3 ms·

this is a security agency - what makes you think you would have seen it? multiple intercept locations + timing information + flow size captures + crawling data

• belorn 9y ago
  I have seen statements both Snowden and Schneier that say that security and in particular encryption works but the attacker only need a single point of failure and security agencies generally bypass rather than break security measures. But we are talking about a specific attack vector here: Correlation attacks. flow size captures and destination site fingerprints are great if the traffic can be isolated. Imagine a actually fingerprint. A computer will transform the image into specific dot values, and from there create a unique value. Now imagine you put 100 different fingerprints with the exact same outer finger shape on top of each other. No method will be able to say with confidence if a specific fingerprint is in it, regardless deep pockets and honking databases. But there are a few catches. Reduce the number of simultaneous signals and the problem goes down. If you can introduce additional traffic into the signal, you can often isolate the traffic you are interested in. While we can never know with certainty what the big agencies can do, the general advice I have heard is to not send a single message through the tor network and always do it as a part of multiple simultaneous messages (both for sender and receiver).