Also, according to their latest blog post on their finances, while it is true they have money from the US Government, that was only ~50% of their income (I think that was 2023). For the FUD part of that comment, see the "U.S. Government Support" section of https://blog.torproject.org/transparency-openness-and-our-20...
And if you trust the NSA can’t overcome correlation in the presence of “padding defenses”, then sure: TOR is secure.
That is to say, if I started an onion server on one side of the world, then connected to it from somewhere else, my connection to it would be anonymous and encrypted to any external entity.
Uses a dataset created from aggregation of logs from all nodes in a simulated Tor environment to train a model that can identify the onion server's IP based on fingerprints created from that model.
>We ran the modified Tor software in the Shadow simulation environment to obtain a large amount of circuits for analysis. Shadow is a discrete-event network simulator developed specifically for Tor network simulation experiments and can run Tor software directly. Therefore, Shadow follows all logic related to Tor circuits. In the simulation environment provided by Shadow, we can build servers, clients, directory authorities, onion services and relays, and can control all nodes. Therefore, we can get circuit data in Shadow without the real Tor network.
This is: a) Not a real world example b) Not an example of interception of unencrypted traffic between a client and an onion site c) Not de-anonymization of a client
This: https://www.usenix.org/system/files/raid2019-iacovazzi.pdf
Is super interesting, it's a real world example of using collusion of an entry node that inserts "watermarked" data to identify an onion service.
It does not: a) Intercept or break encryption between client and onion service b) De-anonymize a client
This: https://www.ndss-symposium.org/ndss-paper/flow-correlation-a...
Is the same data watermarking scheme to use entry collusion to identify onion services.
None of your examples show that a connection to an onion server is insecure insofar as data integrity or client anonymity is concerned.
They’re financed by the US Government after all…