I see a lot of people talking about how Tor is pwned by the US Government and is insecure 'by design'. I'm assuming that they know this from a thorough analysis of the source code, which I freely admit I haven't done. So, since you guys actually have taken the time to audit the source and find the vulnerabilities that would allow Tor to be so easily pwned, could you explain it to me and, preferable, post relevant sections (or links to sections) of the source you're basing your statements on?

It's foundation design issues. And hardware level network issues. The code is generally (in the public conversation anyway) assumed to be "best effort, bugs fixed relatively soon after they arise".

I'd really like to investigate these vulnerabilities myself but the code is too massive for one person to realistically audit by themselves so links would be very helpful.

Again, you will need more nuance than "has the code been audited" if you really want a relevant answer. There's a lot of research out there, and also logic and discussions which are straightforward to follow. Next, once you've done some investigation, you start to come across a few interesting factoids of note such as: - lack of network chaff is a fundamental limitation, and problem for privacy (for those who need it) given current known data collection capabilities of the "five eyes" - all network meta data, and there is evident (I'm not about to search the lists, but you only need to search 2.5 years (the time I've been watching)) resistent within "Tor project proper" to making this particular fundamental improvement happen; - arguments are put such as "oh there are no studies proving the benefits of network chaff" and the obvious "we don't have a budget for that (yet) but we encourage contributions" - persistent push back against bittorrent over Tor, including threatening offlist email attacks against those who suggest as much; BT over Tor would provide some chaff, simply by increase of volume, load, unpredictability of end clients, for example. - just watching TBB's behaviour has been interesting - some days, when I open up say 5 tabs for 5 different news websites using the "open all bookmarks from this folder as tabs" function, they all essentially start to load simultaneously, but other days/times, each tab loads distinctly sequentially, which to my mind is a dead giveaway that my current on-ramp is part of some sort of profiling (read 'deanonymising') - configurable latency randomization is another technical improvement which has been bandied around for years, and sounds easy to my programmer mind in practice, but has yet to see anything like the light of day There is ample room for an alternate dev team. Unfortunately, the US DoD are the ones providing almost all the funding, so they get to continue to control Tor development. If you are a big funder, start a whole new dev team, in a -completely separate jurisdiction (if that's possible). I know of an apparently well intentioned and productive man who may be close to ideal to set up and lead such a team :) Also, fundamentally we need a physical layer network which individual humans in their homes and offices, actually control - that is, shift the entire network to a "dark fibre" concept, where suburbs have random connections to one another, neighbours connect to one another with ethernet, wireless and more. If you don't own it, you don't control it. If you don't control it, it --will-- be used against you. This is a long term (say 20 year) plan, but it's the only long term option if we want to achieve anything resembling a genuine network of the people which honours privacy and anonymity of communication. By virtue of our capacity and existence and by the blessing of our cognizance of these things, we humans are with the right to anonymous and private communication. We have the right. I encourage you to work towards a world where many can live the right.