[tor-talk] MyFamily requires a mutual agreement

Sun Apr 26 15:57:53 UTC 2015

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

> This makes for an interesting counter-example: if the MyFamily 
> declaration was used as reason for setting BadExit on related
> exits, a malicious adversary could set their MyFamily to the same
> as a good exit cluster, and then intentionally behave badly, in
> order to get the good cluster flagged as BadExit.
> 
> My point is, the MyFamily declaration is completely
> unauthenticated, and cannot be relied upon for anything more than
> providing contact information. There is a newer iteration being
> discussed that would prevent relays from joining families without
> permission, but then a malicious exit provider would have even less
> motivation to set it up.

Since MyFamily declarations have to be mutual to actually build a Family
group, your described attack scenario does not work.