[tor-talk] DocTor's 'Possible Sybil Attack' (2015-06-03) report

[Philipp Winter]

On Thu, Jun 04, 2015 at 10:39:03AM +0000, nusenu wrote:
> > These relays have previously been excluded from the Tor network.
> > They have now tried rejoining with new fingerprints. All of the
> > following relays are confirmed as being managed by the same
> > operator.
> 
> Again, I really dislike the in-transparency here.

I agree that it needs improvement.  In theory, we already have a public
repository for blacklisting relays:
<https://gitweb.torproject.org/authdirbadexit.git/>

In practice, nobody has had time yet to put all existing rules in the
new repository.  Also, it's called "authdirbadexit" and it would be
great if AuthDirReject and AuthDirInvalid rules could be published as
well.

> Could you share a bit more information?
> (or if it is already available somewhere, a url is enough)
> 
> Which relays where excluded? (identified by fingerprints)
> When were they excluded?
> How have they been excluded? (specific IPs, entire IP blocks,
> fingerprints, ...)
> Why have they been excluded?

I attached a list of fingerprints that were rejected by the directory
authorities around May 20.  All these relays were HSDirs and actively
scanned hidden services they were responsible for.

Cheers,
Philipp