If bridges users configure at least two bridges in different /16s,

it makes it harder to run some kinds of statistical attacks on the

paths that they build through the Tor network. (For example,

working out that relays in that /16 are never used by the client.)

For context, see this Twitter thread:

I think that:

* most of the current default Tor Browser bridges are in at least two

   /16s, except for the single-bridge pluggable transports,

* almost all the 3-bridge sets given out by BridgeDB are in at least

   two /16s.

Should we:

* document this as a recommendation? Where?

* add code to Tor that warns when it isn't true? (Maybe not?)

* make sure all of the Tor Browser bridges are across two or

  three /16s?

* make sure BridgeDB gives out bridge sets in two or three

   /16s?

T