> Could you skip everything in the middle, since request latency is correlated with system load? You have to load the server in either case, so both are active

> Could you skip everything in the middle, since request latency is correlated with system load? You have to load the server in either case, so both are active attacks. I think the problem is that latency is so variable due to Tor itself, it's actually faster to measure server load through clock skew than through request latency. I don't think it's only the variable latency due to Tor, but also the fact that latency is tightly enough correlated with the load and the software and hardware configuration that it can't be reliably used for fingerprinting. Clock skew, on the other hand, occurs due to various fabrication parameters not being constant; it has a random element that can be reliably used to fingerprint physical machines. To put it another way, two identical machines -- built out of identical components, running perfectly identical software, on entirely identical storage media, with exactly the same bits written in exactly the same location of the hard drive and RAM -- placed behind a NAT would be impossible, or at least much harder to discern based on latency alone, while being comparatively easier to discern by clock skew.