If anybody is able to make themselves a Tor server, what is to stop a security agency from populating the list of Tor servers with many of their own? If they have enough servers there, then might they be able to track the progress of your message from origin to destination?
1 Answer
Right, Tor cannot protect against an adversary that runs a significant fraction of the network. This is true for any anonymity network, and is why it's important for other people with good intentions to run relays.
In fact there are timing-based attacks where an adversary only needs to control a user's entry and exit relays, and not the middle. This is why Tor clients stick with a single (hopefully benign) guard relay for long periods of time, to reduce the likelihood that the client creates a circuit with a malicious entry relay.
