Is there a way for an end user to protect oneself against the timing attack when using Tor?

For those, who are not familiar with it, a timing attack involves an adversary populating the Tor cloud with the nodes under their control, with the goal to likely be the first node that you contact and also be the exit node. The latter part is actually made easier by Tor, since it allows people to opt-out from being an exit node. With such a setup, the adversary begins to record times that you send a packet and also the time when the request packet leaves the exit node, and perform statistical analysis on your traffic and the traffic of the requested resource with the tor network.

Is there a way to introduce an artificial delay or some other mechanism to make a statistical analysis more difficult?

  • 2
    Please be more specific and provide details about the attack you're trying to defend against. A good general rule of thumb is that SE questions should be complete enough that someone finding them via a search engine in a years time should be able to understand the question and implement their solutions even if the original context has been lost. You'll also get better answers this way, and fewer off-topic answers. Thanks!
    – Sam Whited
    Nov 6 '13 at 18:13
  • I've added a description of the timing attack, hopefully it's more clear this way.
    – v010dya
    Nov 7 '13 at 4:46

Short answer is no, not really.

Timing attacks can be defended against by pumping a constant stream of data through the network. That's not foolproof, however, since an entry / intermediate node could introduce lag spikes which could then be analysed.

I believe that high-latency anonymity networks (anonymous remailers) have all kinds of timing attack defences; so maybe you want to look into those.


I believe it is possible, but don't know if required tools already exist that anyone could use with low technical skills.

This answer will cover both traffic correlation and timing attack issues.

My idea is, you must somehow be able to use some computer in the middle anonymously and send it commands to perform anonymous tasks on scheduled dates and times, or immediately.

  • In context of Tor, pay anonymously for a server and host a Tor hidden service on it by connecting only through Tor to configure it. The tasks should be performed through Tor too on that server.

  • For any potentially risky activity, in terms of traffic correlation or timing attacks, you should use that anonymous server in the middle to perform tasks and better if you scheduled the tasks with a good timing where it is impossible to be correlated with any of your other identities, offline or online. Tasks could be performed when you're sleeping, when you're somewhere with no connection and preferably for a long time like vacations, etc.

About the implementation,

  • I think cronjob is the tool to schedule the tasks in Linux. Never used it before.

  • Most of the manual tasks which require browser clicks and typing would be hard to be scheduled if not impossible.

  • I don't know if Tor Browser could be controlled remotely on command-line, if a remote desktop connection is possible to the hidden service, that can be used for instant tasks.

  • Whonix may be used for both (your own and the one at the middle) computers for best protection. I'm not sure how possible it is.

  • Simple downloading & uploading tasks creates traffic fingerprints so you use the server in the middle to do it now or later, and maybe transfer files to your own computer at a later time. A remote desktop connection could also eliminate the need of having the files on your own computer and allow you to do any tasks anonymously.

  • But a remote desktop connection will also have its own traffic which may be suspicious.

About the tools,

  • I hope people could suggest better ideas, or any available tools to perform such tasks.

  • I believe volunteers could create some hidden websites/servers which could be used by public for instant or scheduled remote tasks. Advanced tasks may be hard to provide for such public services, but providing even the most simple tasks could create a huge benefit for people.


It would be child's play to implement some small amount of delay and dummy traffic into the network at any or all hops. I have no idea why this isn't a feature of Tor already.

  • I doubt that it would really help much, not unless you also implement something like a datastore, but that would be very difficult with the stream data (probably impossible).
    – v010dya
    Dec 23 '13 at 16:05

I imagine it is possible to randomize the sending times to confuse the statistical, say by adding a random .5 to 3 second variance. More advanced statistical analysis would probably be able to beat this, and it would slow thing up a bit. It would probably be best as an optional feature, but I think it may be worth pursuing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.