4 ms·

According to this [0] there are only about 1.5k exit nodes and over 6k relays total. It's a pretty small network. I'm not an expert on tor internals but it soun

According to this [0] there are only about 1.5k exit nodes and over 6k relays total. It's a pretty small network. I'm not an expert on tor internals but it sounds to me like a sufficiently dedicated player could easily control a big chunk of this. Don't even need crazy money. I understand that they have mechanisms preventing obviously fake new servers from flooding the network. But still at these numbers it doesn't seem that tough to play the long game. [0] https://metrics.torproject.org/networksize.html https://metrics.torproject.org/networksize.html

worldofmatthew 6y ago
Are you planning to add any relays?
- sarakayakomzin 6y ago
  > Are you planning to add any relays? does not adding relays invalidate the criticism somehow? do you want them to add 20k relays in order for their justified opinion to...still be an opinion?
tga_d 6y ago
Yeah, it happens: https://blog.torproject.org/bad-exit-relays-may-june-2020 https://blog.torproject.org/bad-exit-relays-may-june-2020 One reason why it's not devastating to the network as a whole is that the process for getting your relays to make up such a large fraction of the network is social. If you run a ton of capacity, especially if added all at once, people are going to notice, and reach out to find out who you are (and if they can't, expect to get removed). This means that while yes, you can do this (and as above, people have), once it's detected, all of your resources are dropped at once, and you have to start a pretty expensive and time-consuming process over again. It's also the case that adversaries generally don't collude, so e.g., the above attack was for cryptocurrency theft, and those adversaries likely aren't working with the FBI or China to deanonymize circuits. This means you only have to worry about a few of these happening at a time, which makes it easier to detect (pull on one thread, and the rest start to unravel). That said, just based on the blog post above, it's something that TPO seems to be thinking about new ways to address, and sibyl detection has a long history of research in the academic community as well that has plenty of space left to explore. Something like Salmon[0] is in the process of being implemented by TPO for bridge distribution[1], and the constraints for this reputation problem are far less onerous than that setting. [0] https://content.sciendo.com/view/journals/popets/2016/4/article-p4.xml?language=en https://content.sciendo.com/view/journals/popets/2016/4/arti... [1] https://gitlab.torproject.org/tpo/anti-censorship/bridgedb/-/issues/31873 https://gitlab.torproject.org/tpo/anti-censorship/bridgedb/-...

worldofmatthew 6y ago

Are you planning to add any relays?

sarakayakomzin 6y ago
> Are you planning to add any relays? does not adding relays invalidate the criticism somehow? do you want them to add 20k relays in order for their justified opinion to...still be an opinion?

tga_d 6y ago

Yeah, it happens: https://blog.torproject.org/bad-exit-relays-may-june-2020 https://blog.torproject.org/bad-exit-relays-may-june-2020 One reason why it's not devastating to the network as a whole is that the process for getting your relays to make up such a large fraction of the network is social. If you run a ton of capacity, especially if added all at once, people are going to notice, and reach out to find out who you are (and if they can't, expect to get removed). This means that while yes, you can do this (and as above, people have), once it's detected, all of your resources are dropped at once, and you have to start a pretty expensive and time-consuming process over again. It's also the case that adversaries generally don't collude, so e.g., the above attack was for cryptocurrency theft, and those adversaries likely aren't working with the FBI or China to deanonymize circuits. This means you only have to worry about a few of these happening at a time, which makes it easier to detect (pull on one thread, and the rest start to unravel). That said, just based on the blog post above, it's something that TPO seems to be thinking about new ways to address, and sibyl detection has a long history of research in the academic community as well that has plenty of space left to explore. Something like Salmon[0] is in the process of being implemented by TPO for bridge distribution[1], and the constraints for this reputation problem are far less onerous than that setting. [0] https://content.sciendo.com/view/journals/popets/2016/4/article-p4.xml?language=en https://content.sciendo.com/view/journals/popets/2016/4/arti... [1] https://gitlab.torproject.org/tpo/anti-censorship/bridgedb/-/issues/31873 https://gitlab.torproject.org/tpo/anti-censorship/bridgedb/-...