There are many many tech companies which trigger a new Tor circuit refresh without user intervention. These happen most of the time because of new captcha request or to mitigate a potential abusive node. But often times genuine use cases get stuck in this too.
Let’s talk about Cloudflare for example. Even a simple visit to their website over Tor browser will continuously refresh the Tor exit nodes! Found this quite interesting as no matter the customization of the configuration, the exit node keeps changing within seconds not few minutes!
The torrc offers a lot of options but so far haven’t found a solution. Anyways to counter such measures?
That’s weird, your local Tor instance decides what circuits and exit nodes you use, not the service you visit. Tor Browser has stream isolation enabled though, so maybe Cloudflare is making you visit many different domains and this is resulting in many different exit nodes being used?
Disabling stream isolation in Tor Browser is not easy, despite the title of the wiki page documenting how to do it:
You might try something like that, but be aware that this will decrease your anonymity and you probably should not do this.
I noticed this at some domains that are interesting to use as honeypot a month ago. No Cloudflare captcha. I have seen it with Cloudflare too. Every few seconds the circuit change for a few minutes. The website might try to reload the circuit until it finds a known malicious exit. Once you’re on a malicious exit you can visit the website. I have bad faith
Something is there that is enforcing such frequent changing of nodes but I don’t know what exactly that is! I also don’t understand why change of nodes happen this fast? This is default browser profile. Since this didn’t work out, modified configuration a bit trying to keep nodes alive for more time along with host tracking and what not. Still no go!
Generic Bug Reproduction will most likely be required. Please try to reproduce this issue outside of Whonix, for example on plain Debian using Tor Browser.
Creation of new Tor circuit happens especially when known outcomes don’t meet the expected results. For example, test with Facebook by Meta. There too we get same results. The indirect measurement here is how the website behaves differently over Tor browser. In this case of Facebook, the nodes get changed so fast on its own that feels almost like some bug itself!
Checked across several distributions and results are same. Users are met with error 500. Any manual generation of new circuit won’t work as again the same loop starts. I know this sounds quite confusing and all but I am trying to learn is why and how such websites are doing this? How can an external website trigger a new Tor node when there is a defined set of rules within the network itself.
This issue is interesting one as no matter the deployment the results are consistent and errors too. In short, we get same unexpected behavior no matter what we try to modify on our end.
Invalid test method. Websites can act different over Tor or inside Tor Browser because the list of Tor exit relays is public by design, easily knowable and therefore for example easily blocked. See also:
The methodology might look unconventional but we are observing the same results as an indirect confirmation. Apart from that, the change in circuit is also present and evident. This is not that strange to happen but the rate at which this happens is quite interesting bypassing Tor’s own guidelines, maybe?
Let’s still assume this being an unspecified or unrelated subject but I hope we could try to solve the issue benefiting a large user base.