Hacker News Reader

Comment by nikcub | Hacker News Reader

You can include or exclude particular exit nodes in your torrc file, syntax is:

   ExcludeExitNodes <node>, <node>, <node> ..

to exclude. to only use particular nodes:

   ExitNodes <node>, <node>, <node> ..

where <node> can be a fingerprint, IP address (CIDR), country code.

Examples:

Use only US exit nodes:

   ExitNodes {us},

Block the nodes listed in this report (we block all of Russia, since listing each node slows down the matching):

   ExcludeExitNodes {ru}, 8F9121BF, 229C3722, 5A2A51D4, E455A115, 02013F48, 02013F48, 02013F48

edit: blocking by IP/range might be a better idea since fingerprints are easy to regenerate:

   ExcludeExitNodes {ru}, 64.22.111.168/29, 121.54.175.51/32, 111.240.0.0/12, 89.128.56.73/32, 117.18.118.136/32, 178.211.39.0/24, 24.84.118.132/32

edit 2: also make sure strictnodes is set to true:

   StrictNodes 1

View on HN

That's not necessary. Most of the relays in the report were already BadExited by the Tor Project. That means that the network consensus has the "BadExit" flag set which tells Tor clients not to select a particular relay as the last hop in its circuit. In fact, by interfering with your path selection algorithm, you reduce your anonymity over time.

Could you elaborate on why manually blocking known bad exits is worse for anonymity than letting the network decide this?

Manually blocking known bad exits won't really hurt your anonymity but it's also not really necessary as the Tor Project does that for you.

I was actually objecting to stuff like this: ExitNodes {us}. By interfering with your path selection algorithm in such a strong way, you make it easier for attackers to narrow down your path over time (which gives them an idea of which exit relays to monitor) and intersection attacks also become easier. Then again, you might have good reasons to do exactly that. It depends on your threat model, of course.

First thing I did is to check the directory, there are 6 nodes that i've checked so far (starting from the bottom) that are still listed :

http://82.94.251.203/tor/status-vote/current/consensus

I see no problem with running this automated test and adding these nodes yourself once you find them since BadExiting is a non-transparent process that appears to have delays in it.

edit: as an aside, using country codes as I listed "ExitNodes {us}" is nothing more than an example to express the syntax options.

It is good to know incase you need to get a particular exit point for geo-restrictions, etc. and your adversary isn't the NSA.

Reply on news.ycombinator.com