I heard that someone, who can read the traffic of many tor nodes (like the government of a country where many nodes are located) can find out which user is sending/reading data to/from which resource by statistical analyzing those node's traffic. I've read this is done by analyzing the traffic of the first and last node of each route. As I did understand, the middle node seems not to be of interest. Is this true? If yes: Why is the middle node's traffic not useful for statistic analysis?
Each tor route goes through three tor nodes. Can it help to protect the anonymity of tor users to choose only routes where the first and last node are located in different countries? Maybe even different continents?
And what about hidden services? The traffic from a user to a hidden service goes twice through the tor network, so that there are six tor nodes transporting the data. How does this influence de-anonymization? Is it enough to analyze data of nodes 1 and 6? Or is there a need to analyze the nodes 3 and 4 too?
Supposed Tor software already creates only routes where the nodes 1 and 3 are located in different countries: If a user connects to a hidden service, can it be, that nodes 1 and 6 are now in the same country? Wouldn't this allow this countries government to find out quicker to which hidden service a user is connected, than to which normal website?
I am not interested in other methods of attacking a users or a service providers anonymity. I am asking about traffic analysis and how it can be influenced by placing Tor nodes over the planet, and if hidden services make it easier or harder to perform such analysis.
http://tracking.host.domain/tracker_<ID>.json- it looks like a usual non-criminal query, **but flash ignores your proxy settings and goes straight through your default