I'm probably going to take some flack for this, but I don't trust Tor. When you access Tor, you're masking your origin IP to the remote address by trusting one

I'm probably going to take some flack for this, but I don't trust Tor. When you access Tor, you're masking your origin IP to the remote address by trusting one of a couple hundred volunteer exit nodes who raised their hands and said "Trust me! You can route all of your internet traffic through me and I promise I won't monitor or inject anything..." I think most Tor users don't have an adequate understanding of the threat model. It doesn't help that the Tor Project has at times upsold the anonymity provided to a ludicrous extent[1] (to be fair, they do address the risk in their FAQ[2]). Is it more likely that that Comcast will MITM me, or some random exit node? I might expect Comcast to maybe inject an ad into an HTTP connection or do some DNS redirect to shoot me an advertisement, but I don't worry about them stealing my credit card or injecting a buffer overflow or something. In fact, they have a profit incentive to not do so. I don't have that guarantee with a random exit node. It might be a generous privacy advocate, or it might be someone who has more nefarious profit incentive in mind[3]. If you're only connecting through Tor just to avoid the NSA, then you have to assume that both a) the NSA is targeting you to begin with, and b) that exit node you're going through isn't controlled by the NSA (or GCHQ/FSB/PLA/etc). sslstrip[4] undermines the prospect of protecting yourself by connecting solely over SSL through Tor. Even then, in my experience more than half of the sites I visit don't support SSL to begin with. The HTTPS Everywhere plugin that EFF provides and is included in the Tor Browser Bundle is implemented backwards - it connects over SSL only when the site matches a whitelist[5] (I use KB SSL Enforcer on Chrome myself). Sorry if this came off as a rant - I just see too many articles like this that prop up Tor as a silver bullet without discussing the risks and establishing an adequate threat model that allows the user to make an informed decision regarding the risks/benefits of using Tor. [1] http://betaboston.com/news/2014/05/07/as-domestic-abuse-goes-digital-shelters-turn-to-counter-surveillance-with-tor/ http://betaboston.com/news/2014/05/07/as-domestic-abuse-goes... [2] https://www.torproject.org/docs/faq.html.en#AttacksOnOnionRouting https://www.torproject.org/docs/faq.html.en#AttacksOnOnionRo... [3] http://threatpost.com/small-number-of-malicious-tor-exit-relays-snooping-on-traffic http://threatpost.com/small-number-of-malicious-tor-exit-rel... [4] https://www.youtube.com/watch?v=ibF36Yyeehw https://www.youtube.com/watch?v=ibF36Yyeehw [5] https://www.eff.org/https-everywhere/faq https://www.eff.org/https-everywhere/faq