Is Tor still secure?

Every time a darknet market gets taken down, the same headline appears. This page goes through what happened in each case, what the Tor Project built in response, and what Aphotic adds on top.

Why this page exists

A fair question deserves a specific answer

Hidden services do get seized, and researchers have published papers on attacking Tor. Some of those attacks were real and have engineering answers. Most "Tor is broken" stories were about something other than Tor. Each block below takes one claim, lays out what the record says, and then states what Aphotic does about it.

Hidden services keep getting busted, so onion routing must be broken.

What happened

The takedowns we have records for come down to operator mistakes: servers that were also reachable at a normal internet address, misconfigured software that printed its real address in an error page, operators reusing a personal email address from years earlier, third-party scripts, informants. Where court documents exist, they describe exactly these failures. None of them describes anyone breaking Tor's encryption.

What Aphotic does

Aphotic is built on the assumption that someone will try those mistakes against it. The server has no normal internet address that could leak. It sits on an internal-only network where the Tor process is the one thing that can reach the outside world, and every incoming port is shut. Replies carry no identifying headers, and even the health check gives away no version number. If a machine were seized anyway, it would hold scrambled messages, public keys, pseudonymous IDs and group memberships, and the order records of the license shop, none of which name a person. The privacy policy lists every field.

Guard-discovery attacks deanonymize onion services.

What happened

This is the one attack to take seriously. Every Tor connection starts at a first hop, called a guard, which is deliberately kept the same for weeks. An attacker who can force a service to keep making new connections can, over time, work out statistically which guard it keeps starting from, and then attack or watch that one machine. It worked best against services that had been running a long time with default settings and no extra protection.

The engineering answer is already deployed. A protection called Vanguards pins the second and third hops to small sets that change slowly, so the statistical narrowing never converges. It also watches for the pattern an attempted attack leaves behind.

What Aphotic does

The server runs the full version of Vanguards, with pinned second and third hops and two watchdogs. One flags meeting points that get picked far more often than chance allows, which is the signature of somebody actively trying this attack. The other flags odd bandwidth patterns and injected junk. Guard choices survive restarts. If the protection process ever dies, the service goes down with it and never carries on unprotected.

Timing and traffic-correlation attacks break Tor anyway.

What's true

This attack means watching both ends of a connection at the same time and matching up the rhythm of the traffic. For ordinary Tor browsing, the exit relay gives an attacker a cheap second place to watch from. Traffic to a hidden service never leaves the Tor network, so there's no exit to sit on. An attacker has to find and watch the specific first hops of both sides simultaneously.

Tor's designers state this limit openly: Tor does not try to beat an attacker who can already see both ends, because the only known defence is adding so much delay that the network becomes unusable. Their work goes into making those two positions hard to reach in the first place, with six hops, first hops that change slowly and on purpose, and no exit side at all for hidden services. Timing gets addressed at that layer, and Aphotic builds on it.

What Aphotic does

Vanguards covers the guard-discovery attacks above. Timing is Tor's job. Aphotic adds no artificial delay to your messages, because a delay added before your message reaches the network shifts both ends of the comparison by the same amount and cancels out of the attacker's calculation, and a delay big enough to help would cost more than the six hops already do. Aphotic's own measures sit elsewhere: traffic never leaves the Tor network, messages are padded out to a few fixed sizes, direct messages carry no sender, there are no read receipts or typing signals to time, the database has no columns for when you signed up or were last online, and queued messages disappear on delivery or after seven days. Against somebody watching both first hops at once, none of that abolishes the attack. Tor doesn't claim to, and neither do we.

Just connecting to Tor puts you on a list.

What's true

Your internet provider can see that you connect to Tor. It cannot see what you do or where you go. Millions of people use Tor every day: journalists, security teams, researchers, and plenty of ordinary readers. In most countries using it is legal and unremarkable.

On a network that actively blocks Tor, Aphotic currently can't connect. Disguising the traffic to get through is on the roadmap and not built yet, which you should know before relying on Aphotic in such a place.

What Aphotic does

Aphotic sends nothing outside Tor. There are no push services or analytics, and no update check slips out a side door. An observer sees a phone speaking Tor, which looks the same as everybody else's.

Tor is too slow for anything serious.

What's true

Six hops cost real time: roughly half a second to two seconds per action, up from a few milliseconds. That's what hiding both ends costs, and every hidden service pays it.

What Aphotic does

Aphotic is designed around that delay. Connections are kept warm, anything you send is queued and retried in the background so the app never freezes waiting on the network, and messages keep arriving while the app is closed. Messaging is the one use where Tor's slowness all but disappears day to day, since you were never waiting on a round trip to begin with.

The stack in one view

Defence in depth, layer by layer

No single mechanism carries the weight here.

your phoneencrypted vault · key held in the security chip · PIN-only unlock · panic PIN

the messagetwo-layer quantum-resistant setup · AES-256-GCM · no sender on direct messages

its shapepadded to fixed sizes · no read receipts or typing signals · no live calls to time

the networkabout 6 Tor hops · Tor built into the app · nothing sent outside it

the servicefull Vanguards protection · proof-of-work at the door under load

the machineinternal-only network · no incoming ports · no identifying headers · 7-day queue

New to Tor?

Start one page back: what onion routing is, how the two sides meet in the middle, and why the address is itself the key.

How Tor works →