Please route a bunch of packets to me

That is precisely what BGP lets you do on the normal Internet. It comes with some limitations, and you need to be an ISP, but who says all ISPs are honest? Similarly, if you set up a high-power access point in a busy airport, plenty of people will send their packets your way.

The difference is that an exit node on Tor can’t choose what data it receives and doesn’t know where it comes from (unless the content gives that away). Whereas the BGP and fake-AP attacks are much more targetted and give more information.

If you trust the people around you more than a random stranger, then you’re right – Tor makes the risk of sniffing worse. But people in sensitive occupations, like embassy employees, might worry about those nearby far more than someone who randomly sees their traffic.

I’m not condoning the absence of encryption, instead I’m just pointing out that the question of whether Tor increases the risk of sniffing does not have a simple answer. That depends on the content in question and the risk-environment of the user.

I haven’t seen any authoritative explanation for why embassy personnel are using Tor, but I can think of some reasons. Tor is an anti-surveillance technology, and embassy employees are in the type of jobs where they worry about that.

For example, suppose an embassy worker is checking their email from a public access point. By using Tor, they hide their affiliation, potentially reducing the risk that they will be attacked. They might also want to hide their employment from their ISP.

Of course, they should be using encryption but I can understand why embassies might have encouraged the use of Tor. A VPN hides the data, but not the identify of the user, so the security added by Tor could be beneficial.

When even smallish private companies use VPNs for access to internal mailservers from remote locations, the notion that the foreign services of some major countries do not is hard to credit. Amazing!

They’re long and non-mnemonic, but they all take the form ([a-z][0-9])*, which yields a smaller password space than, say, [a-z0-9]*. They do get points for effort, though, particularly compared to “password”, “asdfgh”, “12345678″ (”That sounds like the combination an idiot would put on his luggage!”), and all of the Iranian passwords. Wow.