it’s difficult to find information on the topic which is why i’m posting here. a large number, likely a majority, of tor nodes are based in fourteen eyes countries. having both your entrance and exit nodes monitored (say, by their ISPs) opens you up to a more-or-less trivial timing correlation attack. on the other hand, blocking huge swaths of the network, according to the tor project, can open you up to deanonymization too.
it’s often been said that if your adversary is the intelligence agencies, you’re fucked anyway. that’s more than reasonable for active attacks. i don’t think that’s necessarily true for passive dragnet surveillance. so my question is, has anyone considered this particular vector of attack? is it better to block fourteen eyes or not? is it even worth asking the question?
I was curious about this very thing and started researching bridges once. I discovered that a small majority of bridges were run by weird hackers and small consulting groups, collectives or non-profits. One was even run by a hackerspace I was familiar with in SF (Noisebridge). I also run two bridges, that I set up when Russia invaded Ukraine and have left up. Both are hosted on DigitalOcean, so I wouldn’t trust them not to cooperate with authorities, but I don’t even look at their traffic (other than to note that they do indeed have traffic).