[tor-dev] Defending against guard discovery attacks by pinning middle nodes

[A. Johnson]

> It's interesting to reduce the HS path length, but that would reduce
> the length of the chain that the adversary has to walk, which is bad :/

Yeah, security in this attack model pushes towards a long path.

> The rendezvous model is a bit restricting isn't it :(

Agreed, modifying path selection just raises the attack time and effort some (although that “some” is a real improvement IMHO). Clearly users with a powerful global adversary should be able to survive eventual compromise of a server. It might be fun to build a system that would provide fault tolerance and protect the private HS information against individual server compromise. “Survivable HSes”? This seems doable :-)

Cheers,
Aaron