> Is Tor still considered secure? Define "secure." Secure from what attackers, in what threat model, with what resources devoted to the attack, etc. There ar

> Is Tor still considered secure? Define "secure." Secure from what attackers, in what threat model, with what resources devoted to the attack, etc. There are several categories of attack against Tor, and several ways to mitigate them, depending on who you are and what you use Tor for. For a typical end user of Tor, the main one to worry about is "browser beaconing" style attacks - where a compromised onion website causes the browser to beacon out, on the clearnet, with something that links the browser's request on the clearnet to the browser's activity on the onion network. If you just use a regular browser proxied to Tor, this is a rather high risk, as browsers leak all sorts of things (I believe WebRTC was a common way of doing it for a while). The solution here is Whonix - a multi-VM setup in which your workstation (with a stripped down browser) is only connected to a Torification VM that routes all inbound traffic over Tor. So, if the browser tries to beacon out, it doesn't matter. Pop open a command shell and use ping, it still goes out through Tor. Etc. I consider this a reasonable way to use Tor, and any lesser construct is probably a dumb idea unless you're using it for things like sysadmin where beaconing out doesn't matter. Of note, Qubes supports the Whonix configuration as a first party sort of setup, and can route all your traffic through Tor, should you care. There's also the risk of traffic correlation for end users, but I don't have a sense for the scale of this risk - I wouldn't leave long running connections over Tor, but I don't know if it matters for "casual use." If you're hosting hidden services, the "guardian nodes" that know your identity are a risk, and given how many nodes seem to be run by three letter agencies, you'll want to deeply understand Tor and how to protect your services if you're going to host something - I believe you can limit guardian nodes to those you trust (and run yourself, perhaps?), but that changes some of the risk equations in ways I don't fully understand how to reason about (not running hidden services that matter - my blog has an .onion address, but it's literally just the same content as the clearnet version). And then, we get into the problem that "computers in general" could be argued very convincingly to be "not in the slightest bit secure against a high level adversary," which is another can of worms...