I have some question about the very basics of tor, as this keeps bugging me now for some time:

As far as I know every tor node is only aware of the ip address of the following node. For example the guard node knows where the next relay is, but does not know the exit node (as this information is hidden from it by encryption). The same holds true in the other direction, i.e. from exit node to guard node. This ensures that if let's say somebody gets access to the exit node the actual origin still remains hidden.

Now imagine the following scenario: All three nodes lie within countries where let's say law enforcement or agencies are known to cooperate (maybe the EU). Let's also assume that there is very little traffic over these nodes. Isn't it then possible for an attacker like law enforcement to first acquire logs from an Internet Service Provider for the exit node, figure out to which ip the exit node sent data in a specific time frame, then check the logs for the second node and so on? Does anonymity in this scenario depend on the amount of traffic making correlations in ISP logs difficult or impossible?

  • Generally yes, Tor does not and cannot protect users against “global adversaries” who can monitor a large fraction of relays. Tor tries to build circuits with relays that reside in different geographical areas, but I don’t know enough about the path selection algorithm to comment further. There are a variety of timing correlation attacks that can be done if the adversary can monitor both the guard and the exit.
    – Steve
    Mar 8, 2019 at 20:12
  • Yeah, I thought so. Some global "cybercrime" legislation could completely crush Tor, I think.
    – Lord Vapor
    Mar 9, 2019 at 9:20


You must log in to answer this question.