How do Tor bridges differ from public relays and how are they discovered?
Executive summary
Bridges are functionally ordinary Tor relays configured to be “hidden” — they do not appear in the public Tor directory and are intended to let users reach Tor when public relays are censored or when revealing a direct Tor connection would be risky (Tor Project documentation) [1] [2]. They can be public (advertised only to Bridge Authorities) or fully private, and adversaries discover them through active network scans, traffic analysis, and by exploiting operational mistakes; researchers have demonstrated large-scale discovery (including ZMap scans that found roughly 79–86% of bridges) and academic work has catalogued additional detection techniques [3] [4].
1. What makes a bridge different from a public relay — the technical distinction
A bridge is “just a normal relay with a slightly different configuration,” but the critical operational difference is visibility: bridges are not listed in the public network-status documents that enumerate ordinary entry, middle, and exit relays, so censors can’t trivially block the whole set of entry points by downloading the public list (Tor Project support pages) [2] [5]. Bridges are typically used as a first-hop (guard) to hide that a user is connecting into the Tor network; after that hop, traffic traverses the normal public relay network [6] [7].
2. Variants and tools that increase secrecy — pluggable transports and private vs public bridges
To counter censorship that fingerprints or blocks Tor bootstrapping, bridges often run pluggable transports (like obfs4) that obfuscate protocol fingerprints; some bridges auto-publish to the Bridge Authority and are distributed to clients, while other bridges remain private and are shared out-of-band for high-risk users, creating layers of secrecy and differing threat models (Tor Project support and blog posts) [5] [8] [9]. The Tor Project also ships default bridges (for example in Tor Browser and Tails), but those are fewer and can be less reliable against powerful censors [6] [8].
3. How bridges are discovered — active scanning, operational leaks, and research findings
Discovery pathways are both technical and procedural: broad IPv4 scans looking for Tor protocol signatures or TLS cert patterns have recovered large fractions of bridge hosts in research, and security studies have combined scanning, certificate matching, and attempts to download bridge descriptors to verify and classify bridges, finding both public and private instances and revealing proxy/back-end infrastructures (Jordan Wright’s writeup and the NDSS paper) [3] [4]. The Tor Project acknowledges specific techniques and the cat-and-mouse nature of discovery, and has patched some issues exploited by researchers while warning that adversaries with scanning capability can still find many bridges [3] [4].
4. Trade‑offs and real‑world implications — reliability, blocking, and operator risk
Bridges reduce the risk of automated blocklisting of relay IPs because they aren’t in the public directory, but they are a scarcer, often slower, and sometimes less reliable resource than public relays; some censors (notably China and Iran) have developed methods to detect and block bridges, and published or poorly protected bridges rapidly lose usefulness (Tor Project docs and support notes) [1] [5] [6]. Running a bridge is low-risk compared to an exit relay and can be configured for low bandwidth, but when bridges are discovered their IPs may be blocked or their operators could attract scrutiny [1] [2].
5. Conflicting incentives and failure modes — when secrecy breaks and who benefits from exposing bridges
The system depends on controlled distribution: the Tor Project limits how many bridges a given user receives and maintains Bridge Authorities to manage addresses, but that design also creates pressure to automate discovery and to rotate addresses; academic attackers, nation-states, or misconfigured public listings (third parties posting bridge addresses) can all undermine bridge secrecy — indeed, forums note organizations that publish bridges publicly, which reduces their censorship-evasion value [8] [10]. Researchers and Tor maintainers run detection tools like “sybilhunter” to detect suspicious relay clusters, illustrating an implicit dual agenda: defenders want to protect users by finding problematic relays and removing risks, while censors want the same discovery techniques to find bridges and block them [9].