How does de-anonymization work?

Question

I heard that someone, who can read the traffic of many tor nodes (like the government of a country where many nodes are located) can find out which user is sending/reading data to/from which resource by statistical analyzing those node's traffic. I've read this is done by analyzing the traffic of the first and last node of each route. As I did understand, the middle node seems not to be of interest. Is this true? If yes: Why is the middle node's traffic not useful for statistic analysis?

Each tor route goes through three tor nodes. Can it help to protect the anonymity of tor users to choose only routes where the first and last node are located in different countries? Maybe even different continents?

And what about hidden services? The traffic from a user to a hidden service goes twice through the tor network, so that there are six tor nodes transporting the data. How does this influence de-anonymization? Is it enough to analyze data of nodes 1 and 6? Or is there a need to analyze the nodes 3 and 4 too?

Supposed Tor software already creates only routes where the nodes 1 and 3 are located in different countries: If a user connects to a hidden service, can it be, that nodes 1 and 6 are now in the same country? Wouldn't this allow this countries government to find out quicker to which hidden service a user is connected, than to which normal website?

clarification:

I am not interested in other methods of attacking a users or a service providers anonymity. I am asking about traffic analysis and how it can be influenced by placing Tor nodes over the planet, and if hidden services make it easier or harder to perform such analysis.

Answer 1

I think I can answer the first two paragraphs.

I think because the entry guard node knows where a Tor user is from (compromising anonymity) and the exit node knows what that user is looking at (compromising privacy) and thus, it give the clearer overall picture to the attacker if they have control of these two points. I don't think its as useful to analyze and entry and a middle node, it's as good as just analyzing the entry node's traffic. Same for analyzing middle and exit node, it's the same as analyzing the exit node only. Alexey Vesnin is right too, it may be a waste of resources if you cannot discover links between certain Tor users to certain online activities done.

I am not saying that analyzing just the entry or exit nodes are totally not useful but that is off topic to your question on hand so I won't go into that. Alexey Vesnin had cover bit on that in the comments though.

It might help that all the nodes in a Tor circuit are from different countries but governments through collaborations of intelligence agencies, ISPs and server providers from different countries or simply private attackers could set up (or analyzes existing) different relays in different countries. Thus, it will still makes traffic analysis feasible.

Edit: I totally left out the possibilities of ISPs and NSA somehow tapping into the internet cables (possibily underwater?) could as serve as a vector for traffic analysis attack. Please do note that other metadata such as time and packet size not shown in the diagram linked could be taken in account in such attacks too. So a bad single node or even with no bad nodes, other factors from what it seems from the linked diagram, could be used against one's anonymity.

However, it seems that most of these vectors requires authoritative powers to carry out. So Tor users are somewhat safer from adversaries that are not from government agencies as there are less vectors of attack from those guys. And also as we all know, a lot of time this network path will be across countries which makes such attacks harder. But on the other other hand, the intelligence agencies of different countries could be working together which we know they did before.