In today's Tahoe-LAFS' Nuts & Bolts meeting, @warner suggested that anonymity modes (i.e., configuring Gridsync to connect to storage nodes over Tor/i2p) should not be toggleable by users after the initial grid configuration procedure has completed. Such a restriction would aim to prevent the scenario in which a user might be led to (mistakenly) believe that anonymity can be trivially restored after it has already been jeopardized (in this case, as a consequence of having previously connected over a regular/"clearnet" connection).

To be sure, anonymity works in a unidirectional fashion and is naturally irrevocable upon disclosure: an individual can easily choose to break anonymity, but, in the very act of doing so, they give up the ability to restore it without taking additional measures. The user interface must convey this.

In practice, this involves removing (or at least disabling) the "connection mode" option from the current preferences dialog (pictured below) and placing it instead somewhere into the initial grid configuration procedure.

Additional measures may need to be taken on top of this (e.g., in providing proper warnings to the user), however, the end goal remains that users wishing to connect to storage services anonymously should be required to do so from the very beginning.