CISA can analyze flow on backbones and (I presume) the various branches of partner domestic ISP networks. It's one way they track down botnet C2 nodes. What d

CISA can analyze flow on backbones and (I presume) the various branches of partner domestic ISP networks. It's one way they track down botnet C2 nodes. What does this mean? It means the fact you accessing a hidden service is no longer hidden from the state. While the content may be encrypted, CISA could tap on the pipe with a wrench at a known HS node and see what pipeline in the mix rings on the other end (my cute way of describing adding delays and interrupts to a stream so those show up as recognizable fingerprints to scan for elsewhere, like a cable finder/tester). Combine in some techniques on analyzing payload sizes and order, and some decent guesses of the content can be formulated. Only way I can think to defeat the analysis is to make a mixnet which asks for a GB/month target and simply transmits either data or padding uniformly in time with all nodes it peered with (a much much smaller subset than the whole network). Padding should be multi-hop so immediate neighbor nodes can't tell what is encrypted traffic and what is encrypted padding.