[tor-bugs] #25668 [Core Tor/Tor]: Write a proposal for using two guards, not one

[Tor Bug Tracker & Wiki]

#25668: Write a proposal for using two guards, not one
-------------------------------------------------+-------------------------
 Reporter:  nickm                                |          Owner:  (none)
     Type:  defect                               |         Status:  new
 Priority:  Medium                               |      Milestone:  Tor:
                                                 |  0.3.4.x-final
Component:  Core Tor/Tor                         |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:  034-roadmap-master,                  |  Actual Points:
  034-triage-20180328, 034-included-20180328     |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by cypherpunks):

 Things I'd like to see covered but haven't been in the tor-dev discussion:
 For bridges, would going for 2 guards be risky since it increases the
 chance that censor already knows one of the two bridges and thus can
 easily learn more bridges and censor them? What if the censor is
 unsophisticated and only blocks some bridges, if BridgeDB gives me 3
 bridge addresses, two of which have been already blocked by the censor,
 what will Tor then do with only one working bridge? Aren't people who hit
 such cases of only one working bridge going to be easily fingerprintable?
 How would this work with meek-amazon, would there be a need for two
 bridges there as well?

 It's clear that the argument for using 2 guards is straightforward, but
 designing it for bridges will require a nontrivial amount of thought.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/25668#comment:3>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online