Troll Patrol: Anonymous User Reporting of Bridge Censorship
Authors: Vecna (University of Waterloo), Ian Goldberg (University of Waterloo)
Volume: 2026
Issue: 4
Pages: 964–982
DOI: https://doi.org/10.56553/popets-2026-0154
Artifact: Available, Functional, Reproduced
Abstract: Bridges are circumvention proxies that provide routes around censorship. In order to be effective, most bridges must be kept secret from censors, lest they be added to censors’ blocklists.
Reputation-based bridge distribution systems including rBridge, Hyphae, and Lox have been proposed with the goal of enabling regular users to learn about bridges while preventing censors from learning about and blocking these bridges. These three examples use anonymous credentials to preserve user anonymity while still allowing the anonymous users to gain reputation within the system if the bridges distributed to them remain unblocked for some period of time and penalizing them by reducing their reputations if the bridges distributed to them become blocked by censors. Performing these reputation changes requires these systems to have knowledge of which bridges have been discovered and blocked by censors and which are still accessible.
The obvious way to test whether a given bridge is accessible from a given region is by attempting to connect directly to that bridge from within that region; however, this approach carries risks, including that these scans may inadvertently reveal previously undiscovered bridges to a censor. Rather than actively scanning all bridges, we favor soliciting users to submit reports when their bridges are inaccessible and scanning only the bridges for which user reports have been received, to validate those reports. This approach reduces the set of bridges that must be actively scanned but also introduces new risks if implemented naïvely; namely, censors or malicious users might submit inaccurate reports in order to disrupt the bridge distribution system or induce additional scans. It might be tempting to tie users’ reports to their identities in order to penalize users who submit inaccurate reports, but doing so would violate user anonymity. Building on the anonymous credential systems used in, e.g., Hyphae and Lox, we design Troll Patrol, a scheme for users to submit reports that is resilient against malicious behavior, both by censors and by regular users, while still preserving the anonymity of the users who submit them.
Keywords: measuring censorship, bridges, anonymous credentials, Tor, Lox
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution 4.0 license.
