The FBI Identified a Tor User

I'll put it like this: if parts of the US government are using exploits to de-anonymise TOR users, which is hard to dispute, and they're funding the TP, which they are and always have done, and they're the US government, which has never had any qualms about interfering with companies that aren't funded by them, never mind ones that are, why do you think they wouldn't delay patches in order to maintain an exploit?

the US collective funds TOR so that they can exert control over the field of play, or even just keep it in sight. perhaps that control is relatively small and only used in extremely high-profile cases, but that's more useful than nothing at all

it's a parenting paradigm: it's safer for your kids to drink at home than out at a bar or in a park somewhere, because at least at home you can keep an eye on things

The fact that the three letters do more than spying on possible threats/terrorists, in particular, their practice for trying to cultivate future "agents of change" should send chills down the spine of any well paid and well educated tech workers.

I do believe that most people on HN qualify as "interesting" to these forces.

Most have CCTV

Not related to Tor, but food for thought regarding anonymity...

Quite a few people online wear multiple masks. You're that wonderful professional on linkedin with your full name on display, the ideal grandson on Facebook, but also a Twitter shitposter and toxic gamer under the disguise of anonymity.

Its worthwhile to consider the anonymous version of you. I'm imagining that it won't take long before a few dots can be connected. Not by the FBI, surely they already can, but as a public service. AI reverse engineering your clicks, writing style, whatever other input.

Meaning, if there's a "socially less accepted" version of you, do worry. It seems inevitable to me that they ultimately get linked back to your true identity.

And to be clear, this isn't just about a burner account to let off some steam. Anonymity is also used to freely criticize employers, political ideas, the establishment in authoritarian regimes, and it's an essential defense for people/groups that are often the target of harassment.

To illustrate how easily this can go wrong, recently a giant Twitter dump resurfaced. It turned out to be a cleaned up 2 year old file, but it did send a lot of people into a moral panic. Specifically, some made the mistake to link their real identifiable email address to their burner account.

The bottom line is that anonymity is fragile and unlikely to last.

The situation is different, think about nodes and encrypted channels between them.

If you encrypt traffic on your host properly and send it off to a remote host, your ISP (node(s) in between) sees encrypted traffic.

If you create an encrypted VPN connection to a VPN providers server and then configure a second encrypted connection (e.g. through Tor) from that VPN providers server to a remote host, then your VPN provider is able to see exactly what happened on that VPN providers server; since that’s where the encryption (and decryption) happens.