3

I believe you're misunderstanding the term "content policy". It is not about what kind of content is alloweed/welcome when using Tor or about censorship. Instead, it is a technical term that describes how content in browser tabs interacts with content from other tabs and windows. The Tor Project does not have a content policy.


2

Replace "onion site" with "clearnet site" - your description of the threats and attack vectors could equally apply to both. The same personal security practices and behaviours should therefore be followed in each case. However, as soon as you add a centralised authority whose job it is to qualify and judge what is and isn't a spoofed site, and who acts to ...


1

Richard's answer is correct, I'd also add some points: People operating the legitimate sites have a static address, while the people creating clones or scam sites are capable of making arbitrary new addresses (with some effort if they wish to use homonyms) would make maintaining the blacklist an arms race that could easily exceed the capability of finding, ...


1

As it has been some time since I have had any experience with this sort of thing, it is unclear what exactly you mean by "certificate spoofing". However, from my understanding of MITM attacks, the implementation of the more secure HSTS protocol used by Google et al. mitigates against many of the attacks using methods such as sslstrip. I'm not sure if banks ...


Only top voted, non community-wiki answers of a minimum length are eligible