I'm making a personal effort to use TorBrowser whenever I have some trivial need to use a government website. I suspect I'd stop short of applying for a visa via TOR, but I'll happily look up my local state or federal politicians and their websites, or renew my car registration, or any of the other day-to-day things - in much the same way as I always choose to use BitTorrent for fully legal purposes when available - sure, we all know that 99% of Torrent traffic is copyright infringement, but at least _some_ of it is me grabbing the latest Ubuntu/Raspbian/GameOfThones (no, wait, not that last one...)
Here's some info on how to help: https://blog.torproject.org/blog/support-tor-network-donate-...
And that's why I encourage everybody I can to run a tor node
A: No. If law enforcement becomes interested in traffic from your exit relay, it's possible that officers will seize your computer. For that reason, it's best not to run your exit relay in your home or using your home Internet connection.
Instead, consider running your exit relay in a commercial facility that is supportive of Tor. Have a separate IP address for your exit relay, and don't route your own traffic through it.
Of course, you should avoid keeping any sensitive or personal information on the computer hosting your exit relay, and you never should use that machine for any illegal purpose.
This will reduce the monthly usage to 12GB and keep you under the 15GB limit. I've been running this bridge for a few months now and have never gone over.
A: Tor (like all current practical low-latency anonymity designs) fails when the attacker can see both ends of the communications channel. For example, suppose the attacker controls or watches the Tor relay you choose to enter the network, and also controls or watches the website you visit. In this case, the research community knows no practical low-latency design that can reliably stop the attacker from correlating volume and timing information on the two sides.
So, what should we do? Suppose the attacker controls, or can observe, C relays. Suppose there are N relays total. If you select new entry and exit relays each time you use the network, the attacker will be able to correlate all traffic you send with probability (c/n)2. But profiling is, for most users, as bad as being traced all the time: they want to do something often without an attacker noticing, and the attacker noticing once is as bad as the attacker noticing more often. Thus, choosing many random entries and exits gives the user no chance of escaping profiling by this kind of attacker.
The solution is "entry guards": each Tor client selects a few relays at random to use as entry points, and uses only those relays for her first hop. If those relays are not controlled or observed, the attacker can't win, ever, and the user is secure. If those relays are observed or controlled by the attacker, the attacker sees a larger fraction of the user's traffic — but still the user is no more profiled than before. Thus, the user has some chance (on the order of (n-c)/n) of avoiding profiling, whereas she had none before.
You can read more at An Analysis of the Degradation of Anonymous Protocols, Defending Anonymous Communication Against Passive Logging Attacks, and especially Locating Hidden Servers.
More to the point - I want the expectation of privacy and the deployment of tools to maintain privacy in the face of technological and legal "advances" in surveillance to seem closer to "technologically informed libertarian" rather than "paranoid wingnut" or "jetliner-hijacking 3rd-world-sympathiser".
"A global passive adversary is the most commonly assumed threat when analyzing theoretical anonymity designs. But like all practical low-latency systems, Tor does not protect against such a strong adversary. Instead, we assume an adversary who can observe some fraction of network traffic; who can generate, modify, delete, or delay traffic; who can operate onion routers of his own; and who can compromise some fraction of the onion routers."[1]
If your attacker is not "a global passive adversary"(GPA) what dots are they going to connect if you renew your car registration? If your attacker is a GPA they are already connecting all the dots.
[1] https://svn.torproject.org/svn/projects/design-paper/tor-des...
I'm assuming "they" have access to government servers and networks, and that they'll easily be able to connect me - as a real and (at least mostly) law abiding citizen - to a clean-slate browser using SSL over TOR - logging in to a government web server with real world credentials and doing some mundane and law abiding everyday task.
Which may well be true.
(But I'm still hoping my new 2048bit GPG key and a significant portion of tor nodes are _not_ NSA bugged...)
However, that doesn't mean there isn't a good reason to use it anyway to make a statement and promote legitimate usage of Tor.
Then, even if things get patched, it's mere existence and prevelence among the layman gives you a tremendous amount of plausible deniability while also increasing the strength of the network.
However, it's quite morally wrong to do so. I guess it's just one of those late-night thoughts.