I know that statistical analysis of the data entering and leaving the TOR network can be used to de-anonymise users given enough time. http://www.ohmygodel.com/publications/usersrouted-ccs13.pdf

How long in practice would a 'passive adversary' have to observe the network before he could identify you? Are we talking minutes? days? weeks? And by 'adversary' i don't mean a hacker with a low boredom threshold, i mean e.g. a group with decent resources to throw at the problem. Say e.g. the FBI as a worst case in terms of a strong adversary with knowhow, expertise and resouces. And what kind of things make somebody more easy to 'cull from the herd' as a TOR user?

1 Answer 1


The best case as reported by the leaked documents, where the NSA was able to bust someone from Tor, involved exploiting the Tor browser bundle with 'Quantum insert' (Man-on-the-side-attack) and FoxAcid (A 'server farm' that serves malware). Apparently, as Jacob Applebaum mentioned in one of his talk, this took them 8 months to bust this single person!

So the take home message is that there's no indication 'they' can break the Tor protocol or do traffic analysis on the Tor network. And the `passive adversary' can not afford to surveil everybody all the time, instead they have to be really selective and work towards it for a long time. That's good!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .