As for your Tor links: 1. Not even about Tor, rather about Tor Browser, which is a modified Firefox and is optional to use (and 100% unrelated to Tor as a prot

As for your Tor links: 1. Not even about Tor, rather about Tor Browser, which is a modified Firefox and is optional to use (and 100% unrelated to Tor as a protocol or daemon). Complaints about this can be directed to Mozilla. 2. Pando loves to fear-monger about Tor and draw 'conclusions' without actually supporting them. Notice how they represent a blog post stating "incapacitated" (ie. affecting availability) as "exposed" (ie. affecting confidentiality)? Notice how Pando nowhere actually describes how a lot of 'fake' nodes could supposedly compromise users? That's because they are not making a technical argument, and they don't understand the internals of Tor. They are just publishing a hit piece that sounds vaguely to the untrained ear like it might have some technical merit, without ever actually proving the assertion they're making. And their implied argument is wrong. 3. Ah, an actual issue with Tor. But look at the operative phrase: "The problem boils down to this – around 90% of Tor users are still using older software which can be hacked." It's an issue that has long been resolved, and was an implementation error rather than a fundamental issue with Tor. -- You're really not the first to try and claim that Tor is "broken" by pointing at a bunch of articles like this. The reality is that none of it actually means that Tor is broken, and the one attack on Tor that does exist (and that is very expensive to pull off) isn't even clearly described in any of these articles. If you're going to argue about the technical merit and security of different proxying techniques (because that's what they all effectively are), then at least inform yourself to a point where you actually understand how they work internally. Right now, you just look ignorant. I think icebrained nicely covered the other few points, aside from "installing a software program" and "cloud services" - in which case, I'd recommend you look into package/executable signing, how it provides some guarantee of consistency, and how you can use it to avoid dodgy software builds. This kind of thing is also exactly why many people avoid proprietary software and 'cloud services', by the way.