Can partially predictable behavior deanonymize a Tor user?

Question

Let's say a Tor user has a history of routinely accessing websites A, B, and C, and that this history is established before he began using Tor. Let's say some adversary, like his ISP or a government agency, can access this history after the fact. Suppose that the set {A, B, C} is enough to accurately fingerprint the user --- almost no one else routinely accesses that particular set of websites.

Further Suppose the adversary also has the ability to monitor some number of exit nodes. If the user routinely accesses websites A, B, C, and X using Tor, how difficult would it be for the adversary to conclude that this specific user is accessing site X (because all four websites tend to be requested within a short time frame)?

I'm not talking about a basic traffic analysis attack where the adversary actively monitors both entry and exit nodes; I'm talking about an adversary who has a partial behavior profile on the user and can monitor exit nodes.

Answer 1

Yes, if using clearnet you establish a pattern and then continue with that pattern of browsing/activity on Tor then there is a big chance for correlation. Then again it depends what you're doing. Can it be done? Yes. Will it be done if you're not doing anything important to anyone watching then probably not. I think deanonymizing people for the sake of deanonymization is just stupid and a waste of time and resources even if it's automated. However the answer is a definite yes.

Answer 2

I agree with Alan that it could be done, and that whether or not it would be done depends on how interesting you are to the adversary.

It's my policy to keep true-name activities and "anonymous" activities totally separate. I also firewall "anonymous" activities (each of A, B and C) to distinct VMs and connection paths (some mix of nested VPN chains, JonDonym and/or Tor).

Starting out, you would gradually stop accessing A, B and C in plausible ways, but not by something obvious like getting banned. Just seem to lose interest. And then, more or less randomly, create new accounts on A, B and C, using a distinct Tor browser instance (or better, distinct Whonix instance) for each one. Some overlap in time between old and new accounts is good.

The new accounts must remain totally unassociated with your old accounts. Show new interests, at least at first, and make new friends. Talking with yourself is probably a bad idea. Tell no one about the switch, no matter how well you trust them.

I don't recommend faking language style, because it's hard to keep consistent over time. You could start out being very formal, with occasional simple errors, and then relax over time. Read https://ell.stackexchange.com/ (or the equivalent for the language to be used) for ideas.