How does Tor guarantee anonymity of Tor network?

Question

To me it seems that the only thing Tor is doing for anonymity (not security!) is the fact that it does not record the traffic in and out, because obviously if every router was recording the traffic going through it (let alone publish that information), every pathway would be clearly visible and then anyone could backtrace anyone.

But how does Tor guarantee that nodes do not log their traffic and/or send them to an adversary? I would bet that all NSA-helded routers would keep track of this and I bet that most of private-held routers would also do this since Tor is open-source and since people are naturally driven for evil.

Anonymity would still work if the nodes did not cooperate with each other (sharing traffic logs) or if the data passed through one honest node that does not log any information, but it's still a major flaw if most of the network you don't know if you can trust.

So how does the Tor network know whether to trust a node not to send traffic information to an adversary or to make it publically available?

Answer 1

It doesn't guarantee anonymity if enough of the network is controlled by a single adversary. There's no general way you can do so; if your whole connection goes entirely through adversary-run computers, your adversary is going to be able to track it, no matter what system you're using.

What Tor does is make it really, really, really hard for an adversary to control enough of the network to make this happen. It passes each connection through multiple nodes, so you have to control enough nodes that not just one but at least three nodes selected from the list are yours (in specific cases, it may use more than three). The reason Tor works is that with a single Tor network, you have lots and lots of people running Tor servers; an adversary has to compete with tons of legitimate nodes. It's the same basic idea as Bitcoin - make it so an attacker inherently has to compete with legitimate users, and then the bigger the system gets the harder it is to attack.

Answer 2

Like cpast mentioned Tor does not guarantee anonymity if large portion of the network by capacity (not by number of relays) is controlled by colluding advesaries. This is because one relay at 100 MB/sec capacity is effectivly is eqivalant to 100 relays at 1 MB/sec capacity. So it is the colluding adversaries's total employed data capacity to total capacity of the Tor network which determine capability of adversaries to undermine the anonymity of clients. By this account for example adveraries might have only few hundred high capacity relays but control half of all Tor data capacity. In this case they can de-anonymize most Tor users in a relatively short period of time. Tor folks encourage all entities to add as many relays as they wish to the network, and there is little verifiable evidence that these entities do not record or log whatever data they wish to record like what you said. Knowing this fact and all the snooping that is going on according to pulished material in journals especially in last two years, point to the direction that one should be prudent and take the claim of anonymity provided by Tor or any other anonymity network with grain of salt.