Can you describe please, what identity correlation is referring to?
Why should I care?
How can it be prevented?
Tor Stack Exchange is a question and answer site for researchers, developers, and users of Tor. It only takes a minute to sign up.
Sign up to join this communityIt's arguable that few technologies, and none that are commonly available, provide stronger anonymity than Tor does. The NSA has called it "[t]he king of high-secure, low-latency anonymity". However, as user-friendly and secure as the Tor Browser Bundle (TBB) has become, it cannot reliably prevent tracking and identity correlation.
Online vulnerabilities fall in three general categories: fingerprinting, tagging and exploiting. All TBB users, unless they tweak browser settings, look alike to websites. That certainly mitigates against fingerprinting. However, there are trade-offs. For example, one of the instrumental design choices, having NoScript configured to allow scripts by default, facilitates tagging and exploiting.
Two implementations build on the TBB to provide more-secure anonymity, and better prevent identity correlation: The Amnesic Incognito Live System (Tails) and Whonix. Tails uses TBB to protect against fingerprinting, and it further mitigates against tagging and exploiting by forgetting online activity after shutdown. Using Ducks' example, rebooting Tails would separate Joe and Aron more effectively than TBB alone could.
Whonix also uses TBB to protect against fingerprinting, but its design is heavier on defense than amnesia. The Tor software and userland applications are isolated in separate virtual machines (VMs). Although Whonix arguably doesn't protect against persistent tagging as well as Tails does, it protects far better against application exploits that compromise Tor connectivity, and could reveal ISP-assigned IP address to adversaries.
Also, given that modern computers can run several VMs, it's easy to simultaneously use multiple Whonix instances. Whonix workstation VMs have independent Tor connectivity, each through its own Tor gateway VM. Exploits in one workstation VM can't compromise its gateway VM, or other Whonix instance VMs, unless they break the VM-host barrier.
Using Qubes to run multiple Tor gateway and TBB workstation VMs would provide even stronger security. Qubes is a hypervisor OS, based on Xen and Linux, that runs directly on hardware.
With such strong technology, deanonymization and identity correlation are most vulnerable to human error. By failing to upgrade TBB, many Freedom Hosting users were vulnerable to deanonymization exploits by the FBI, after it compromised the site's servers. Both Silk Road founder Ross Ulbricht and Lulzsec member Anarchaos mindlessly revealed incriminating information on websites and/or chats.
Identity correlation is learning that two or more identities -- Like Joe on Facebook and Aron on StackExchange -- are actually the same person. This can be a problem if you don't want others knowing this; for example, Aron is an anonymous gay rights activist, and he made a Facebook profile under a different name to avoid getting persecuted/trolled/flamed. However, someone who doesn't like Aron and wants to bring him down is tracking him across the web, linking his identities, and revealing them to the world. Now his Facebook account is hacked and vandalized, his Gmail is full of spam, and people are stealing his chickens. This is why Tor and the Tor Browser were invented. Using them properly and following the warnings on the download page should be sufficient against most adversaries.