Another theoretical question about Tor: Imagine I am running a dissident web site as a hidden service. How can I reduce the chances that I get caught?
Assume I am running the server from home, over a large ISP. Going to a small ISP seems too suspicious, and giving the server out of hand is way to dangerous.
I'm especially worried about the following: The spies figure out (though the content of my site, idiosyncrasies of my writing, the times I post updates) in which country I am living. The major ISPs here are all in cahoots with the spies. One call - or a secret secret court order - and the ISP starts bisecting all connections. They disconnect half of the connections for a split second, and the spies look whether my site went down. If not, they try the other half. But if so, they continue bisecting the half I am in. In roughly log2(number of customers) steps they have identified me.
This is a very simple approach, I'm sure there are much more sophisticated attacks, like traffic correlation analyses. Are there things one can do to remain anonymous? Is there something like DNS round-robin for Tor? Are there documented best practices for running hidden services?
grep "Welcome to my dissident homepage!"
on all your customers' servers? Thanks!". Even if that doesn't happen, traffic analysis can identify my server in this case just as well.