According to a number of bloggers(1), <a href="http://torproject.org">torproject.org</a> was include among those domains targeted in the certificate breach. In at least the case of Google, these certificates have been offered to Iranian Internet users by a number of ISPs, in a number of city. <div>
<br></div><div>Risk is a product of situation, and if you are in Iran, Syria, Belarus, et al, I would exercise at least that level of caution.<div><br></div><div>(1) <a href="http://www.nu.nl/internet/2603449/mogelijk-nepsoftware-verspreid-naast-aftappen-gmail.html">http://www.nu.nl/internet/2603449/mogelijk-nepsoftware-verspreid-naast-aftappen-gmail.html</a><br>
<br><div class="gmail_quote">On Fri, Sep 2, 2011 at 1:11 PM, Seth David Schoen <span dir="ltr"><<a href="mailto:schoen@eff.org">schoen@eff.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class="im">Joe Btfsplk writes:<br>
<br>
> Is it really a risk, d/l Tor or TBB directly from Tor Project's<br>
> site, that verifying signatures is necessary? What is the reasoning<br>
> here - if getting files from Tor Project server?<br>
<br>
</div>How do you know it was really the Tor Project server?<br>
<font color="#888888"><br>
--<br>
Seth Schoen <<a href="mailto:schoen@eff.org">schoen@eff.org</a>><br>
Senior Staff Technologist <a href="https://www.eff.org/" target="_blank">https://www.eff.org/</a><br>
Electronic Frontier Foundation <a href="https://www.eff.org/join" target="_blank">https://www.eff.org/join</a><br>
454 Shotwell Street, San Francisco, CA 94110 <a href="tel:%2B1%20415%20436%209333%20x107" value="+14154369333">+1 415 436 9333 x107</a><br>
</font><div><div></div><div class="h5">_______________________________________________<br>
tor-talk mailing list<br>
<a href="mailto:tor-talk@lists.torproject.org">tor-talk@lists.torproject.org</a><br>
<a href="https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk" target="_blank">https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><b>Collin David Anderson</b><div><a href="http://averysmallbird.com" target="_blank">averysmallbird.com</a> | @cda | Washington, D.C.</div><br>
</div></div>