ghu

No, the whole point is that you expose your ip address so users in censored countries can connect to it. The proxy is between a user and a tor entry node.

Some hashing algorithms are suspectible to long password denial of service so it’s recommended to limit the length of password but certainly not to 20 characters but to a more reasonable limit, like 100 characters or so.

When I install a new software, sure I don’t start auditing the souce code but the developement of a software is a process and I trust that all the contributors and distributors have eyes on it and know what changes a release contains. It’s very hard to sneak in shenanigans into popular repositories. And an opensource software can quickly lose the trust of the community and get replaced if it makes bad turns. In non-free softwares I don’t have this assurance.