I've heard that a bitcoin node with only Tor connections is "trivial" to eclipse attack and that such nodes should maintain at least one (or more?) clearnet connections in addition. What is it about Tor that makes eclipse attacks trivial?
There is a good summary of this problem on the BIP324 website:
Proxy networks like Tor or I2P introduce a separate address space, independent from network topology, with a very low cost per address making eclipse attacks cheaper. In comparison, clearnet IPv4 and IPv6 networks make obtaining multiple network identities in distinct, well-known network partitions carry a non-trivial cost.
There is also a paper titled Bitcoin Over Tor Isn’t a Good Idea that goes into much more detail.
Connecting to the bitcoin network over TOR to make transactions as an user is a good practice (this is important to mention in case casual users misunderstand your question).
Running a full bitcoin node exclusively over TOR can lead to an eclipse attack performed by an adversary that controls enough TOR nodes.
This problem is not exclusive to TOR, and occurs in any scenario where an adversary controls a significant portion of the network (such as in countries where internet access is tightly controlled by the government).
What is it about Tor that makes eclipse attacks trivial?
It's not exactly trivial. The Bitcoin Over Tor Isn’t a Good Idea paper estimated that to get a 7% chance to perform an attack, it would cost 2500 USD per month. The cost is possibly higher today.
This type of attack can only be performed (at high probability) by entities with large financial resources, such as governments.
Avoiding eclipse attacks is not hard. Make sure that you:
- Connect to a diverse / trusted list of nodes or
- Connect over multiple different networks (for example, you can also use I2P or the clearnet)
- It is easier to get lots of onion addresses compared to IP
- An attacker with lot of Tor nodes could result in all outgoing connections with the attacker for some nodes using
- Tor nodes might not be able to see some transactions and blocks if too many nodes use
onlynet=onion, making it difficult for onion nodes to connect with clearnet nodes.
Note: Trusted onion peers added with
addnode could help and eclipse attacks are difficult as long as some nodes in the network connect to onion and ipv4 peers.