Now, this seems almost too obvious, so I assume I must be missing something, but I figure I should run it by the experts first to see.

Hypothetical scenario: At 5:18pm, a user using the Tor network logs on and posts something on WikiLeaks (or some other site wherein anonymity would best be maintained in the interest of self preservation).

Lets say the data leaves country x, bounces off county a to country b to country c, finally arriving at server y in country y.

If regime x really wanted to seek prosecution of whomever contacted server y, wouldn't be as simple as contacting country y and using diplomatic connections to find out the ip of the server in country c which contacted the server y at exactly 5:18pm, contact country c to find out who contacted server c in country b, contact country b and find out who contacted server b in country a, then finally contacting country a to find out who contacted server a in country x? This of course would give them little trouble hunting down server x (you).

x => a => b => c => y

  1. get ip of c by looking in y's logs at precisely 5:18 and some milliseconds
  2. get ip of b by looking in c's logs at precisely 5:18 and some milliseconds
  3. get ip of a by looking in b's logs
  4. kick in your door once they realized your ip contacted server a at exactly 5:18

It should be mentioned, that county x would begin the investigation if the data sent to server y directly involved it. but if the data did hurt country x, then it's not a far cry to assume that they would begin an investigation

Of course this whole thought experiment relies on the idea that countries y,c,b, and a would all be diplomatically friendly with country x, but if its a life and death scenario should we really be relying on one countries inability to communicate with another???

Please tell me I'm missing something!?!?!?!

  • I believe I have a solution in the form of a new protocol. It also deals with several other of tor's short comings: 1) exit relay are dangerous. 2) Exit relays data sniff 3) uses parallel opposed serial communication 4) allows UDP 5) full anonymity please tell me what you think: I would love to see if some insight into the feasibility reddit.com/r/TOR/comments/3aktx0/… Commented Jun 21, 2015 at 17:34
  • BTW in the link above, you have to scroll down to my response to see the solution to the problem posed. Commented Jun 21, 2015 at 17:40

3 Answers 3


What you're describing is a timing attack and yes this is possible. One attempt to mitigate this is to pump a constant stream of data through Tor at all times so it's difficult to differentiate between your upload and benign information. This was discussed here


Well kinda, but that is inherent of how it works. That is quite difficult because you would have to subpoena each of the nodes which are likely from different countries which is rather hard. Additionally, people don't usually keep logs and TOR doesn't keep any by default. However, time-based attacks are a thing, they work like this

x => a => b => c => y 1)Packets left x at lets say 5:18:12 (5:18 and 12 seconds)

2)Packets arrive at y at 5:18:45 (5:18 and 45 seconds)

3)You send lots of packets and they can find what the time delay and the offset is then they can see where you are sending packets.

Please note that This is usually only used in targeted attacks and is not used in a dragnet format.

Additionally, note that this requires access to your isp (or at your first hop) and the exit nodes ISP.


Grugq, The. "The Grugq - OPSEC: Because Jail Is for Wuftpd." YouTube. YouTube, 26 Nov. 2012. Web. 21 June 2015. https://www.youtube.com/watch?v=9XaYdCdwiWU.


Please tell me I'm missing something!?!?!?!

Well, yes, you might.

  1. The Onion Routers which relay your traffic (a, b, and c) are often interconnected anyways, relaying not just your traffic, but much other traffic as well.

  2. They should not keep connection logs:

In most instances, properly configured Tor relays will have no useful data for inquiring parties, and you should feel free to educate them on this point.

  1. Wikileaks has a hidden service, which increases the trouble of someone trying to find out who connected by increasing the number of hops to six, f.ex.

If someone can observe all of those relays which forward the data, you might indeed have a timing attack problem, as @Nick answered.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .