Tor, is no longer safe and secure. Concerted efforts by multiple governments recently shut down over 400 Tor sites (most of which were selling drugs or laundering money. Tor offers no explanation as to how this happened because they don’t know. Thus, future compromising of Tor sites is now a certainty, assuming a government is seriously interested in its activities.
The joint effort was called Operation Onymous. “Onymous” means “giving or bearing an author’s name – opposed to ‘anonymous’.” Yuck, yuck.
Tor admits to being blindsided by the attacks.
Over the last few days, we received and read reports saying that several Tor relays were seized by government officials. We do not know why the systems were seized, nor do we know anything about the methods of investigation which were used. Specifically, there are reports that three systems of Torservers.net disappeared and there is another report by an independent relay operator. If anyone has more details, please get in contact with us. If your relay was seized, please also tell us its identity so that we can request that the directory authorities reject it from the network.
Governments are now quite sophisticated in their attacks on Tor.
By targeting a specific hidden service with a relatively low-powered network attack exploiting Tor’s Hidden Services Protocol, law enforcement agencies could have “destroyed” the Hidden Services Directory “lookup circuits” for those services and forced new connections to be made through Tor nodes controlled by law enforcement. Doing so would lead law enforcement to the guard node for a hidden service, allowing them to physically locate it and in turn (through monitoring the guard node) find the location of the hidden service itself.
Compromise the guard node and the hidden site is compromised. Tor admiits this is a major problem and a weak link in the system.
Another possible Tor attack vector could be the Guard Discovery attack. This attack doesn’t reveal the identity of the hidden service, but allows an attacker to discover the guard node of a specific hidden service. The guard node is the only node in the whole network that knows the actual IP address of the hidden service… We’ve been discussing various solutions to the guard discovery attack for the past many months but it’s not an easy problem to fix properly.
Use Tor if you want. But don’t assume you are anonymous.