Hacker News Reader

Comment by rpigab | Hacker News Reader

I had that problem too, very slow on network requests, just change the setting "num_relays_proxied" from 3 to 1 to make it blazingly fast.

View on HN

Then the single relay knows both who you are (your IP) and where you are going. This offers no anonymity against the relay itself.

3 relays is the goldilocks number for speed vs privacy. Using less is not a tradeoff the usual user of Tor should make.

How is 3 so much better than 2, but 4 not so much better than 3?

1 = no privacy from relay

2 = risk of collusion between relays

3 = goldilocks default

4 = ... actually, you have more attack surface and you are more susceptible to fingerprinting because everybody else is using 3, so you're timings etc help identify you

So the default is 3 and nobody ought change it! Use 3 like everybody else.

The exception is .onion sites. TOR actually deliberately defaults to 6 hops when accessing .oninon sites - 3 to protect you and 3 to project the site.

That reminds me of the holy Handgranate of the Monty pythons

There's no exit nodes for onions because there's nothing to exit to. Nothing beats anonymity of onions and it's design is well created.

The right number for you to use is the default. But the right default is not necessarily 3.

Knowing not so much about Tor but some about math: the number of nodes you need to compromise in order to de-anonymize a Tor user is exponential in the number of hops. Google says there are roughly 7000 Tor nodes, including 2000 guards (entry) and 1000 exit nodes. If you have a single hop, there's roughly a 1/1000 chance that you will connect to a single malicious node that can de-anonymize you, going up linearly with the number of nodes an attacker controls. If you have 3 hops, you have a 1 in 1000 * 7000 * 2000 = roughly 14 billion chance. 2 hops would give you 1 in 2 million, 4 hops would give you 1 in 1000 * 7000 * 7000 * 2000 = 98 trillion. In practical terms 1:14B is about the same as 1:98T (i.e. both are effectively zero), but 1:2M is a lot higher.

There are currently ~9000 relays if you look at https://metrics.torproject.org/networksize.html. The current problem is the fact that majority of relays are in Germany and if you rotate your circuits enough, you'll also notice the same path. German govt has been very hostile towards Tor for a long time, they were also behind KAX17. We need more relays obviously but also in different regions.

because then there is at least one node that knows neither the source nor the destination of a request

The law of diminishing returns

This is a joke, for those who didn’t notice.

Tor is slow because traffic is routed through multiple layers. The design priority is anonymity, not speed.

You should preface this with some important information about what that does.

There are some trade-offs!

Changing that setting to 1 gives you weaker anonymity guarantees. Using multiple guards spreads your traffic across different IP addresses, making it harder for an adversary who controls a subset of the network to correlate your activity.

Reducing to a single guard concentrates all traffic through one point, increasing the chance that a hostile relay could observe a larger fraction of your streams...

The setting doesn’t exist.

Your config improvement made it into Google AI https://i.imgur.com/v5DsXy9.png

If this is sarcastic you should probably add /s or someone might actually follow your "advice".

Or people should not be idiots and think for themselves just a smidge, and not use /s.

They should be fine since I made up the setting name, and even though I am not familiar with Tor client's configuration, I don't believe this is possible without altering its source code.

Also, using this kind of software without understanding how its works even just a little doesn't protect much of your privacy.

Yeah I was confused! Pretty sure this is not configurable.

What's the point of having one relay? You're better off using a reputable VPN like mullvad or ivpn. Tor is the best you're gonna get for low latency anonymous overlay network. It's been studied and refined over the years.

It would shifts part of the data route info from your provider toward that particular relay.

But I wouldn't recommend it of course.

Of course it would hence you should stick with mullvad, a reputable VPN. Tor is not made for single relay paths, you're just wasting it's potential.

It's very difficult for me to contemplate how anybody could run a VPN, however reputable, that isn't compromised by one intelligence agency at least. Their incentive structures and their costs to participate in this space just make it a no-brainer.

If you're starting a brand new VPN company with ironclad ideals about privacy - are you going to be able to compete with state-run enterprises that can subsidize their own competing "businesses", on top of whatever coercive authority they possess to intervene in local small businesses?

Reply on news.ycombinator.com