Well, kmf is actually talking about a different attack from the one published in the paper that started this thread. He's talking about a well known attack published in 2006 which you can read here: http://freehaven.net/anonbib/date.html#hs-attack06 That one doesn't require an entry guard to be taken over. It just requires LE to identify an entry guard by opening up many connections to the hidden service, and it's a lot scarier because it only takes 1-2 hours to find the entry guard, although probably days to weeks longer to monitor it and find the hidden service. However, that's way shorter than the 4-8 months it takes to carry out the attack in the recent paper. The best defense against the 2006 attack is layered entry guards, which are discussed in the original paper and still not implemented. Relays are given the entry guard flag by the directory authorities. Entry guards are chosen based on uptime and bandwidth. So right now there are about 3500 relays and 1200 entry guards. Here's a graph of how they change over time: https://metrics.torproject.org/network.html?graph=relayflags&start=2012-02-29&end=2013-05-29&flag=Running&flag=Guard#relayflags Your Tor client picks 3 entry guards and sticks with them for a month at a time. It does this "randomly" but based on bandwidth, otherwise small guards would be overloaded and the Tor network would be even slower. Your Tor client builds new circuits every 10 minutes, so before entry guards were created, your client would pick new entry nodes every 10 minutes. Going from 10 minutes to 1 month with the same entry nodes, you can see that was a big change in Tor client behavior. In the 2006 attack, LE opens many connections to a hidden service, until one of them happens to pass through a node they control, which is one hop away from the entry guard. That way they can identify the entry guard. Allowing people to choose the nodes in their circuits would make their circuits distinguishable, because of individual biases in how they selected nodes, and that would reduce their anonymity. Your anonymity is maximized when you look like everyone else, and more people that look just like you, the bigger your anonymity set. That's why you should stick to the defaults in your browser bundle, we all should, so we'll all look the same. That being said, you *can* choose your own entry and exit nodes, it's just not recommended.