Although the method of the attack didn't directly break Tor/VPN, the nature of it has compromised confidence in those technologies.

What good is using Tor or a VPN if I can't be sure any web page I load will compromise me? Suddenly every single link becomes a potential land mine... is the web server compromised? Is it safe?

You could argue that, of course, loading a malicious web page will do malicious things. But in this case, the malicious code is compromising all further web activity as well from the sounds of it.

AIUI the issue only occurs when you're browsing through tor with a browser profile that also contains logins to chinese websites linked to your identity.

This is why you shouldn't run your regular browser session through TOR for critical work and use the tor browser bundle instead, with a separate profile, with a as-paranoid-as-possible configuration (minimal cross-site requests! use µMatrix, not just noscript) if you really want to information leakage.

Tor itself can only do so much, it doesn't magically prevent your browser from telling the world that you're person X.

Tor Browser protects against these sorts of attacks very well. Just don't use Tor with a regular browser. https://twitter.com/torproject/status/610542145305464832

@dang: if one flags such a click-baity headline, will the account get banned/shadowed for that task? How do I know if my account has crossed the invisible line? Who can check that? The karma ratio indicator vanished from the profile page.

HN title reads: China has now compromised VPNs and Tor

I'm not sure I understand your question, but we don't ban accounts for either flagging or producing clickbaity headlines.

I only saw your question by chance. To reliably get a response, please email [email protected].

If one must click-bait, go all-in: "The Shockingly Disturbing and Weirdly Beautiful Chinese Compromise of VPNs and Tor"

To be fair, it's the NYT that has the "clickbait-y styled topic title".

The NYT title, "Chinese Hackers Circumvent Popular Web Privacy Tools", is more accurate than the HN title. China has not "compromised" TOR and VPNs, they've circumvented them. They remain intact and working as designed. "Compromosed" is the wrong word here. "Circumvent" is the correct word.