Ephemeral Exit Bridges for Tor

This paper examines an existential threat to Tor---the increasing frequency at which websites apply discriminatory behavior to users who arrive via the anonymity network. Our main contribution is the introduction of Tor exit bridges. Exit bridges, constructed as short-lived virtual machines on cloud service providers, serve as alternative egress points for Tor and are designed to bypass server-side censorship. Due to the proliferation of managed cloud-based desktop services (e.g., Amazon Workspaces), there is already a surprisingly large fraction of web requests that originate in the cloud. Trivially disrupting exit bridges by blocking requests from the cloud would thus lead to significant collateral damage. Our experiments demonstrate that exit bridges effectively circumvent server-side blocking of Tor with low overhead. Additionally, we perform a cost-analysis of exit bridges and show that even a large-scale deployment can be done at low cost.

I. Introduction

Tor [12] is used by millions of daily users [27], [49], most of whom use the anonymity network to privately browse the web [27]. Blocking access to the relays that comprise the Tor network is trivial: the network locations of the relays are public (to allow for source routing) and can be straightforwardly enumerated and subsequently blocked. To prevent such blocking, the Tor Project has responded by developing new obfuscation protocols [16], [31], [54] that allow Tor clients to covertly communicate with bridge relays-Tor relays whose network locations are not advertised by the directory servers.