The New Yorker Strongbox
I was discussing with a colleague whether tor is still trustworthy these days: running exit nodes without ending up in jail or thrown out by your ISP becomes more and more difficult (if it's not impossible already). Also tor still gets a lot if bad press as being nothing but a medium for child porn consumers to hide their tracks.As such I wonder whether there are exit nodes (or even just plain nodes) left that are not being run by governments as honeypots?How can you be sure that the data you are submitting is not intercepted? How can I be sure that all my traffic is not running through one government network (because all tor nodes still left are compromised)? How can I be sure that I'm actually submitting my information to the New Yorker in this case as opposed to a government server posing as them?The announcement page linked is not being served over SSL and the onion URL given isn't using ssl either (as if any ca would sign a cert for that domain, but if the linked page was served over SSL they could publish a fingerprint there)If I had important information to leak, I would probably still have an otherwise uninvolved colleague drop by in person to dump the data for that one (and only one) time. If I had a friend willing to take the risk.Or if there was an EV signed page of the New Yorker listing an SSL fingerprint of a certificate that's used by that tor server, then maybe I could live with the fact that tor is likely compromised.Then again, maybe I'm just a paranoid coward. I'm so glad I don't have access to information anybody would be interested in.