You're pretty safe so long as you stick to the .onion domains, but there are no .onion domains I really want to visit. Using it to access the regular web means you really aren't as anonymous as people think. That's when I lose all trust in it. You *can* be vulnerable on the network, but blocking any scripting and keeping the browser as stock as you can will pretty much defeat that - assuming you're also smart enough to not reuse usernames and email addresses.
I didn't read through all of them at your link, but anyone with enough clout can do something called a 'timing attack' and that will use the times that packets are transmitted at various points to figure out who is doing what. Basically, they see when you send a DNS request, when a packet leaves your device, when it hits the TOR network, when it leaves, when it hits the site you're visiting, when the site sends back a packet, back through the network, and back to your PC. They can check the timing of all those events and see what you're doing. Then, a malicious attacker can control end-points and do a variety of things to the traffic flowing through it.
So, if you're using it like a VPN that's going to provide complete privacy, you're doing it wrong.
therecord.media
