&gt;If the anonymous user connects to a part of ProPublica that isn’t SSL-encrypted—most of the site runs SSL, but not yet every page—then the malicious relay could read what the user is viewing.<p>So using a hidden service was <i>easier</i> to set up than enforcing SSL on every page?<p>&gt;Or even on SSL-encrypted pages, the exit node could simply see that the user was visiting ProPublica. When a Tor user visits ProPublica’s Tor hidden service, by contrast—and the hidden service can only be accessed when the visitor runs Tor—the traffic stays under the cloak of Tor’s anonymity all the way to ProPublica’s server.<p>The exit node sees that <i>someone</i> visited Propublica, not who, or what was fetched. (Assuming it&#x27;s over SSL.) That really doesn&#x27;t seem like sensitive information.