Tor's routing algorithm is trading safety for speed, says cofounder Roger Dingledine. After 25 years, the anonymity network's biggest threat is centralization, not surveillance.
Millions of people rely on a network of unpaid volunteers to stay anonymous online, and for 25 years that network has run on altruism rather than profit. Tor, short for The Onion Router, routes a user’s traffic through three volunteer operated relays, as many as 9,000 of them scattered across the globe, so no single relay knows both who is asking and where they are going.
At the DEF CON security conference, Tor Project cofounder Roger Dingledine walked through the operational lessons behind keeping that network running, covering routing design, bad actor detection, and a centralization problem tied to the economics of cheap hosting. He also reiterated that the goal of Tor is about privacy, not profit.
“The building block that Tor is based on is altruism,” Dingledine said. “It is: I want to make the world a better place, I have these extra resources, whether it’s bandwidth or a computer or something, and of course I’m going to give back to my community so that people in authoritarian regimes like Egypt or the U.S. or wherever we’re going, can have more safety on the internet.”
How Tor works today
Tor routes traffic through three relays: an entry guard, a middle node, and an exit node that connects to the destination site. Each relay operator sets an exit policy defining which addresses and ports it will forward. Some allow only ports 80 and 443 for web traffic. Others accept no exit traffic at all and serve only as an entry or middle hop.
A directory consensus, published hourly by nine directory authorities, tells clients which relays exist and how to reach them. Dingledine runs one of the nine and knows the other eight operators personally, a tradeoff between decentralization and a manageable degree of central control. He noted that if an attacker could somehow compromise or coerce or take over a majority of those nine, then it would be possible to start doing attacks on the Tor network.
“So, one piece is this centralization has been helpful for letting us do admission control on the Tor network,” Dingledine said. “If some jerk in Russia signs up 1,000 Tor relays, then we have the ability, once we’ve identified them, to get those relays out of the network, and that has turned out to be really useful over time.”
The directory authorities were once also a performance and censorship bottleneck, since clients bootstrapped from nine fixed IP addresses a censor could simply block. Tor fixed this by distributing directory information across all relays and adding fallback bootstrap directories, so no client has to reach a directory authority directly.
Opsec mistakes cause the most damage
Dingledine ranked the threats facing Tor users by how often they actually occur in practice, not by theoretical severity.
- Opsec mistakes. The most common cause of deanonymization is user error, not a flaw in Tor itself. Dingledine cited law enforcement contacts who tracked suspects only after they briefly used an open network connection without Tor.
- Browser fingerprinting. Tor Browser, a Firefox fork, works to make every user look identical to every other user by normalizing variables like JavaScript behavior and window size.
- Browser exploits. Zero-day vulnerabilities purchased for Firefox frequently work against Tor Browser as well, since it shares the same rendering engine and a browser’s attack surface remains large regardless of the anonymity layer running underneath it.
- Confirmation attacks. An adversary who already suspects a specific user can monitor that person’s network connection alongside the destination site the person is believed to visit, then correlate the two traffic flows.
- Traffic analysis. Without a known suspect, an adversary instead tries to match flows within a large set of observed Tor traffic. Dingledine called this a hard research problem at scale.
Bad actors have also tried to hijack Tor’s admission model directly by signing up botnets of compromised devices as relays. A network health team monitors for that kind of anomaly and removes the relays once identified, but the pattern keeps recurring.
“This problem is going to keep on happening,” Dingledine said. “So we need to get better and better at recognizing anomalies and dealing with them.”
Cheap hosting is recentralizing the network
Running a relay no longer typically means installing software on a personal machine with an always-on connection. Most relay operators now provision a VPS instead, and Dingledine pointed to a narrowing set of providers as the practical consequence.
“Everybody’s like, I’ll run mine on Hetzner also, and then suddenly Hetzner is 20% of the Tor network,” Dingledine said.
The geographic effect compounds the provider concentration. Dingledine said new relay operators gravitate toward Europe because bandwidth is cheap there. Tor’s own load-balancing and bandwidth-measurement systems then favor those relays, because proximity to other European relays makes them measurably faster. The result is a routing algorithm that, by optimizing for speed, pushes more traffic toward a smaller and more geographically concentrated set of infrastructure. That situation runs against the network’s original design goal of spreading traffic across many jurisdictions.
“If the goal of the Tor network is to spread out all the traffic over many continents, then we’ve got a conflict here between making Tor fast and making Tor safe,” Dingledine said.
Part of the fix underway is technical. The Tor Project is rewriting its relay code in Rust, moving away from a C implementation with a large set of configuration options that Dingledine said had become hard to build reliably on stable Linux distributions. Part of the fix is about who runs relays at all. Relay capacity remains concentrated in Europe, and Dingledine said growth in the United States lags behind.
“So, we live in a world where it’s increasingly important for us to help the people here in the U.S. And I would like your help trying to help make the Tor network stronger,” he said.
