I think you are referring to the following lines in my write up:
“There are cases where attackers have control or observe certain relays and they can be used to see the victim’s browsing. However, such chances are also nullified because the TOR guard nodes are changed for every hop”

I have written this to specify cases such as Predecessor attack and Denial of Anonymity attack where the attackers can control certain relays. And yes, TOR guard nodes do change. Please refer the link https://blog.torproject.org/improving-tors-anonymity-changing-guard-parameters for complete details on the same.

CHFI, ECIH and CEH || Security Analyst by profession || Admirer and practitioner of lucid writing!

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store