  Anonymous Communication designs such as Tor build their security upon
distributing the trust in many volunteers running relays in many locations
globally. In practice, it leads to a heterogeneous network in which many
versions of the same Tor software exist, with a different set of protocol
features. Because of the heterogeneous aspect of the network, the maintainers
employ forward-compatible protocol design strategies to maintain network
extensibility. These strategies aim to guarantee that different versions of the
Tor software interact without unrecoverable errors. In this work, we cast the
protocol tolerance enabled with forward-compatible protocol considerations as a
fundamental security issue. Despite being beneficial for the developers, we
argue that protocol tolerance is the cause of many strong attacks against Tor
in the past fifteen years. To address this issue, we propose FAN for Flexible
Anonymous Network, a new software architecture for volunteer-based distributed
networks that shifts the dependence away from protocol tolerance without losing
the ability for the developers to ensure the continuous evolution of their
software. We realize an implementation, evaluate the overheads and, experiment
with several of FAN's benefits to defend against a severe attack still
applicable to Tor today.
