<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">Hi all,<div><br></div><div>If bridges users configure at least two bridges in different /16s,</div><div>it makes it harder to run some kinds of statistical attacks on the</div><div>paths that they build through the Tor network. (For example,</div><div>working out that relays in that /16 are never used by the client.)</div><div><br></div><div>For context, see this Twitter thread:</div><div><a href="https://twitter.com/twbtwb/status/943974051000721408">https://twitter.com/twbtwb/status/943974051000721408</a></div><div><br></div><div>I think that:</div><div>* most of the current default Tor Browser bridges are in at least two</div><div> /16s, except for the single-bridge pluggable transports,</div><div>* almost all the 3-bridge sets given out by BridgeDB are in at least</div><div> two /16s.</div><div><br></div><div>Should we:</div><div>* document this as a recommendation? Where?</div><div>* add code to Tor that warns when it isn't true? (Maybe not?)</div><div>* make sure all of the Tor Browser bridges are across two or</div><div> three /16s?</div><div>* make sure BridgeDB gives out bridge sets in two or three</div><div> /16s?</div><div><br></div><div>T</div><div><div><br></div><div><br></div></div></body></html>