To get a good understanding of the general problem, I recommend the paper Why Efficient Traffic Analysis Countermeasures Fail
. It gives a good overview of why previous defence mechanisms are not sufficient. They also proposed a rather simple classifier called VNG++ which achieves good detection accuracy by only exploiting coarse features such as "total bytes sent", "connection duration" and "packet bursts".
Generally, the only perfect defence against web site fingerprinting is a constant-rate channel between client and web server which keeps transmitting data (the paper cited above refers to such a channel as BuFLO). Obviously, that's not very practical. So with every piece of efficiency we obtain, we move further away from our ideal traffic analysis defence. That doesn't have to be bad but it also doesn't make defending against web site fingerprinting easier.
Can users alter their behavior to prevent or make fingerprinting more difficult?
Maybe a little bit. If you have a very good understanding of how modern classifiers work and what features they exploit, you might be able to influence your web surfing in a way that you would slightly reduce their accuracy. So with a lot of effort, you might be able to make it somewhat more difficult. This is just a guess, however. Web site fingerprinting does not exploit user behaviour but rather HTTP-level behaviour. In particular, how much content is transferred, how long it takes to transfer it and how client and server communicate while downloading a web site. As a user, you can't influence this process all that much.
I don't think that web site fingerprinting should be tackled by teaching users to act differently, though.
What can websites do to make it more difficult for an adversary to fingerprint their users?
I'm not aware of any lightweight and neat hacks. Good server-side protection would probably mean making your content "look similar" to other web sites. And even then, an attacker might be able to say "well, it's either site X or site Y". Also, this would require heavy modification of all the content on a web site. Unfortunately, the research community is currently more interested in enhancing attacks rather than thinking about defences. One reason for that is that it's easy to conclude from the paper I linked above that "we're all screwed".
For example ScrambleSuit aims to be more sophisticated than current pluggable transports. Would it help regarding fingerprinting of websites and be feasible to deploy on the whole Tor network?
ScrambleSuit modifies its packet length distribution and inter-arrival times. The modified packet length distribution should get rid of Tor's characteristic 586-byte signature. ScrambleSuit does not, however, obfuscate derived features such as "total bytes transferred" or "downstream/upstream bursts". While it wouldn't be a very tricky feature to implement, it would involve additional overhead.
There's no comprehensive analysis of how well ScrambleSuit defends against web site fingerprinting (I have the measurement tools but not the data) but my guess is that it would probably reduce the accuracy of classifiers a little bit but certainly not enough to be regarded as strong defence. However, it would be quite interesting to enhance ScrambleSuit in such a way. Patches are welcome! :-)
Regarding the feasibility of deploying it: the code is mostly ready and is currently being tested.
