it’s difficult to find information on the topic which is why i’m posting here. a large number, likely a majority, of tor nodes are based in fourteen eyes countries. having both your entrance and exit nodes monitored (say, by their ISPs) opens you up to a more-or-less trivial timing correlation attack. on the other hand, blocking huge swaths of the network, according to the tor project, can open you up to deanonymization too.
it’s often been said that if your adversary is the intelligence agencies, you’re fucked anyway. that’s more than reasonable for active attacks. i don’t think that’s necessarily true for passive dragnet surveillance. so my question is, has anyone considered this particular vector of attack? is it better to block fourteen eyes or not? is it even worth asking the question?
Tor is shady as Sam Bent stated. They don’t take the necessary precautions to anonymize you the best way they can.
I’m not an expert on Tor at all, but it seems like a normal person with good intentions is unlikely to run a node which makes me suspect that a lot of nodes are run by people with incentives like intelligence agencies which makes me question how anonymous it actually is. But someone should correct me if I’m wrong.
Also I don’t think that nodes from said agencies would be limited to just their own jurisdiction.
I was curious about this very thing and started researching bridges once. I discovered that a small majority of bridges were run by weird hackers and small consulting groups, collectives or non-profits. One was even run by a hackerspace I was familiar with in SF (Noisebridge). I also run two bridges, that I set up when Russia invaded Ukraine and have left up. Both are hosted on DigitalOcean, so I wouldn’t trust them not to cooperate with authorities, but I don’t even look at their traffic (other than to note that they do indeed have traffic).
You can run a TOR node quite easily as a normal person. You cannot (or should not) run an exit node, however. As a middleman you receive encrypted traffic and send encrypted traffic. Even as an operator you don’t know the content, neither knows the big, probably watching guy.
