[tor-bugs] #17773 [Tor]: Should clients avoid using guards that lost the Guard flag?

[Tor Bug Tracker & Wiki]

#17773: Should clients avoid using guards that lost the Guard flag?
-----------------------------+--------------------------------
     Reporter:  arma         |      Owner:
         Type:  enhancement  |     Status:  new
     Priority:  Medium       |  Milestone:  Tor: 0.2.8.x-final
    Component:  Tor          |    Version:
     Severity:  Normal       |   Keywords:
Actual Points:               |  Parent ID:
       Points:               |    Sponsor:
-----------------------------+--------------------------------
 Nick and I both thought that at least in the past, Tor clients would stop
 using a relay as their guard, if it loses the Guard flag.

 But it looks like the code doesn't do that -- once a relay is your guard,
 you'll use it in the guard position regardless of whether it has the Guard
 flag at this moment or not.

 This is actually a tricky design decision. In favor of avoiding guards
 that don't have the guard flag:

 - If they get really slow, we can instruct clients to abandon them.
 - If a relay gets the guard flag for only a short period of time, it will
 have only a small number of (dedicated) users using it for the next
 months.

 In favor of using non-Guard guards anyway:

 - An attacker can't push you away from your guard by hurting its
 performance in the eyes of the directory authorities.
 - You won't rotate guards as many times.

 That "can't push you away" one looks big. What other aspects should we be
 considering here?

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/17773>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online