For example you should assume the entry point is owned by an attacker, which means they know via your IP that you use Tor, how often, and at what times of day y

For example you should assume the entry point is owned by an attacker, which means they know via your IP that you use Tor, how often, and at what times of day you do it. In addition you should assume that the exit point is owned by an attacker, which means they know which sites are receiving Tor traffic. The Tor Browser has HTTPS Everywhere which is rather misleadingly named. It still loads stuff over HTTP if it doesn't know of an HTTPS alternative to that particular site. So you should assume that everything you load over HTTP has been trojaned or contains attacks like EgotisticalGiraffe. This applies even if the HTTP site you visit is not compromised or dodgy since the exit node will rewrite content on the fly. https://www.zdnet.com/article/rogue-tor-node-wraps-executables-with-malware/ https://www.zdnet.com/article/rogue-tor-node-wraps-executabl... If the site you visit is shady enough then that has also been compromised and is serving you malware over HTTPS. https://thenextweb.com/security/2016/11/11/the-fbi-likely-ran-nearly-half-the-child-porn-sites-on-the-dark-web-in-2016/ https://thenextweb.com/security/2016/11/11/the-fbi-likely-ra... Good luck with the sandbox https://venom.crowdstrike.com/ https://venom.crowdstrike.com/