an entry guar? – negrita May 16 '16 at 7:51
  • To simplify: the more often you change your guard node, the more chance there is of connecting to one owned by the Bad Guys. I think this is BS - the enemy of anonymity is predictability and that's just what is happening here. Have you been compromised by NSA? I am going to stop using TOR – Fred May 16 '17 at 4:30
0

Fred is right. From a probability perspective, if one in ten relays are compromised, you always have a one in ten chance of getting the compromised relay. Therefore, there is no advantage to forcing the use of one relay. However, if an entity (with the help of your internet provider) were to direct your Tor request to a compromised relay, you would have no way to randomize relay choice to minimize your chance of getting it. In this case, you have a 100% chance of using a compromised relay.

I'd like to see the mathematical analysis behind this policy because it seems to make hijacking much more possible.

  • How do you imagine "hijacking" works? Relays can't impersonate other relays because they use authenticated key exchanges. A man-in-the-middle cannot impersonate a relay that they do not hold the private keys for. A relay they do hold the private keys for they already control. Hijacking isn't a meaningful attack. – cacahuatl Nov 6 '17 at 23:14
  • Don't have to imagine how it's done, since the issue is about whether or not "guard nodes" add to security and the preservation of anonymity. I'm unconvinced they do, and don't see a way to get there. In fact, I think Fred's point is a valid one and that they may go the other way. As a general rule I try not to begin by assuming there is no way to compromise something to justify a design decision. – user4904532 Nov 7 '17 at 4:57
  • "However, if an entity (with the help of your internet provider) were to direct your Tor request to a compromised relay, you would have no way to randomize relay choice to minimize your chance of getting it." <- since this "hijacking" cannot happen, your speculation drawn from this possibility makes the whole point moot. – cacahuatl Nov 7 '17 at 11:30
  • Also, if you want "the mathematical analysis behind this policy" it's literally in the two links in the answer to this question. Which makes me think you did not bother to actually read it. – cacahuatl Nov 7 '17 at 11:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.