import EntryGuards faq entry

docs/en/faq.wml

@@ -79,6 +79,7 @@
     <p>Anonymity and Security:</p>
     <ul>
     <li><a href="#KeyManagement">Tell me about all the keys Tor uses.</a></li>
+    <li><a href="#EntryGuards">What are Entry Guards?</a></li>
     </ul>
 
     <p>Alternate designs that we don't do (yet):</p>
@@ -1363,6 +1364,60 @@ the same geographic location.
 
     <hr>
 
+[https://www.torproject.org/docs/faq#EntryGuards Answer moved to our new FAQ page]
+
+<a id="EntryGuards"></a>
+<h3><a class="anchor" href="#EntryGuards">What are Entry Guards?</a></h3>
+
+<p>
+Tor (like all current practical low-latency anonymity designs) fails
+when the attacker can see both ends of the communications channel. For
+example, suppose the attacker is watching the Tor relay you choose
+to enter the network, and is also watching the website you visit. In
+this case, the research community knows no practical low-latency design
+that can reliably stop the attacker from correlating volume and timing
+information on the two sides.
+</p>
+
+<p>
+So, what should we do? Suppose the attacker controls, or can observe,
+C relays. Suppose there are N relays total.  If you select new entry and
+exit relays each time you use the network, the attacker will be able to
+correlate all traffic you send with probability (c/n)^2^. But profiling
+is, for most users, as bad as being traced all the time: they want to do
+something often without an attacker noticing, and the attacker noticing
+once is as bad as the attacker noticing more often. Thus, choosing many
+random entries and exits gives the user no chance of escaping profiling
+by this kind of attacker.
+</p>
+
+<p>
+The solution is "entry guards": each user selects a few relays at random
+to use as entry points, and uses only those relays for entry.  If those
+relays are not controlled or observed, the attacker can't win, ever,
+and the user is secure.  If those relays *are* observed or controlled
+by the attacker, the attacker sees a larger _fraction_ of the user's
+traffic -- but still the user is no more profiled than before.  Thus,
+the user has some chance (on the order of (n-c)/n) of avoiding profiling,
+whereas she had none before.
+</p>
+
+<p>
+You can read a bit more at http://freehaven.net/anonbib/#wright02,
+http://freehaven.net/anonbib/#wright03, or
+http://freehaven.net/anonbib/#hs-attack06.
+</p>
+
+<p>
+Restricting your entry nodes may also help against attackers who want
+to run a few Tor nodes and easily enumerate all of the Tor user IP
+addresses. (Even though they can't learn what destinations the users
+are talking to, they still might be able to do bad things with just a
+list of users.)
+</p>
+
+    <hr>
+
     <a id="EverybodyARelay"></a>
     <h3><a class="anchor" href="#EverybodyARelay">You should make every Tor
     user be a relay.</a></h3>