{"id":6182,"date":"2026-09-05T10:02:18","date_gmt":"2026-09-05T01:02:18","guid":{"rendered":"https:\/\/eternalsphere.net\/echoes\/?p=6182"},"modified":"2026-09-12T17:17:51","modified_gmt":"2026-09-12T08:17:51","slug":"4wm1nj2dg0q88oc","status":"publish","type":"post","link":"https:\/\/blog.eternalsphere.net\/index.php\/2026\/09\/05\/4wm1nj2dg0q88oc\/","title":{"rendered":"Privacy and Exposure When Running a Public Tor Relay"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Operating a public Tor relay improves the diversity and capacity of the Tor network, but it also creates a deliberate public presence on the Internet.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The objective of good relay privacy is therefore not to make the relay invisible. That would be incompatible with being a public relay.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The realistic objective is:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Publish everything the Tor network needs, and nothing unnecessary about the operator.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">1. Information That Must Be Public<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A public relay necessarily exposes several pieces of information.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>public OR address<\/li>\n\n\n\n<li>ORPort<\/li>\n\n\n\n<li>relay fingerprint<\/li>\n\n\n\n<li>relay flags<\/li>\n\n\n\n<li>exit policy<\/li>\n\n\n\n<li>bandwidth-related information<\/li>\n\n\n\n<li>consensus weight<\/li>\n\n\n\n<li>software compatibility information<\/li>\n\n\n\n<li>first-seen and last-seen history<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Without these values, Tor clients could not safely discover and select relays.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">2. The Public IP Cannot Be Hidden<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Other Tor relays must know where to establish OR connections.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Public Relay\n     \u2193\nPublic IP\n     \u2193\nPublic ORPort<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">is fundamental to the design.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If hiding the server&#8217;s address is a strict requirement, a public relay is the wrong Tor role.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Bridges serve a different purpose and are intentionally less publicly discoverable.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">3. Relay Fingerprint<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Every relay has a long-term cryptographic identity fingerprint.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A fictional example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>91F84B0D...<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This is the true persistent identity of the relay.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Changing:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>nickname\nIP address\nORPort\ncontact information<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">does not create a new relay as long as the identity keys remain unchanged.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This persistence is essential for building stability history and trust.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">4. Nicknames Should Be Treated as Public Pseudonyms<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Relay nicknames are public and searchable.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A poor configuration would reuse an internal infrastructure hostname:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Nickname production-storage-03<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This unnecessarily reveals part of a private naming scheme.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A better approach is to use a dedicated public pseudonym:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Nickname IronHarbor<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The pseudonym should not contain:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>real name<\/li>\n\n\n\n<li>city<\/li>\n\n\n\n<li>employer<\/li>\n\n\n\n<li>ISP name<\/li>\n\n\n\n<li>personal username<\/li>\n\n\n\n<li>internal hostname<\/li>\n\n\n\n<li>other unique infrastructure identifiers<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">5. ContactInfo Is Also Public<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><code>ContactInfo<\/code> is useful because it gives the Tor community a way to reach a relay operator.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But it should be considered fully public.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A risky example is:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>relay@personal-domain.example<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">if that domain is also used for personal websites, email, or other infrastructure.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This creates a direct correlation:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Relay fingerprint\n      \u2193\npersonal domain\n      \u2193\nother public services\n      \u2193\noperator identity<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A cleaner design uses a dedicated address on an unrelated mail provider:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>relay-alias@example-mail.invalid<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The mailbox should ideally exist only for relay administration.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">6. GeoIP Information Is Unavoidable<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Public monitoring systems can infer approximate location from the relay&#8217;s public IP.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This may expose:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>country\nregion\ncity approximation\nlatitude\/longitude approximation<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">These values come from GeoIP databases rather than relay configuration.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">They should not be confused with precise GPS location.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">7. ASN Information Is Also Publicly Inferable<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The public IP belongs to an Autonomous System.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Public data can therefore reveal:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ASN\nAS organization name<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This may identify:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>an ISP<\/li>\n\n\n\n<li>hosting provider<\/li>\n\n\n\n<li>university<\/li>\n\n\n\n<li>company<\/li>\n\n\n\n<li>network operator<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This information cannot realistically be hidden while continuing to use that network address as a public relay.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">8. Reverse DNS Deserves Attention<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A public IP may have a PTR record.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>203.0.113.42\n    \u2193 PTR\ncustomer-42.isp.example<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A generic ISP PTR is usually harmless.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A custom PTR such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>personal-server.example.org<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">creates a much stronger identity link.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Relay operators should therefore inspect reverse DNS when performing a privacy audit.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">9. Software Information<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Public relay information may reveal broad platform data such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Tor 0.x.x on Linux<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This does not normally reveal:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>exact Linux distribution\nCPU model\nRAM size\nhypervisor\nlocal username\nstorage layout\nLAN address\nSSH configuration<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Attempting to obscure standard Tor compatibility information is generally unnecessary and can make operation less standard.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">10. Bandwidth Is Public but Limited in What It Reveals<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Relay Search may expose:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>bandwidth rate\nbandwidth burst\nobserved bandwidth\nadvertised bandwidth\nconsensus weight<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This can reveal roughly how much capacity is allocated to Tor.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It does not necessarily reveal the physical connection&#8217;s full speed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A relay capped at:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>30 Mbit\/s<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">could be operating behind a much faster Internet connection.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">11. Running History Is Public<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Tor metrics can record:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>First Seen<\/li>\n\n\n\n<li>Last Seen<\/li>\n\n\n\n<li>Last Restarted<\/li>\n\n\n\n<li>historical bandwidth<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This allows outside observers to determine roughly when a relay entered the network and when it has been available.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Long-term 24\/7 operation generally reveals less behavioral information than a highly regular personal on\/off schedule.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">12. Relay Family Relationships Are Public by Design<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Operators of multiple relays should correctly declare their family relationships.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This tells Tor:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">These relays are controlled by the same operator and should not be treated as independent for path diversity.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">Hiding such a relationship for privacy reasons would weaken Tor&#8217;s security model.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Correct family declaration is therefore more important than concealing the operational link.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">13. Cross-Service Correlation Is Often the Largest Remaining Risk<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Tor&#8217;s own directory metadata may be carefully minimized, while the same public IP exposes unrelated services:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>TCP 9443 \u2192 Tor\nTCP 443  \u2192 personal website\nTCP 22   \u2192 SSH\nTCP 8443 \u2192 administration panel<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">An external observer can scan the public IP and correlate:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>TLS certificates<\/li>\n\n\n\n<li>domain names<\/li>\n\n\n\n<li>HTTP titles<\/li>\n\n\n\n<li>service banners<\/li>\n\n\n\n<li>reverse DNS<\/li>\n\n\n\n<li>application-specific identifiers<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This can reveal much more than the Tor Relay Search page itself.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Separating relay infrastructure from personally identifiable services is therefore one of the strongest privacy improvements available.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">14. Public Relay Status Can Affect IP Reputation<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A public relay IP appears in openly available Tor relay lists.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Some anti-abuse systems classify such addresses broadly as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Tor-related<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">even when the relay is non-exit.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This can occasionally affect:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>account registration<\/li>\n\n\n\n<li>CAPTCHA frequency<\/li>\n\n\n\n<li>fraud detection<\/li>\n\n\n\n<li>rate limits<\/li>\n\n\n\n<li>website access<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">A non-exit relay does not forward Tor users&#8217; ordinary Internet traffic to external websites, so it does not have the same reputation risk as an Exit. Nevertheless, poorly differentiated blocklists can still create side effects.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">15. Changing Public Metadata Does Not Erase History<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Suppose a relay initially publishes:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Nickname OldName\nContactInfo old-address@example.invalid<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">and later changes to:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Nickname NewAlias\nContactInfo relay-contact@example.invalid<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Current Relay Search data will eventually show the new values.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, historical descriptors and third-party archives may still contain the earlier metadata.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>changing metadata\n=\nstopping future publication of old information<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">not:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>erasing every historical copy<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This is why privacy-sensitive metadata should ideally be chosen correctly before the relay is first published.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">16. A Minimal-Exposure Public Relay<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A well-designed public relay can reduce unnecessary operator information to approximately:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Required:\npublic IP\nORPort\nfingerprint\nTor metadata\nflags\nbandwidth information\nASN \/ GeoIP-derived location\n\nOptional but anonymized:\nneutral nickname\ndedicated relay-only contact address\n\nAvoided:\ninternal hostname\npersonal domain\npersonal email\nreal name\nprivate infrastructure names\nidentifiable PTR record\nunrelated public services on the same IP<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Perfect anonymity is not compatible with operating a <strong>publicly listed<\/strong> Tor relay. The relay itself must be discoverable.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The achievable privacy goal is instead separation:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Public relay identity\n       \u2502\n       \u2514\u2500\u2500 intentionally public\n\nPersonal \/ internal identity\n       \u2502\n       \u2514\u2500\u2500 deliberately unlinked<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Once the nickname, contact information, reverse DNS, and cross-service correlations are properly controlled, the remaining exposure is largely inherent to the role of a public Tor relay rather than unnecessary personal disclosure.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Operating a public Tor relay improves the diversity and capacity of the Tor network, but it also creates a deliberate public presence on the Internet. The objective of good relay privacy is therefore not to make the relay invisible. That would be incompatible with being a public relay. The realistic &hellip;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[120],"tags":[265,245],"class_list":["post-6182","post","type-post","status-publish","format-standard","hentry","category-1s3b6h7r2zay02x","tag-security","tag-tor"],"_links":{"self":[{"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/posts\/6182","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/comments?post=6182"}],"version-history":[{"count":1,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/posts\/6182\/revisions"}],"predecessor-version":[{"id":6183,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/posts\/6182\/revisions\/6183"}],"wp:attachment":[{"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/media?parent=6182"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/categories?post=6182"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/tags?post=6182"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}