On Monday, 12 October 2026 19:48 Marco Moock via tor-relays wrote:
Does it help that less relays have the HSDir flag for the attacker?
HSDir's are the 'decentralized' DNS servers of the darknet. They are essential for Hidden (Onion) Services to function! Law enforcement is killing the other relays in order to collect the .onion addresses using their own HSDir. Usually the start of an LA operation for subsequent timing analyses and guard discovery. The nice neighbor on the server rack above me (the one with the powerhouse CPU) got the journalists' documents back then. https://marx.wtf/2024/10/10/law-enforcement-undermines-tor/ https://marx.wtf/2024/09/25/operation-liberty-lane/
What about the many relays with low bandwidth running at home-user sites? Are they also being attacked that much?
I have no idea what criteria these guys have, but servers in the data center are certainly preferred for dynamic IPs.
I operate a relay that got and lost the guard flag many times, but keeps the HSDir flag. I currently do not see attacks that make the relay unusable or something else.
With relais @home, the guard flag often comes and goes due to the calculation 'xy days running & your bandwidth % compared to all guards'. Quote from dir-spec/assigning-flags-vote “Guard” – A router is a possible Guard if *all* of the following apply: - It is Fast, - It is Stable, - Its Weighted Fractional Uptime is at least the median for "familiar" active routers, - It is "familiar", - Its bandwidth is at least AuthDirGuardBWGuarantee (if set, 2 MB by default), OR its bandwidth is among the 25% fastest relays, - It qualifies for the V2Dir flag as described below (this constraint was added in 0.3.3.x, because in 0.3.0.x clients started avoiding guards that didn't also have the V2Dir flag). -- ╰_╯ Ciao Marco! Debian GNU/Linux It's free software and it gives you freedom!