[1] http://motherboard.vice.com/en_au/read/carnegie-mellon-unive...
And the more troubling aspect is that the courts have accepted the government's arguments that no warrant is required to disclose IP addresses:
> ... Tor users clearly lack a reasonable expectation of privacy in their IP addresses while using the Tor network. In other words, they are taking a significant gamble on any real expectation of privacy under those circumstances.
If both of these statements are true (that the government could easily run a majority of Tor relays, and that the government does not need a subpoena), then any particular vulnerability being patched is irrelevant to the inherent insecurity of the network.
This doesn't make it bad software; it's the best we have, and being able to monitor traffic across the entire Internet is a huge ask of an attacker.
But I'd expect that to change, a low-latency network like tor that also doesn't create cover traffic just architecturally isn't equipped to deal with something approaching a global passive adversary. Though networks for even that can be built..
AFAIK, Tor developers are willing to implement cover traffic; the main reason it hasn't happened so far is that there is no known way to do this that clearly helps against that kind of threat. Until we have this (either from academic research, the Tor Project's own efforts or something else), it would be at best a placebo.
In other words, its not gonna protect you from the NSA, ever, nor was it meant to. It might have a fightning chance against the FBI though. Actually it was surprising how in Snowden's files, the NSA was having trouble reliably deanonymizing targeted tor users.
It was bad that Tor didn't notice the large number of new relays joining the network but greater vigilance is being shown.
Tor is effective against many threat models and yet many attacks are known. Further work is required.
Secure against what or who? Nothing is completely secure.
Your browser isn't secure, and most Tor users are using browsers over it to visit websites. All an attacker has ever needed to do is compromise your browser.
I thought the whole point of Tor was that it would work against highly capable or motivated adversaries?
Honestly, if you are doing things so naughty (which I don't advocate) that you are worried about state adversaries using lots of resources to track you down, you probably need a level of OpSec that you are not likely to achieve without being supported by another state level espionage agency. But at the very least you should be disguising yourself (in such a way that you still blend in), you should not be accessing an AP within a few hundred miles of where you actually live, you should probably not be driving your personal vehicle anywhere near the AP you log into (instead, using public transport paid with cash and then sitting on a park bench near the AP), you should probably be using a computer you purchased second hand from a thrift store with cash at least 6 months ago, you should probably wear gloves, you should probably dispose of the computer in a public dumpster in a different town than you accessed the AP. Hell, you probably shouldn't even download TAILS from an IP you control, I have no doubt every Tor Bundle and TAILS and WHONIX download is logged for cross referencing. Even with all of that, I honestly doubt that in the current climate a normal, highly careful person could remain anonymous if they were targeted by a major western intelligence agency like the NSA or the GCHQ.
Obviously this means you are doing something illegal but undetected, like spying for the Russians or Chinese in the West, spying for the West in Russia or China, etc.
OTOH, if you are doing something like exposing human rights violations in China/Russia/Iran/etc. where, by its very nature, the results of your (in that place) illegal activity are published, you are far more likely to be targeted.
Which distro? One known problem is that browsers still transmit their location. If the network and the laptop are hundreds of yards distant, that's an instant red flag. Once that problem is corrected, there may be unknown problems to deal with.
Nearly a year-and-a-half after CMU canceled a Black Hat presentation, hints were dropped that CMU's Tor-related efforts may not have been for research purposes only. An anonymous tipster claimed the FBI had paid CMU $1 million to unmask Tor users. A quasi-confirmation popped up during the DOJ's prosecution of Brian Ferrell, who was allegedly assisting Blake Benthall in running Silk Road 2.0. Ferrell and Benthall were both swept up in the wake of a Tor-related FBI raid known as "Operation Onymous," which began a few months after the hastily-cancelled Black Hat talk.
Included in the information handed over to Farrell's legal representative was the following:
On October 13, 2015, the government provided defense counsel a letter indicating that Mr. Farrell’s involvement with Silk Road 2.0 was identified based on information obtained by a “university-based research institute” that operated its own computers on the anonymous network used by Silk Road 2.0.
[1] https://www.techdirt.com/articles/20160225/07295633707/silk-...