- "Nation state attackers" don't possess unlimited and/or magical capabilities. There's a reasonable case that TOR is run by some US three-letter agency, but ev

- "Nation state attackers" don't possess unlimited and/or magical capabilities. There's a reasonable case that TOR is run by some US three-letter agency, but even that is by no means certain. The official story of some limited and non-offensive support by the State Department is still plausible, and the turf wars b/w State and the darker branches are legendary. - Beyond the US, China and Russia might have the resources and enough of an interest to undermine TOR. Everyone else has lots of other, lower-hanging fruit to attack first. I've had some interaction with Germany's efforts about a decade ago, and I wouldn't be surprised if their largest project back then is still ongoing, which was migrating away from Windows 95. - More nation states trying to attack TOR would probably lead to increased security, because the only known weak point is controlling both exit and entry nodes. - None of these agencies outside of 5-eyes plus maybe Israel & NATO would ever collaborate on something like this. - Your drug, porn, or even whistleblowing habits aren't even interesting enough to warrant investment in far more obvious avenues of investigation. If, for example, you semi-regularly buy a few hundred $ worth of bitcoin with your credit card but don't report/have any holdings, you're probably not spending it at the one or two remaining legal online stores accepting it. - Heck, there is some guy apparently working in the Trump administration, publishing an anonymous book this month. Considering we're probably talking about Harvard Law and not MIT grad here, and that the Prez isn't exactly known for letting strategic considerations get in the way of his gut instinct to exact revenge for personal slights, every day this person isn't outed is a pretty good argument against the tendency to consider the US security apparatus to be all-mighty. - In the alternative, if they are unwilling to compromise their methods for that target, you will probably never make it to the level where they would be willing to do it for you (sorry). - The same argument applies to all the dark markets, where history suggest retiring with a bunch of your customers' cash is just about as likely as somehow being caught. Most prosecutions also happened outside US jurisdiction, making me doubt suggestions of parallel construction.