I'm pasting Arturo's response to your questions (posted on the tor-talk mailing list) here:
"When you click on a link with OONI Run the user is presented with a page that shows them the list of URLs (if the test is web_connectivity) that they are about to test.
If a malicious URL is included in such list, the user will be able to avoid running it by simply clicking the X button.
The run.ooni.io links are also defined as a custom URI inside of both apps, so if the app is installed, the user will actually never be connecting to ooni.io servers.
That said, something to keep in mind, is that OONI Probe is not a privacy tool, but rather a tool for investigations and as such poses some risks (as we explain inside of our informed consent procedure).
We are not aware of any OONI Probe users having gotten into trouble for using our tool, but we prefer to air always on the safe side be sure that they understand very well the speculative risks that they could run into."
Hi Seth,…
Hi Seth,
I'm pasting Arturo's response to your questions (posted on the tor-talk mailing list) here:
"When you click on a link with OONI Run the user is presented with a page that shows them the list of URLs (if the test is web_connectivity) that they are about to test.
If a malicious URL is included in such list, the user will be able to avoid running it by simply clicking the X button.
The run.ooni.io links are also defined as a custom URI inside of both apps, so if the app is installed, the user will actually never be connecting to ooni.io servers.
That said, something to keep in mind, is that OONI Probe is not a privacy tool, but rather a tool for investigations and as such poses some risks (as we explain inside of our informed consent procedure).
We are not aware of any OONI Probe users having gotten into trouble for using our tool, but we prefer to air always on the safe side be sure that they understand very well the speculative risks that they could run into."