The vulnerability enables clustering outgoing Mullvad traffic into user-sized buckets based on metadata analysis alone. Clustering, in turn, allows time-based

The vulnerability enables clustering outgoing Mullvad traffic into user-sized buckets based on metadata analysis alone. Clustering, in turn, allows time-based deanonymization[1], against the users assumptions of being sufficiently anonymized. Adversaries who do not enjoy a backbone-traffic MitM vantage point cannot exploit this vulnerability, which makes it appear NOBUS-y. 1. Any *aaS, forum, or board, when given a (Mullvad!) IP address and series of request timestamps, and a subpoena, can yield PII on the real identity (email, phone, billing address)