I know if I use Tor and maybe made a tweet, it gives the government a really tough time tracing the originator. But what if like a police car was directly outside my home for instance. Is it still difficult or straightforward to know what I'm doing now? So I mean me being directly monitored is Tor still a good option? What is a good option in this case?

2 Answers 2


If an entity with government-like budgets is after you specifically, you're in big trouble, and no simple software system can save you. You need serious spy skills ;-)

More to the point...

Perhaps the biggest problem with Tor is correlation attacks. There has been some new research in this area of late that is causing some justifiable heartburn.

The basic idea is that when you take some online action (like sending a tweet) your computer generates a series of packets that get transmitted via the tor network. These packets are encrypted, but they are emitted at certain times and in a certain order. If the person trying to de-anonymize you can log the local traffic at your house AND the traffic coming in to Twitter, they can:

  • find the set of packets arriving at twitter that produce the tweet in question.
  • look at the spacing of those packets in time (first packet, wait N milliseconds, second packet, wait M milliseconds, etc...)
  • compare that spacing of those packets to the spacing of the packets recorded coming from your network.
  • Even though they can't directly read the packets coming from your network, by matching them up against the packets arriving at the endpoint, they can gain a surprising level of proof that the packets originated with you.

It has long been known that this could be done for a single user. The recent research I cited was successful around 80% of the time in de-anonymizing tor traffic.

  • The blog post you cited has a clarification of the researcher that not 80% of the traffic could be deanonymized, but they were successful in 80% of the experiments they did. The Tor Project explains this in another blog post.
    – qbi
    Jan 6, 2015 at 7:28
  • @qbi: great point. I have updated my answer
    – stochastic
    Jan 6, 2015 at 16:54

If you're using Twitter your government might not have a really hard time to get your data. The US government used a subpoena against Twitter in the past. Among the requested data were email and IP addresses. So if you're used your real IP address only once chances are that your government will find the originator. So you need to use Tor or another anonymisation technology every time you use Twitter. Please make sure to inform about some rules of operational security, because there are several risks which can lead to deanonymisation.

Assumed you use Tor every time and there is just an eavesdropper who watches your online activity. In the case of Twitter your activity will produce some kind of tweet (retweet, fav etc.) which is linked to your Twitter handle. An eavesdropper could see your online activity and select all Twitter customers which have activity in this time frame. When you're tweeting the next time the attacker does it again. Now there are two data sets which has users which were active both times and some are not. The attacker watches for users which were active in both data sets. Using this technique over and over (plus some more advanced statistical methods) the attacker will be able to guess which Twitter handle corresponds to you.

Furthermore an attacker might do a forensic analysis of your computer. A researcher did this a while back and found some files which changed during installation and usage. This way an attacker might be able to guess that you're are using Tor to connect to the web. So a further attack might be to block every connection from your computer to the Internet. So Tor will not work anymore and you are forced to use another circumvention technology. But this will also not work. Only when you visit Twitter with a direct connection the attacker will allow it and so be able to see which Twitter handle you are using.

When everything else fails an attacker might also be able to install some kind of malware or keylogger on to your system. Now you're usually lost.

So there are several ways to attack you. There is no need that someone places a police car outside your door. Usually this raises suspicion. Monitoring online activity and some active attacks might give better results for the attacker.

Generally when someone targets you and your online activity you are better off using a tool like Tor and stick to some strict rules of operational security.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .