As for using a bank account or email, I would feel perfectly safe using both over Tor, as long as I entered the https: myself DNS lookups are made through Tor.

As for using a bank account or email, I would feel perfectly safe using both over Tor, as long as I entered the https: myself DNS lookups are made through Tor. This means that a compromised exit node could phish your email or bank account. Unless you do the DNS lookups yourself off-Tor, of course, but then you won't be anonymous. I would feel less safe using news websites, since my activity with these could be used to identify me as the same user over a number of exit nodes. How? Torbutton doesn't use your non-Tor browsing cookies. And you can block cookies altogether anyway. The second is the timing attack. Tor is low-latency and not a mix[3], so packet size & timing data can be correlated to determine whether two hostile nodes are on the same tunnel. You-H-N-H-Dest, where H are hostile nodes and N a neutral node. The one beside You is a guard node, and can determine its status as such by observing how often you connect to it (your node connects to only a small group of guard nodes). The second H is the exit node, and knows what the Destination is. A simple timing attack plus the mutual connection to N links your ip to the destination. There are 1800 tor nodes[4], I'll let you do the math on how long it would take an adversary with a very modest budget (or 20 zombies) to land two hostile nodes in this configuration. It's not very long, given that your 3 outbound tunnels reconstruct every 10 minutes. You're right on this. I knew about timing attacks, but I didn't know they were so easy. I though you needed a big infrastructure like Echelon. I think a solution for Iranians would be using I2P or Freenet, or even Tor if it's just with .onion websites, because then the traffic never leaves the darknet and therefore it's more resistant to a timing attack (You might need something like Echelon for a timing attack in this case). The problem is they wouldn't be able to use Twitter, Google or any other Internet sites.