Comment by ObsidianBreaks

I think it's prudent to point out that the article's title is quite 'clickbaity', but to address it directly, the correct answer is (as it usually is) is 'it depends'. In my view, it depends on the answer to the question 'safe for who?', i.e. what is the threat model to which you are trying to guard against? If it's the US, then of course not, as the code is well-known to the US and I would expect that they have known vulnerabilities that they can leverage to ascertain the users of their service. The fact that TOR is, 'on paper', non-governmental doesn't really matter these days with the merging of private and public (and non-affiliated open-source communities) inside the security community. I would say that even the fact that it's open source isn't much of guard against such attacks, given that it relies on proficient oversight (which many eyes may not guarantee). Against other 'nation state' type adversaries - I'd wager that the more prominent who have the capacity to host a large number of relay nodes, and have access to very large computational power, will find it possible to decode portions of the TOR traffic. Against less technically proficient adversaries, such as 'run of the mill' police forces and minor nation states I'd go so far as to say it might be secure but only if you are using it for something uninteresting to them, but I ask 'how hard is it really to do a man in the middle a TOR relay?', and in terms of the most general case, 'what about the endpoints?' which of course aren't secured via TOR. Ultimately the best defense against 'snooping' in my view is to use a pre-agreed communication protocol which is undocumented and is known only between the communicators and is unusual enough to be hard to recognize or hard to work out what it means (preferably with a key to those communications known only to the two parties), but then I suppose you could use any communication protocol...