Browse code

faq: add recommendation to not mess with the path (fixes #13843)

traumschule authored on21/08/2018 06:10:54 • hiro committed on22/08/2018 12:10:12
Showing1 changed files
... ...
@@ -262,6 +262,8 @@ packets,
262 262
     so people can't block the exits.</a></li>
263 263
     <li><a href="#ChoosePathLength">You should let people choose their path
264 264
     length.</a></li>
265
+    <li><a href="#ChoosePathCountries">You should change path selection to avoid
266
+    entering and exiting from the same country.</a></li>
265 267
     <li><a href="#SplitEachConnection">You should split each connection over
266 268
     many paths.</a></li>
267 269
     <li><a href="#MigrateApplicationStreamsAcrossCircuits">You should migrate
... ...
@@ -4061,7 +4063,34 @@ best way to attack Tor is to attack the endpoints and ignore the middle
4061 4063
 
4062 4064
     <hr>
4063 4065
 
4064
-<a id="SplitEachConnection"></a>
4066
+    <a id="ChoosePathCountries"></a>
4067
+    <h3><a class="anchor" href="#ChoosePathCountries">You should change path
4068
+    selection to avoid entering and exiting from the same country.</a></h3>
4069
+
4070
+    <p>
4071
+    It is better to not manually change the path. This could have unforeseen
4072
+    consquences and you'll probably screw it up, we don't understand it very
4073
+    well either.
4074
+    </p>
4075
+
4076
+    <p>
4077
+    There are many attacks and adversaries that Tor is trying to defend against
4078
+    at once, and constraining paths has surprising trickle-down effects on the
4079
+    other attacks (e.g. if I see where you exit then I know where you *didn't*
4080
+    enter, thus reducing your entropy, sometimes by a surprising amount
4081
+    depending on what path constraints are choosen).
4082
+    </p>
4083
+
4084
+    <p>
4085
+    In general, changing Tor's path selection makes your client look different
4086
+    from other clients. Picking your entry and exit in different countries is
4087
+    not a good defence, because it only defends against adversaries that are
4088
+    unable to rent servers in other countries.
4089
+    </p>
4090
+
4091
+    <hr>
4092
+
4093
+    <a id="SplitEachConnection"></a>
4065 4094
     <h3><a class="anchor" href="#SplitEachConnection">You should split
4066 4095
     each connection over many paths.</a></h3>
4067 4096