I've been thinking about a potential vulnerability that in certain cases may make it possible to identify a Tor client.
Say a malicious entry node establishes a connection with an Orbot client. This client proceeds to connect to the entry node through different network paths (wifi access points, mobile carriers) as the user moves in space. Through the pattern of hostnames/IPs connecting to the entry node, it may in extreme cases be possible to detect the identity of the user.
The way I see it, it could be resolved by automatically switching to a new Tor identity when Orbot detects network connectivity changes.
Thoughts or comments?