[tbb-bugs] #20212 [Applications/Tor Browser]: Tor can be forced to open too many circuits by embedding .onion resources

[Tor Bug Tracker & Wiki]

#20212: Tor can be forced to open too many circuits by embedding .onion resources
-------------------------------------------------+-------------------------
 Reporter:  gacar                                |          Owner:  tbb-
                                                 |  team
     Type:  enhancement                          |         Status:  new
 Priority:  Medium                               |      Milestone:  Tor:
                                                 |  unspecified
Component:  Applications/Tor Browser             |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:  guard-discovery,                     |  Actual Points:
  TorBrowserTeam201803                           |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by gk):

 Replying to [comment:10 cypherpunks]:
 > Replying to [comment:9 cypherpunks]:
 > > Why limit the number of onion addresses that can be embedded instead
 of limiting the number of circuits that can be created for onions in a
 single origin?
 >
 > The former should be relatively easy to implement in Tor Browser, while
 the latter would presumably be much more difficult and error prone (if
 implemented by monitoring circuit events on the control port). The simple
 approach of limiting the number of onions seems like it would indirectly
 limit the number of circuits, but reading the above question I'm suddenly
 having doubts. (How quickly can Tor Browser cause more circuits to be made
 by continually retrying just one onion that is failing to rendezvous?)

 Good question. I think we can spend some time figuring that out so we can
 come up with a good plan for fixing this bug.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/20212#comment:11>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online