Tor can anonymize traffic but only against passive attackers who cannot perform traffic flow confirmation on a global scale. > A global passive adversary is th

Tor can anonymize traffic but only against passive attackers who cannot perform traffic flow confirmation on a global scale. > A global passive adversary is the most commonly assumed threat when analyzing theoretical anonymity designs. But like all practical low-latency systems, Tor does not protect against such a strong adversary. Instead, we assume an adversary who can observe some fraction of network traffic; who can generate, modify, delete, or delay traffic; who can operate onion routers of his own; and who can compromise some fraction of the onion routers. (https://svn.torproject.org/svn/projects/design-paper/tor-design.pdf https://svn.torproject.org/svn/projects/design-paper/tor-des..., Page 4) I read an interesting article in the ACM last month, titled "Seeking Anonymity in an Internet Panopticon" (http://cacm.acm.org/magazines/2015/10/192387-seeking-anonymity-in-an-internet-panopticon/fulltext http://cacm.acm.org/magazines/2015/10/192387-seeking-anonymi...). > The most well known global-traffic-analysis attack—"traffic confirmation"—was understood by Tor's designers but considered an unrealistically strong attack model and too costly to defend against. They explain a number of attacks against Tor (both active and passive) and introduce Dissent, "a project at Yale University that expands the design space and explores starkly contrasting foundations for anonymous communication".