Risk of deanonymization running thousands of hidden service on same server

Question

Is there any difference of risk of deanonymization on running thousands of hidden service on the same server than running just a few? Does the quantity of hidden services on a server actually have anything to do with its deanonymization probability?

Answer 1

There are multiple factors and tradeoffs at play here:

First off, how many Tor instances are you using?

The biggest protection against deanonymization are the guard nodes of your Tor instance, the number of which doesn't change when you increase the number of hidden services you're running as long as you use the same Tor instance. If you spin up many Tor instances to host your hidden services (which may be necessary due to scalability issues/guard node overloading), you're picking many different guards, thus massively increasing your chance of being deanonymized. This trumps any other effects that I discuss below, so let's assume all hidden services use the same Tor instance.

The next effect is that when you run many hidden services, you spread out your hidden service descriptors all across the network, so your adversary is sure to find it if they run any hidden service directories. This is a limitation of the current hidden service design, and is scheduled to be fixed in a later version of Tor with the next-generation hidden service protocol. If you publicise your hidden service addresses, this effect is negligible as your adversary has other means of learning them. Why does it matter, though?

Assuming the guard you picked wants to learn whether you're responsible for a given hidden services, it can do a timing-based confirmation attack when it has your .onion address by simply connecting to it (possibly multiple times) and observing your traffic. This is made slightly easier by the choice to reduce the number of guards Tor uses by default (but that decreases the chance of picking an evil guard in the first place).

Next is the sheer number of users. If you have a fixed amount of users, and they either all use the same hidden service or each uses their own, the total number of client connections to hidden services does not increase. These connections are an attack vector for your guard to identify a link between you and your users. By hosting all hidden services on the same machine, it becomes easier to link your users together once you are deanonymized.

Answer 2

The deanonymization can be done by just one badly configured service. So - the quantity does not matter at all. If you have enough resources+bandwidth - you're welcome. The reason for this answer is pretty simple : hidden services does not see each other - it's like STunnel setup...