>This means they are hosting the Tor bridge themselves, but the device's traffic is still going through the carrier's network in plaintext The traffic is encry

>This means they are hosting the Tor bridge themselves, but the device's traffic is still going through the carrier's network in plaintext The traffic is encrypted using the onion layering scheme on the device. The bridge node is the entry point for this traffic to the tor network. >an attacker on the other side of their bridge spinning up a fake Tor network The client creates the 'circuit', all the bridge node knows is who is connecting to it, it then unwraps its onion layer, finds an encrypted packet and a forwarding address and then sends it on.