I'm using Tor (Orbot for Android), and when I look at the log of the connection establishment phase, I see that I'm repeatedly being connected to familiar nodes, especially the Entry Nodes which 3 out of 4 times are the same 3 nodes that I'm connecting to every time! Even the whole 3 Nodes in my path are more often than not also familiar and so much so that I almost see no randomization process happening!

I understand that if 1 malicious node is in my path, my anonymity won't be much affected, but if at least the Entry and the Exit Nodes are malicious, then I'm not anonymous anymore since the entry data and exit data can be monitored and compared.

Question is: How do I force randomization of the connection, and WHY am I being assigned these nodes repeatedly (i.e. is there a known attack in which an entity can deliberately assign users to specific ranges of nodes to strip them out of their anonymity?)


1 Answer 1


If you delete your Tor data directory, Tor will randomize how it builds new circuits and picks new entry nodes.

However, the behavior you are seeing is intentional. Tor has affinity to a small set of entry nodes, called entry guards. These guards help reduce the chance that you are assigned an entry node which is malicious, because your computer is only connect directly to that small set of entry guards, rather than connecting at random to a different entry every time.

For example, if you start Tor every day for a year, with random assignment that would be 365 entry points and 365 opportunities for an attacker to be your entry node. Instead, by having just 3 entry guards, you only are placing your trust in those 3 nodes, only 3 random opportunities for your entry to be an attacker, smaller chance that one of your entries is an attacker.


The solution is "entry guards": each Tor client selects a few relays at random to use as entry points, and uses only those relays for her first hop. If those relays are not controlled or observed, the attacker can't win, ever, and the user is secure. If those relays are observed or controlled by the attacker, the attacker sees a larger fraction of the user's traffic — but still the user is no more profiled than before. Thus, the user has some chance (on the order of (n-c)/n) of avoiding profiling, whereas she had none before.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .