It has been known in the security community that a tool as versatile as Tor is likely the target of intense interest from intelligence agencies. While the FBI has admitted responsibility for a Tor malware attack, the involvement of SIGINT organizations has not been confirmed.

Any doubt was removed in early October, 2013 with The Guardian's release of "Tor Stinks," an NSA presentation (vintage June 2012) outlining current and proposed strategies for exploiting the network.

Some salient points:

• Fundamentally, Tor is secure
• ...however, de-anonymization is possible in certain circumstances
• "Dumb users" will always be vulnerable (designated internally as "EPICFAIL")
• NSA/GCHQ operate Tor nodes
• Traffic analysis, in various forms, appears to be the tool of choice

After reviewing the literature, what changes should Tor users implement to ensure -- to the greatest degree technically feasible -- their continuing security?

It has been known in the security community that a tool as versatile as Tor is likely the target of intense interest from intelligence agencies. While the FBI has admitted responsibility for a Tor malware attack, the involvement of SIGINT organizations has not been confirmed.

Any doubt was removed in early October, 2013 with The Guardian's release of "Tor Stinks," an NSA presentation (vintage June 2012) outlining current and proposed strategies for exploiting the network.

Some salient points:

• Fundamentally, Tor is secure
• ...however, de-anonymization is possible in certain circumstances
• "Dumb users" will always be vulnerable (designated internally as "EPICFAIL")
• NSA/GCHQ operate Tor nodes
• Traffic analysis, in various forms, appears to be the tool of choice

After reviewing the literature, what changes should Tor users implement to ensure -- to the greatest degree technically feasible -- their continuing security?

It has been implicitly known in the security community that a tool as versatile as Tor is likely the target of intense interest from intelligence agencies. While the FBI has admitted responsibility for a Tor malware attack, the involvement of SIGINT organizations has not been confirmed.

Any doubt was removed today, with The Guardian's release of "Tor Stinks," an NSA presentation (vintage June 2012) outlining current and proposed strategies for exploiting the network.

Some salient points:

• Fundamentally, Tor is secure
• ...however, de-anonymization is possible in certain circumstances
• "Dumb users" will always be vulnerable (evidently designated internally as "EPICFAIL")
• NSA/GCHQ operate Tor nodes
• Traffic analysis, in various forms, appears to be the tool of choice

After reviewing the literature, what changes should Tor users implement to ensure--to the greatest degree technically feasible--their continuing security?

It has been known in the security community that a tool as versatile as Tor is likely the target of intense interest from intelligence agencies. While the FBI has admitted responsibility for a Tor malware attack, the involvement of SIGINT organizations has not been confirmed.

Any doubt was removed in early October, 2013 with The Guardian's release of "Tor Stinks," an NSA presentation (vintage June 2012) outlining current and proposed strategies for exploiting the network.

Some salient points:

• Fundamentally, Tor is secure
• ...however, de-anonymization is possible in certain circumstances
• "Dumb users" will always be vulnerable (designated internally as "EPICFAIL")
• NSA/GCHQ operate Tor nodes
• Traffic analysis, in various forms, appears to be the tool of choice

After reviewing the literature, what changes should Tor users implement to ensure  -- to the greatest degree technically feasible  -- their continuing security?